Repository navigation
How to enable SSL #68
Description
Activity
Same question
It looks like the
squidin Ubuntu's bionic repository is not built with--enable-ssl. This docker image just pulls from Ubuntu usingapt.I managed to work around it by basing the image off
alpineinstead.Step 1: Clone the repo
git clone https://github.com/sameersbn/docker-squid.git cd docker-squidStep 2: Modify the Dockerfile:
nathan@nathanb-dev ~/src/docker-squid (git)-[master] % cat Dockerfile FROM alpine:latest LABEL maintainer="sameer@damagehead.com" ENV SQUID_CACHE_DIR=/var/spool/squid \ SQUID_LOG_DIR=/var/log/squid RUN apk update \ && apk add bash squid COPY entrypoint.sh /sbin/entrypoint.sh RUN chmod 755 /sbin/entrypoint.sh EXPOSE 3128/tcp ENTRYPOINT ["/sbin/entrypoint.sh"]Note that you get squid4 instead of squid3, as I don't do the version selection that this repository's dockerfile does.
Step 3: Modify the entrypoint script
The twochownlines should use thesquiduser and group.Step 4: Build the image
nathan@nathanb-dev ~/src/docker-squid (git)-[master] % docker build -t mysquid --no-cache .Step 5: Run the image
nathan@nathanb-dev ~ % docker run --rm -it --name squid -p 3128:3128 -p 3129:3129 -v /home/nathan/tmp/squid.conf:/etc/squid/squid.conf -v /home/nathan/tmp/squidlogs:/var/log/squid -v /tmp/test/certificate.pem:/etc/squid/certificate.pem localsquid:latestHope this helps!
Reacted by Mabel Lee, Alexander Overvoorde, Kieran Bristow and Shahrad ElahiWhy one more port 3129? is it for https ?
If you want to run my container that I built using the recipe I give above, I put it on Dockerhub: https://hub.docker.com/repository/docker/sysdignathan/secure-squid
nathan@nathanb-dev ~/tmp % cat squid.conf http_port 3128 https_port 3129 cert=/etc/squid/proxy.pem dns_v4_first on acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl CONNECT method CONNECT http_access allow localnet http_access allow localhostHere's a minimal config that allows connections from inside the local network only on either plaintext (3128) or encrypted (3129).
How do you add certificates?
E.g:
https_port 3129 bump ssl-bump \ cert=/etc/squid/squid-ca-cert-key.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=16MB@taras-vibes you see on line 2 of the config I posted that there's
cert=/etc/squid/proxy.pem? You just have to mount the certificate into the container at that path as part of thedocker runcommand. For example:docker run --rm -it --name squid -p 3128:3128 -p 3129:3129 -v /home/nathan/proxy/squid.conf:/etc/squid/squid.conf -v /home/nathan/proxy/squidlogs:/var/log/squid -v /home/nathan/proxy/cert.chain.pem:/etc/squid/proxy.pem sysdignathan/secure-squid:latestThe last
-vmounts the local cert into the container at the right location for squid to find and use it.Reacted by Mark StewardHey @nathan-b thanks for your response:
Yes, I do have files in /etc/squid:
ls /etc/squid/squid-ca-cert-key.pem /etc/squid/squid-ca-cert-key.pem
When I curl it:
curl --proxy-insecure --proxy https://localhost:3129 https://skarnet.org/software/s6/
I see logs in/var/log/squid/access.log:
1711558523.802 119 192.168.65.1 TCP_MISS/200 20284 GET http://www.google.com/ - HIER_DIRECT/142.250.190.68 text/html 1711558526.013 134 192.168.65.1 TCP_MISS/200 20195 GET http://www.google.com/ - HIER_DIRECT/142.250.190.68 text/html 1711560575.965 1563 192.168.65.1 TCP_TUNNEL/200 22989 CONNECT skarnet.org:443 - HIER_DIRECT/95.142.172.232 - 1711560578.331 855 192.168.65.1 TCP_TUNNEL/200 22989 CONNECT skarnet.org:443 - HIER_DIRECT/95.142.172.232 -It keeps missing on google, but I guess that is expected.
What is TCP_TUNNEL/200 ? Does that mean it has been cached successfully on Secure 3129 port?@taras-vibes yes, you can read the squid docs to understand the format of the logs, but essentially it means that a TCP tunnel has been successfully established between your system (
192.168.65.1) and the destination (95.142.172.232)
When building squid normally you run the following:
./configure --enable-ssl --enable-ssl-crtd ...How do I enable this in the docker container?