[Squid] Google SafeSearch and SSL Search

[jinnantonnixx]

The problem: Cannot filter queries as Google search is using SSL

 

https://support.google.com/websearch/answer/186669?hl=en

 

Google say: "To utilize the no SSL option for your network, configure the DNS entry for Google to be a CNAME for nosslsearch.google.com." Which is brilliant advice, but doesn't work on MS Server 2008R2 DNS.

 

So, here's my kludge if it's of use to anyone. I'm using Squid on Centos servers, by the way.

I wrote a bash script which runs daily and looks up the IP address for "nosslsearch.google.com" and adds these entries to the Squid server's hosts file.

You must remove any 'dns_nameservers' from your squid.conf

 

Here's the bash file which should live in /etc/cron.daily

 

# rebuilds host file with google's non-ssl seach address

# rename the existing hosts file
mv /etc/hosts /etc/hosts.bak

# copy the old hosts file to a new hosts file, minus any lines containing 'google'
grep -v google /etc/hosts.bak > /etc/hosts

# get the latest IP address
IP_RESULT=`nslookup nosslsearch.google.com | tail -n 2 | cut -f 2 -d ":" | cut -f2 -d " "`

#if IP_RESULT is not NXDOMAIN, add the new IP records, otherwise do nothing

if [ "$IP_RESULT" !=  "NXDOMAIN" ]
then
echo $IP_RESULT www.google.co.uk >> /etc/hosts
echo $IP_RESULT www.google.com >> /etc/hosts
fi

[localzuk]

Can I just ask what you mean by the DNS advice doesn't work in 2k8R2 DNS? I do various DNS spoofing things here and they're running in 2k8 r2 and 2012 just fine?

[jinnantonnixx]

I take it you're making a stub zone plus an 'A' record for http://www.google.com? We didn't want to do that.

 

You can make an alias if you have a 2003 or 2008 server, but not 2008R2. Before 2008R2, it was possible to create a zone for http://www.google.com and add a single CNAME record which would successfully alias the name.

 

The problem is fully covered here:

http://social.technet.microsoft.com/Forums/en-US/eebd5c3f-8d96-4014-9852-f3028c71d930/implementing-cname-wwwgooglecom-pointing-to-nosslsearchgooglecom-without-making-dns-server?forum=winserverDS

 

I'm very late to this party so the above kludge to the server's hosts will have do for now, unless there's a better solution.

Edited December 5, 2013 by jinnantonnixx

[localzuk]

Yeah, that's how we do it. Works well.

[jinnantonnixx]

Can I just ask what you mean by the DNS advice doesn't work in 2k8R2 DNS? I do various DNS spoofing things here and they're running in 2k8 r2 and 2012 just fine?

 

I'm guessing you've done this:

How to be Authoritative for a Single Host Name in DNS | ITGeared.com

 

Does it work for this problem - i.e. are your google searches using regular http (with the google bubble hinting at content filtering)?

Edited December 5, 2013 by jinnantonnixx

[localzuk]

Yeah, that's it. We don't do it for Google - our ISP does the SSL thing for us at their end. But for other site redirections it works well.