[gentoo] how to make squid a https proxy

[RabbieBurns]

Ive got a squid proxy running and its working great. How though can I make it so that its a https proxy and that everytihing between me and the proxy gets encrypted?

 

edit: its not an internal proxy I use it from external only

[RabbieBurns]

anyone able to poiint me in the right direction i might be able to find any docs?

[benaus]

Quotes from here

Finally, as far as transparently proxing HTTPS (e.g. secure web pages using SSL, TSL, etc.), you can't do it. Don't even ask. For the explanation, do a search for 'man-in-the-middle attack'. Note that you probably don't really need to transparently proxy HTTPS anyway, since squid can not cache secure pages.

 

 

I havent tried it but am going to go on that. There was a few more sites that said the same.

[RabbieBurns]

Its not a transparent proxy and Im not using it as caching. Im using it from external from the network so I can browse using my networks IP. It has authentication enabled.

 

What im looklng for is for the connection from wherever i am in the world back to the proxy server to be encrypted.

 

Is that possible?

[Chillibear]

If you don't want to bother with the Squid and you've got SSH access to the server just setup a SSH proxy connection to the machine and point your browser's socks proxy to the localhost. Essentially:

ssh -D 8080 -Nf [email protected] 

Then set the socks proxy to: localhost:8080

If you google for proxy via ssh or something you'll find more detailed notes

 

Otherwise again using SSH, you can do some port redirection (tunnel) to get the connection to go via your server:

ssh -L 8080:localhost:8000 [email protected] 

Where 8000 is the port your squid is listening on and 8080 is the port you'll forward data locally from. So in this configuration you'd set your HTTP proxy up as localhost:8000 and that should send all traffic to myserver.com:8000 but over the encrypted SSH tunnel.

Again google for ssh local port forwarding and you should find more information

Edited January 10, 2010 by Chillibear

[RabbieBurns]

IVe already got openvpn set up for complete ssl tunneling from my main computers

 

I was just looking for a simple way that if i sat down at a random computer, internet cafe etc for example, i could just change the browser proxy and have a secure proxy.

 

Seems I cant. No worries.

 

Cheers

[tom_newton]

That's correct - you can't do this reliably. Even if you could force all traffic between you and the proxy into https, you'd still have the authentication issue - preventing other people from doing the same. You could use proxy auth there I suppose - but a VPN is neater.

 

You could try setting up one of the page translation proxies students use to get around web filters - they can run https, and you can reasonably easily authenticate it.

[RabbieBurns]

That's correct - you can't do this reliably. Even if you could force all traffic between you and the proxy into https, you'd still have the authentication issue - preventing other people from doing the same. You could use proxy auth there I suppose - but a VPN is neater.

 

You could try setting up one of the page translation proxies students use to get around web filters - they can run https, and you can reasonably easily authenticate it.

 

Ive got proxy auth all set up for squid as it is now to stop randoms from using it.

 

I tried php-proxy or whatever it was but it doesnt really work very well.

 

No worries.. Ill just keep it as is. Cheers for the replies