You may want to learn how ftp works and https. Proxying them transperently is extremely difficult. https is encrypted from server to client. Unless your proxy server does a man in the middle and you install a root cert you control on the clients it won't work to well. Kurt Seifried, kurt@seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/security/ ----- Original Message ----- From: "Andreas Niederstadt" To: "Mark Tinka" Cc: "SuseSecList" Sent: Wednesday, November 07, 2001 1:30 AM Subject: Re: [suse-security] Transparent Proxy help

Hi there

Thanks for your attempt to help, but obviously I did not describe the topic as I wanted to do. So, here again: Suse Documentation on Firewall2 which came with Upgrade 7.2 says, you can set the variable FW_REDIRECT_TCP to a value like "192.168.0.0/16,0/0,80,3128" which redirects the http port to squid. The same should be possible with any other protocol handled by squid(e.g. 21, 443). Within the squid.conf file you set the variable "http_accel_port" to 80. This works fine for http! But now here we are. How o I tell squid to listen for ports 21 and 443 as well. I search most of the squid related web sites FAQ's etc but I didn't find any instruction which says type in http_accel_port 80,21,443 or somthing like that (By the way: notation given before does not work!). So, If anyone out there has any Idea how to do, please let me know.

thx

Andreas Niederstadt

Am Mittwoch den, 7. November 2001, um 06:40, schrieb Mark Tinka:

...

one of the problems with transparent proxy is that you cannot redirect FTP.. there is thrid party software that can be used to transparently redirect FTP traffic.. otherwise to use Squid with FTP u will need to go traditional and place the squid IPs in the browser....

SSL is a default in squid.conf.. however, if u get probelms trying to send it out, you may want to allow it outward on teh firewall.. i experienced this once after i upgraded to SuSE 7.2 .. once u set the firewall to let 443 destined packets out, Squid will handle transparent HTTPS okay...

good luck..

AKNIT

--- Andreas Niederstadt wrote: >

...

Hi out there

...

I'm new at this list and so I'm asking to pardon

...

'political correct'. My problem is quite simple but obviously not simple enough. I configured a Box using Suse 7.3 as transparent firewall using Firewall2 and Squid 2.4 stable beta. This works fine so far but now I would like to redirect not only http but ftp and https as well. I tried several kinds of notations to tell squid not only to listen for port 80 but for 21 and 443 as well. At least I have no Idea how to type in that instruction correctly into

me if not being that squid.conf file. If

...

anybody out there knows how to deal, please let me know.

thxs

Andreas Niederstadt

––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

...

Niederstadt EDV Service Lettenstrasse 29 D - 79424 Auggen Tel: +49 (0)7631 173715 Fax: +49 (0)7631 173716 E-Mail: adowntown@mac.com

––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

...

...

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

__________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– Niederstadt EDV Service Lettenstrasse 29 D - 79424 Auggen Tel: +49 (0)7631 173715 Fax: +49 (0)7631 173716 E-Mail: adowntown@mac.com ––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com