Netscreen + Squid (Transparent) + c-icap + ClamAV

缺乏、安全感 2022-09-27 14:22 27阅读 0赞

架構圖：

[![squid][]][squid 1]

目的：  
原始流往網際網路的WEB流量經過防火牆Netscreen-25重新導向內部的Squid proxy伺服器並提供掃毒需求.

方法：  
透通式SQUID可以省去客戶端設定的麻煩, 但需將 TCP 80 流量重新導向. Netscreen 支援兩種導向方式, 介紹如下

*  NAT-DST(DNAT)  
    NETSCREEN NAT-DST的限制如下(來源：ScreenOS參考指南)  
    「注意 : 原始目的地IP位址及已轉譯的目的地IP位址必須在相同的安全區內」  
    由於向外WEB流量在untrust (any), 因此SQUID伺服器也必須在DMZ或有MIP, 且必須允許untrust介面IP流向SQUID位址DMZ/MIP TCP:3128流量. 另外內部流量向untrust的TCP:80封包必須DNAT到SQUID伺服器MIP位址的TCP:3128. 該方式會造成統計SQUID流量時看到的都是防火牆作NAT介面的外部IP, 無法統計實際流量. 原本想把SQUID 內部IP加進untrust-vr, 然後DNAT到內部IP 也是不可行. 此方式可以在舊版ScreenOS(5.4之前)使用.
 *  PBR(Policy Base Routing. Screenos 5.4.0以上支援)  
    此方法可以直接將特定服務流量到向指定的IP但是不支援PAT, 也就是可以轉寄流量但是不能更改目的埠, 因此需要搭配在SQUID主機上執行IPTABLES以達成目的埠轉換..

考量流量分析精確性, Server安全性及架構, 這裡採用PBR以達到cache目的

1.  CentOS5主機安裝Squid 3.1  
    上http://rpm.pbone.net搜尋下載squid3-3.1.8-1.el5.pp.i386.rpm  
    \[root@centos5\]\# rpm –Uvh squid3-3.1.8-1.el5.pp.i386.rpm  
    修改 /etc/squid/squid.conf (只列出重點設定)
    
    \#上層伺服器  
    cache\_peer proxy.hinet.net parent 80 0 no-query no-digest no-netdb-exchange
    
    \#將連到youtube.com要求轉發給上層伺服器  
    cache\_peer\_domain proxy.hinet.net .youtube.com
    
    \#預設存取設定  
    acl manager proto cache\_object  
    acl localhost src 127.0.0.1/32 ::1  
    acl to\_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1  
    acl localnet src 10.0.0.0/8     \# RFC1918 possible internal network  
    acl localnet src 172.16.0.0/12  \# RFC1918 possible internal network  
    acl localnet src 192.168.0.0/16 \# RFC1918 possible internal network  
    acl localnet src fc00::/7       \# RFC 4193 local private network range  
    acl localnet src fe80::/10      \# RFC 4291 link-local (directly plugged) machines
    
    \# ACL for Youtube  
    acl youtube dstdomain .youtube.com
    
    acl SSL\_ports port 443  
    acl Safe\_ports port 80          \# http  
    acl Safe\_ports port 21          \# ftp  
    acl Safe\_ports port 443         \# https  
    acl Safe\_ports port 70          \# gopher  
    acl Safe\_ports port 210         \# wais  
    acl Safe\_ports port 1025-65535  \# unregistered ports  
    acl Safe\_ports port 280         \# http-mgmt  
    acl Safe\_ports port 488         \# gss-http  
    acl Safe\_ports port 591         \# filemaker  
    acl Safe\_ports port 777         \# multiling http  
    acl CONNECT method CONNECT
    
    \# 讓Youtube 使用上層, 其餘由squid本身直接存取  
    never\_direct allow youtube  
    http\_access allow manager localhost  
    http\_access deny manager  
    http\_access deny !Safe\_ports  
    http\_access deny CONNECT !SSL\_ports  
    http\_access allow localnet  
    http\_access allow localhost
    
    \# ssl代理  
    ssl\_bump deny localhost  
    ssl\_bump allow all  
    http\_access deny all
    
    \# 透通代理http  
    http\_port 3128 intercept
    
    \# 透通代理https.基本上不建議在透通模式下啟用.必須置換憑證以解密ssl流量, 因此需要正式憑證, 若使用測試憑證client端會跳出此網站不安全的訊息  
    https\_port 3129 intercept ssl-bump cert=/etc/pki/tls/certs/testcert.pem
    
    hierarchy\_stoplist cgi-bin ?
    
    \# 將儲存區上限改為1gb.  
    cache\_dir ufs /var/cache/squid 1000 16 256  
    coredump\_dir /var/cache/squid  
    refresh\_pattern ^ftp:           1440    20%     10080  
    refresh\_pattern ^gopher:        1440    0%      1440  
    refresh\_pattern -i (/cgi-bin/|\\?) 0     0%      0  
    refresh\_pattern .               0       20%     4320
    
    \#ICAP設定  
    icap\_enable on  
    icap\_preview\_enable on  
    icap\_preview\_size 128  
    icap\_send\_client\_ip on  
    icap\_service service\_avi\_req reqmod\_precache 0 icap://localhost:1344/srv\_clamav  
    icap\_service service\_avi respmod\_precache 1 icap://localhost:1344/srv\_clamav  
    adaptation\_access service\_avi\_req allow all  
    adaptation\_access service\_avi allow all
    
    \#將錯誤顯示頁面設為中文  
    error\_default\_language zh-tw
    
    設定開機即啟用服務
    
    \[root@centos5\]\# chkconfig –add –level 2345 squid
2.  設定iptables  
    加入規則
    
    \[root@centos5\]\# iptables -A PREROUTING -i eth0 -p tcp -m tcp -m multiport tcp -d 10.0.0.2 –dport 80,443 -j ACCEPT  
    \[root@centos5\]\# iptables -A PREROUTING -i eth0 -p tcp -m tcp ! -d localhost –dport 80 -j REDIRECT –to-port 3128  
    \[root@centos5\]\# iptables -A PREROUTING -i eth0 -p tcp -m tcp ! -d localhost –dport 443 -j REDIRECT –to-port 3129
    
    Squid伺服器本身有提供Web服務, 因此第一行需放行目的為本機IP的TCP 80,443封包, 第二行將連往網際網路TCP 80的封包重新導向Squid服務的TCP 3128. 第三行則將連往網際網路TCP 443的封包重新導向Squid服務的TCP 3129.  
    啟動並儲存規則
    
    \[root@centos5\]\# service iptables start  
    \[root@centos5\]\# iptables-save > /etc/sysconfig/iptables  
    \[root@centos5\]\# chkconfig –add –level 2345 iptables
3.  設定NetScreen  
    PBR流程  
    [![policy][]][policy 1]3-1. 建立兩個acl存取名單. 第一組為來源IP是區域網路封包目標為網際網路網頁存取.第二組則為Squid伺服器本身的網際網路存取, 避免本身連向網路封包變成迴圈. CLI (指令模式)
    
    set access-list extended 1 src-ip 10.0.0.0/24 dst-port 80-80 protocol tcp entry 1  
    set access-list extended 1 src-ip 10.0.0.0/24 dst-port 443-443 protocol tcp entry 2  
    set access-list extended 2 src-ip 10.0.0.2/32 dst-port 80-80 protocol tcp entry 1  
    set access-list extended 2 src-ip 10.0.0.2/32 dst-port 443-443 protocol tcp entry 2
    
    3-2. 第一組acl加入Http\_Traffic群組(match-group), 第二組acl則加入Direct\_Http\_Traffic群組(match-group). CLI (指令模式)
    
    set match-group name Direct\_Http\_Traffic  
    set match-group Direct\_Http\_Traffic ext-acl 2 match-entry 1  
    set match-group name Http\_Traffic  
    set match-group Http\_Traffic ext-acl 1 match-entry 1
    
    3-3. Tproxy的執行動作設定為當符合Http\_Traffic群組的封包到達時直接送往Squid伺服器(10.0.0.2). Direct\_Http則將符合Direct\_Http\_Traffic群組送往untrust介面(eth3). CLI (指令模式)
    
    set action-group name Tproxy  
    set action-group Tproxy next-hop 10.0.0.2 action-entry 1  
    set action-group name Direct\_Http  
    set action-group Direct\_Http next-interface ethernet3 action-entry 1
    
    3-4. 建立政策(policy). 第一個先讓Squid本機連往網際網路, 若為其他客戶端則為順序2, 轉到Squid主機..
    
    set pbr policy name trust\_policy  
    set pbr policy trust\_policy match-group Direct\_Http\_Traffic action-group Direct\_Http 1  
    set pbr policy trust\_policy match-group Http\_Traffic action-group Tproxy 2  
    set pbr trust\_policy  
    exit
    
    3-5. 將政策連結到trust介面(eth1).CLI (指令模式)
    
    set interface ethernet1 pbr trust\_policy
4.  安裝Clamav  
    \#搭配MailScanner 因此安裝 Clamd
    
    \[root@centos5\]\# yum install clamav clamav-db clamd
5.  安裝c-icap  
    上http://rpm.pbone.net搜尋下載c-icap , c-icap-modules的source rpm回來編譯
    
    \[root@centos5\]\# rpmbuild –rebuild c-icap-0.1.1-1.el5.pp.src.rpm
    
    編譯完成後會有多個檔案主要安裝下面幾個  
    c-icap-0.1.1-1.el5.pp.i386.rpm      \# c-icap主程式  
    c-icap-libs-0.1.1-1.el5.pp.i386.rpm   \# library  
    c-icap-progs-0.1.1-1.el5.pp.i386.rpm  \# client程式  
    c-icap-devel-0.1.1-1.el5.pp.i386.rpm  \# 編譯c-icap-modules用  
    下載的c-icap-modules並無開啟clamv, 需自行修改並編譯
    
    \[root@centos5\]\# rpmbuild -i c-icap-modules-0.1.1-1.el5.pp.src.rpm  
    \[root@centos5\]\# cd /usr/src/redhat/SPECS
    
    更改c-icap-modules.spec檔案, 註釋掉」–without-clamav」
    
    CFLAGS="$\{RPM\_OPT\_FLAGS\} -fno-strict-aliasing" \\  
    –enable-shared                                \\  
    –with-bdb  
    \#       –without-clamav  \# Still not in RedHat/CentOS
    
    重編
    
    \[root@centos5\]\# rpmbuild -bb c-icap-modules-0.1.1-1.el5.pp.src.rpm  
    \[root@centos5\]\# cd ../RPMS/i386  
    \[root@centos5\]\# rpm –Uvh c-icap-modules-0.1.1-1.el5.rpm
    
    修改c-icap server設定 /etc/c-icap/c-icap.conf
    
    PidFile /var/run/c-icap/c-icap.pid  
    CommandsSocket /var/run/c-icap/c-icap.ctl  
    Timeout 300  
    MaxKeepAliveRequests 100  
    KeepAliveTimeout 600  
    StartServers 3  
    MaxServers 10  
    MinSpareThreads     10  
    MaxSpareThreads     20  
    ThreadsPerChild     10  
    MaxRequestsPerChild  0  
    Port 1344  
    ServerAdmin 你的管理員郵件  
    ServerName 你的主機名稱  
    TmpDir /var/tmp  
    MaxMemObject 131072  
    DebugLevel 1  
    ModulesDir /usr/lib/c\_icap  
    ServicesDir /usr/lib/c\_icap  
    TemplateDir /usr/share/c\_icap/templates/  
    TemplateDefaultLanguage en  
    LoadMagicFile /etc/c-icap/c-icap.magic  
    RemoteProxyUsers off  
    RemoteProxyUserHeader X-Authenticated-User  
    RemoteProxyUserHeaderEncoded on  
    \#本機存取位址  
    acl localhost src 127.0.0.1/255.255.255.255  
    \#所有位置  
    acl all src 0.0.0.0/0.0.0.0  
    \#允許本機存取  
    icap\_access allow localhost  
    \#拒絕所有存取  
    icap\_access deny all  
    \#Log檔位置  
    ServerLog /var/log/c-icap/server.log  
    AccessLog /var/log/c-icap/access.log  
    \#以下三行設定病毒紀錄檔格式及位置  
    acl VIRUS icap\_resp\_header\{X-Infection-Found\} /Type=.\*/  
    LogFormat viruslog “%tl, %>a %im %iu %is %\{X-Infection-Found\}<ih:"  
    AccessLog /var/log/c-icap/viruses.log viruslog VIRUS  
    Service echo srv\_echo.so  
    \#開啟clamav模組掃瞄功能  
    Include srv\_clamav.conf
    
    修改c-icap-modules設定, 基本上維持預設值即可
    
    Service antivirus\_module srv\_clamav.so  
    ServiceAlias  avscan srv\_clamav?allow204=on&sizelimit=off&mode=simple  
    srv\_clamav.ScanFileTypes TEXT DATA EXECUTABLE ARCHIVE GIF JPEG MSOFFICE  
    srv\_clamav.SendPercentData 5  
    srv\_clamav.StartSendPercentDataAfter 2M  
    srv\_clamav.MaxObjectSize  5M  
    srv\_clamav.ClamAvTmpDir /var/tmp  
    srv\_clamav.ClamAvMaxFilesInArchive 0  
    srv\_clamav.ClamAvMaxFileSizeInArchive 100M  
    srv\_clamav.ClamAvMaxRecLevel 5
    
    此rpm所提供的init script以c-icap身份啟動, 經測試無法正常啟動.改以root啟動卻無問題, 因此修改/etc/sysconfig/c-icap
    
    \#改掉下面這行, 將使用者改為root  
    \#RUN\_AS="c-icap"  
    RUN\_AS="root"
    
    也可以到官網[http://c-icap.sourceforge.net][http_c-icap.sourceforge.net] 下載最新0.1.2版自行安裝, 但原始package並未包含init script/syconfig/logrotate檔.  
    設定開機啟動
    
    \[root@centos5\]\# chkconfig –add –level 2345 c-icap
6.  啟動相關服務
    
    \[root@centos5\]\# service c-icap start
    
    \[root@centos5\]\# service squid start
7.  測試掃毒功能
    
    \[root@centos5\]\# c-icap-client -f /path\_to\_clamav/test/clam.exe -s “srv\_clamav?allow204=on&force=on&sizelimit=off&mode=simple"  
    ICAP server:localhost, ip:127.0.0.1, port:1344  
    <html>  
    <head>  
    <!–C-ICAP/0.1.2 srvClamAV module –>  
    </head>  
    <body>  
    <H1>VIRUS FOUND</H1> You try to upload/download a file that contain the virus<br>  
    ClamAV-Test-File  
    <p>This message generated by C-ICAP/0.1.2 srvClamAV/antivirus module  
    <!– And this is a silly HTML comment just to make this error bigger than 512 bytes  
    is allowed to be displayed in IE. Yes, IE has a “feature" which does not allow  
    error messages smaller than 512 bytes to be displayed, because they are not considered  
    “friendly" enough.  
    (Hmm…I think this stupid comment is better than embedding viruses or porn images in this error message like a bad guy suggested me!)–> </body>
    
    顯示掃到毒(clamav原始package內附的樣本)
8.  結論：大致上需要的功能皆已完成, Squid部份可以進行校調以增加cache命中率.

[squid]: http://jameschien.no-ip.biz/wordpress/wp-content/uploads/2010/11/squid_thumb.jpg
[squid 1]: http://jameschien.no-ip.biz/wordpress/wp-content/uploads/2010/11/squid.jpg
[policy]: http://jameschien.no-ip.biz/wordpress/wp-content/uploads/2010/11/policy_thumb.jpg
[policy 1]: http://jameschien.no-ip.biz/wordpress/wp-content/uploads/2010/11/policy.jpg
[http_c-icap.sourceforge.net]: http://c-icap.sourceforge.net/