We help IT Professionals succeed at work.

block https tunnelling with squid

3,029 Views
Last Modified: 2012-05-06
Hi, how can I block http & https Tunneling with squid? without stopping normal traffic.
Thanks
Comment
Watch Question

Mal OsborneAlpha Geek
CERTIFIED EXPERT

Commented:
You can't.  HTTPs is encrypted, Squid therefore cannot tell what is in each packet. If you can identify a lot of HTTPs traffic going to a particular site, you could block it by IP.  Kinda cat & mouse game with your users though.

Commented:
Hi, nice subject

Some things to do :
1) when you know someone is using a https server to tunnel some traffic, you might just want to block its IP. But he'll use another one...

2) If your user is tunneling with SSH on a SSH server running on port 443 (to make squid think it's just allowed https traffic), you have to detect the so-called https server is a SSH server. Just telnet to its IP on port 443, you'll see it (except if your user has recompiled the ssh server to make it answer like a web server... or if he managed to detect it's not coming from him but from someone else and is thus redirecting traffic to a real https server - this guy would be really boring), see :
telnet my.ssh.server 443
Trying 88.x.y.z...
Connected to my.ssh.server.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1p1 Debian-5

But again, you'll just have to block the IP.

3) depending on your company, you might remind everyone the rules of your company's internet access, particularily on tunneling stuff, for security concerns. He might stop, knowing he's being watched.

4) if it's a pure stunnel, I don't think you can detect anything. You'll just have some clues about the guy and then can discuss, see point 3

5) maybe an advanced sniffing technique might give the proof it's something tunneled... but what would be the cost of detecting this for every https traffic...

Just a tip: when someones uses internet a lot and just have a few CONNECT hits in squid's log, he's tunneling everything :) that might help analyzing the logs

GOOD LUCK
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.