WBITT

We Bring In Tomorrows Technology

  • Full Screen
  • Wide Screen
  • Narrow Screen
  • Increase font size
  • Default font size
  • Decrease font size

Fully Transparent + Tproxy + Bridge + Interception + Windows Authentication

E-mail Print PDF
User Rating: / 10
PoorBest 

Fully Transparent + Tproxy + Bridge + Interception

A proxy is a server-like program, receiving requests from clients, forwarding those requests to the real server on behalf of the user, and returning the response as it arrives.

Proxies read and parse the application protocol, and reject invalid traffic. So using proxies on a firewall to mediate requests means higher level of security, than packet filtering firewalls.

Simple, non-transparent proxying is somewhat difficult to manage and administer since each client program must be set up to use proxies.

Transparent proxy

To simplify management tasks of clients sitting behind proxy firewalls, the technique 'transparent proxying' was invented. Transparent proxying means that the presence of the proxy is invisible to the user. Transparent proxying however requires kernel support.

Packet filters packages lacking

Real transparent proxying requires the following three features from the IP stack of the computer it is running on:

  1. Redirect sessions destined to the outer network to a local process using a packet filter rule.
  2. Make it possible for a process to listen to connections on a foreign address.
  3. Make it possible for a process to initiate a connection with a foreign address as a source.

To increase the efficiency of our internet connection, we use a caching web proxy. A web proxy makes the HTTP request on behalf of the client, and caches the result for later. That way, if multiple users request the same document, the cache can serve its local copy, rather than wasting bandwidth. This has two benefits: users get their content faster (when it’s cached), and the internet connection isn't bogged down with duplicate requests.

Tproxy enable a special feature that allow spoofing request from squidbox  to destination , in this way the remote host will see the real ip of the client instead of the ip of the squidbox.

We use our Squid box as a bridging interception proxy. This means that the machine acts as a bridge, and is inserted "inline" between other network devices (in our case, just before our firewall). Additionally, Squid is configured as an interception proxy, which means that it will grab requests destined for port 80 (the standard HTTP port) and run them through the caching engine. Connections not bound for port 80 are passed straight through the bridge.

This setup is advantageous because it makes the proxy completely invisible to the rest of the network (and the users). If we need to, we can simply take the machine out of the network and everything will continue to work just as before (except that it's not being cached). No settings on the client machines need to change.

However, this setup requires compiling our own Linux kernel, and also our own version of Squid. We'll walk you through the steps below.

Note: these steps assume Debian Linux ("Etch" is the release we're using). If you use a different system you may need to compile according to your distribution's conventions.

TARGET:
First of all showing our target what we will achieve till end of this article.

Workstation: 10.101.88.85
Squidbox   : 172.25.12.4
Webserver  : 192.168.1.100

You will see in apache logs of Webserver the ip addres of Workstation instead the Squidbox one. Also in access.log you will see all the traffic for http that it cames from Workstation.

Preparing the System

First, set some environment variables so your custom builds will have sane values in the description files:

export DEBFULLNAME="M.Adnan shahzad"
export DEBEMAIL="adnan.shahzad@your_org.edu.pk"

Now we need to download all the components necessary to build packages on our system. Make sure your package repository listing is up-to-date:

apt-get update

Move into the source directory on the machine:

cd /usr/src

Now we need to download a special patch for bridging proxy support in the kernel and iptables, and unpack it.

wget http://www.balabit.hu/downloads/files/tproxy/obsolete/linux-2.6/cttproxy-2.6.18-2.0.6.tar.gz
tar -zxf cttproxy-2.6.18-2.0.6.tar.gz

We are now ready to fetch and build the three other components we need: the kernel, iptables, and squid

Kernel Compilation

First, fetch the kernel package and all of the packages necessary to build a kernel (you can put the following command all on one line):

apt-get install linux-source-2.6.18 kernel-package libncurses5-dev \
fakeroot bzip2 build-essential dpatch devscripts

This will put a tarball of the Linux source in /usr/src. Go there and unpack it:

cd /usr/src
tar -jxf linux-source-2.6.18.tar.bz2

Now move into the Linux source directory:

cd linux-source-2.6.18

You need to apply the patches included with the tproxy download you got earlier:

for patch in ../cttproxy-2.6.18-2.0.6/patch_tree/*.patch
do patch -p1 < $patch
done

 

Now it's time for a standard Debian kernel build. I suggest making based on the existing config:

make oldconfig

(You may also use make menuconfig for a graphical interface.)

That will ask you about the new features added by the patch. You want to enable the following:


If you want iptables as a module:

Loadable module support --->
[*] Enable loadable module support
[ ] ...
[*]   Automatic kernel module loading



NOTE As of kernel 2.6.20 (as of 2.6.19) you Must enable the following

Networking  ---->
Networking options  ---->
[*]   IP: advanced router
802.1d Ethernet Bridging

Network packet filtering framework (Netfilter)--->
[*]   Bridged IP/ARP packets filtering (NEW)
Core Netfilter Configuration ---->
[*] Netfilter connection tracking support--->
["enable"] Layer 3 Dependent Connection tracking (OBSOLETE)
[*] Netfilter Xtables support (required for ip_tables)
[*] "state" match support
IP: Netfilter Configuration --->
IP tables support (required for filtering/masq/NAT)
Full NAT


When you enable full nat then will appear this section

IP: Netfilter Configuration --->
Transparent proxying
tproxy match support
TPROXY target support


Now is time for bridge netfilter:

Network packet filtering framework (Netfilter)--->
Bridge: Netfilter Configuration  --->
Ethernet Bridge tables (ebtables) support
ebt: broute table support

 

You're now ready to build the kernel:

make-kpkg clean
make-kpkg --rootcmd fakeroot --initrd --append-to-version=-tproxy.1.0 kernel_image

Wait a while for the kernel to compile. When it's done you'll have a linux-image package in /usr/src. Go ahead and install it:

cd /usr/src
dpkg -i linux-image-2.6.18*.deb

If the installation was successful, then we're almost done (with the kernel, anyway).

We want to load the tproxy modules by default, so add the following lines to the end of your /etc/modules file:

ip_tables
iptable_filter
ipt_TPROXY
ipt_tproxy

Reboot your machine into the new kernel. You can confirm the version by running uname -a. You can confirm that tproxy was installed by running:

dmesg | grep TPROXY

 

IPTables Compilation

The new version of the kernel has a patched version of iptables support, which requires that we recompile the iptables binaries to match.

First, move into your source directory:

cd /usr/src

Next, get the source for iptables:

apt-get source iptables
apt-get build-dep iptables

Move into the source directory:

cd iptables-1.3.6.0debian1

Patch the sources:

Note: change of directory to inner iptables dir

cd iptables
patch -p1 < ../../cttproxy-2.6.18-2.0.6/iptables/iptables-1.3-cttproxy.diff
chmod +x extensions/.tproxy-test

Additionally, we need to copy our patched kernel sources into the iptables tree so it can build against them. Change back to the root iptables source tree:

cd /usr/src/iptables-1.3.6.0debian1

Now move the default linux dir out of the way:

mv linux linux-orig
mkdir linux

And copy your linux files in:

for x in COPYING Makefile include net
do cp -a /usr/src/linux-2.6.18/$x linux/$x
done

Now you're ready to build. Susbstitute your e-mail address in the build command:

dpkg-buildpackage -rfakeroot -us -uc -b –adnan.shahzad@your_org.edu.pk

You'll end up with an iptables .deb file in your /usr/src directory. You can move into that directory and install the package:

cd /usr/src
dpkg -i iptables_1.3.6.0debian1-5_i386.deb

To confirm that everything is working correctly, try the following command:

iptables -t tproxy -L

If that doesn't give an error, then all of the modules are installed correctly, and you're ready to go.

Squid Compilation

For maximum performance, the Squid maintainers recommend that you compile your own version of Squid from scratch. Additionally, our "tproxy" setup is not included in Debian, so we must compile our own anyway.

Change into the source directory:

cd /usr/src

Fetch the source for squid, and the build dependencies:

apt-get source squid
apt-get build-dep squid

 

./configure --prefix=/usr --exec_prefix=/usr --bindir=/usr/sbin --sbindir=/usr/sbin --libexecdir=/usr/lib/squid --sysconfdir=/etc/squid --localstatedir=/var/spool/squid --datadir=/usr/share/squid --enable-linux-netfilter --enable-storeio=ufs,aufs,diskd,null --enable-arp-acl --enable-removal-policies=lru,heap --enable-snmp --enable-delay-pools --enable-htcp --enable-poll --enable-cache-digests --enable-underscores --enable-referer-log --enable-useragent-log --enable-auth=basic,digest,ntlm --enable-carp --enable-large-files --enable-linux-tproxy --enable-delay-pools --enable-cache-digests --enable-poll --disable-ident-lookups --enable-truncate --enable-removal-policies --enable-delay-pools --enable-cache-digests --enable-poll --enable-arp-acl --disable-ident-lookups --enable-truncate --enable-auth=basic --enable-auth-helpers=NCSA --with-maxfd=8192 --enable-removal-policies=lru,heap --enable-storeio=diskd,ufs,aufs --enable-snmp --enable-icmp --enable-htcp --enable-external-acl-helpers="wbinfo_group" --enable-basic-auth-helpers=PAM --enable-ssl

We need to make the tproxy headers available to Squid for compilation. You can do this by running the following:

cp /usr/src/linux/include/linux/netfilter_ipv4/ip_tproxy.h \
/usr/include/linux/netfilter_ipv4/

 

You must also install libcap-dev to get the capabilities file for compiling Squid (if you don't do this, you'll see "CAP_NET" errors):

apt-get install openssl ssl-cert 
apt-get install libcap-dev

Also, be sure to add capability to your /etc/modules file (Debian doesn't load capabilities by default).

You may wish to set certain compiler flags (e.g., CFLAGS='-O2 -march=pentium4') before the build to include any processor-specific options.

Note: That these packages may only work for the architecture they're compiled for!

Now, build the package! Susbstitute your e-mail address in the build command:

dpkg-buildpackage -rfakeroot -us -uc -b 
 This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 

Once you've built the binary installation packages, you're ready to install them. They'll appear in the parent directory to your source folder, and there should be 4 Debian package files:

squid_2.6.5-6etch1_i386.deb
squid-cgi_2.6.5-6etch1_i386.deb
squidclient_2.6.5-6etch1_i386.deb
squid-common_2.6.5-6etch1_all.deb

You'll need to install any dependencies manually. At the moment, this includes lsb-base (for squid) and a web server (for squid-cgi).

To install lsb-base:

sudo apt-get install lsb-base

For a web server, you can go with the tried-and-true apache. However, we want as lightweight a server as possible, so we opt for thttpd:

sudo apt-get install thttpd

 

You can install the Debian packages using dpkg -i:

sudo dpkg -i /usr/src/squid*.deb

Once this is done, you should have Squid installed, and ready to configure!

Configuration

At this point, you should have Squid installed on your system. You can confirm this by typing squid -v on the command line. You should get back Squid's version, along with any compile-time options.

If you don't have Squid yet, visit the previous section for information on compiling it from scratch, or install a packaged version from your OS vendor. For example, you could say this under Debian:

sudo apt-get install squid squidclient squid-cgi

Now that you've got Squid, it's time to configure it. Squid has a great deal of run-time options, which affect how it caches documents. We've tuned our config to work with our particular needs; the descriptions below explain the choices we've made. You should make changes as you see fit.

Configure squid.conf to enable tproxy
There are two directive that enable tproxy in squid.conf

http_port 80 tproxy transparent
tcp_outgoing_address 172.25.12.4

Note:
if tcp_outgoing_address (squidbox ip) is not set you will see error like this
in /var/log/squid/cache.log :

-----------------------------------------------------------------------
2007/06/16 18:03:48| tproxy ip=172.25.12.4,0x20010ac,port=0 ERROR ASSIGN
2007/06/16 18:03:48| tproxy ip=172.25.12.4,0x20010ac,port=0 ERROR ASSIGN
-----------------------------------------------------------------------


Remember to enable debug with  debug_options ALL,1 in squid.conf to see what's wrong

 

Bridge Setup

We configure our system as a network bridge, which means that it sits between two physical devices on our network and relays the packets between them. However, there's a twist: we intercept certain packets (those destined for port 80) and shunt them to Squid for processing.

You'll need two ethernet cards in your machine to bridge between (one "in" and one "out", as it were). You can use another card for a management IP address, or you can actually assign an address to the bridge itself and reach the machine just as you would a "real" interface.

In order to set up the bridge, we need to make a few tweaks to the system. First, we need to install some software that's necessary for setting up a bridge:

apt-get install bridge-utils

Next, edit /etc/network/interfaces. You should already have a stanza for a statically configured interface (e.g., eth0). Keep the settings for the stanza, but replace the interface name with br0. Also, add the line bridge_ports eth1 eth2 to add them to the bridge. For example:

auto br0
iface br0 inet static
    bridge_ports eth1 eth2
    address 172.25.12.4
    netmask 255.255.255.248
    gateway 172.25.12.6

Additionally, if your setup is like ours you'll need to add some routing to the box so it knows where to send packets. Our Squid box sits just between our firewall/router and LAN. Thus, it needs to be told how to route packets to the LAN and packets to the outside world. We do this by specifying the firewall as the "gateway" in the interfaces file, and adding a static route for our LAN. Thus, you would add the following lines to /etc/network/interfaces in the br0 stanza:

    up route add -net 10.0.0.0/8 gw 172.25.12.6

We'll need to tell the kernel that we're going to forward packets, so make sure the following are set in /etc/sysctl.conf:

net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.default.forwarding=1
net.ipv4.conf.all.forwarding=1

Once you're all set, the easiest thing to do is reboot for the bridge config to take effect. The other settings should now be working also. cat /proc/sys/net/ipv4/ip_forward to confirm that the machine is in forwarding mode.

TProxy Interception

To redirect traffic from the brige to squid we need ebtables, which is like iptables. we want manipulate the traffic that is crossing the brige.

Install ebtables program :

Apt-get install ebtables


and use this rule to intercept the traffic for destination port 80

ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 --ip-destination-port 80 -j redirect --redirect-target ACCEPT



Now let's redirect to squid using iptables and tproxy

iptables -t tproxy -A PREROUTING -i br0 -p tcp --dport 80 -j TPROXY --on-port 80

 

Testing:

Workstation: 10.101.88.85
Squidbox   : 172.25.12.4
Webserver  : 10.101.88.25

You will see in apache logs of Webserver the ip addres of Workstation instead the Squidbox one. Also in access.log you will see all the traffic for http that it cames from Workstation.

 

FAQ:

1) How to I find my kernel is patched with Tproxy?

2) When Kernel rebuild it didn’t detect LAN Card.

3) How do I check TPROXY Rules?

4) How can I check IPTABLES patched working?


Source.list

deb http://http.us.debian.org/debian stable main contrib non-free

#deb http://dotdeb.pimpmylinux.org/ stable all

#deb-src http://dotdeb.pimpmylinux.org/ stable all

#deb http://non-us.debian.org/debian-non-US stable/non-US main contrib non-free

#deb http://security.debian.org stable/updates main contrib non-free

#deb http://http.us.debian.org/debian/ etch main contrib non-free

#deb http://security.debian.org/ etch/updates main

#deb http://packages.dotdeb.org stable all

#deb http://rekudos.net/ testing main

deb http://packages.dotdeb.org stable all

deb-src http://ftp.de.debian.org/debian testing main contrib non-free

deb-src http://security.debian.org stable/updates main contrib non-free

# deb cdrom:[Debian GNU/Linux 4.0 r0 _Etch_ - Official i386 NETINST Binary-1 20070407-11:29]/ etch contrib main

#deb cdrom:[Debian GNU/Linux 4.0 r0 _Etch_ - Official i386 NETINST Binary-1 20070407-11:29]/ etch contrib main

#deb http://ftp.egr.msu.edu/debian main

#deb http://people.debian.org/~pvaneynd/cl-sarge-packages ./

#deb http://people.debian.org/~pvaneynd/cl-breezy-packages ./

#deb http://packages.dotdeb.org stable all

deb-src http://ftp.de.debian.org/debian testing main contrib non-free

#deb-src http://security.debian.org stable/updates main contrib non-free

#deb http://http.us.debian.org/debian etch main contrib non-free

#deb http://security.debian.org/ etch/updates main

#deb http://http.us.debian.org/debian etch main contrib non-free

#deb http://packages.dotdeb.org stable all

#deb-src http://ftp.de.debian.org/debian testing main contrib non-free

#deb http://security.debian.org/ etch/updates main contrib

#deb-src http://security.debian.org/ etch/updates main contrib

# Security updates for "stable"

#deb http://security.debian.org stable/updates main contrib non-free

#deb http://security.debian.org testing/updates main contrib non-free

# Stable

#deb http://ftp.de.debian.org/pub/debian stable main contrib non-free

#deb http://ftp.de.debian.org/pub/debian-non-US stable/non-US main contrib non-free

# Stable Sources

#deb-src http://ftp.de.debian.org/pub/debian stable main contrib non-free

#deb-src http://ftp.de.debian.org/pub/debian-non-US stable/non-US main contrib non-free

#deb-src http://security.debian.org/ etch/updates main contrib.


# apt-get install libkrb53 libcupsys2-gnutls10 libldap2 libldap2-dev libkrb5-dev krb5-doc krb5-user krb5-config

# apt-get install libkrb5-dev krb5-doc krb5-user krb5-config

NTLM Authentication

Krb5.conf:

[libdefaults]

default_realm = YOUR_ORG.NET

# encrypt = true

# The following krb5.conf variables are only for MIT Kerberos.

# krb4_config = /etc/krb.conf

# krb4_realms = /etc/krb.realms

# kdc_timesync = 1

# ccache_type = 4

# forwardable = true

# proxiable = true

# The following encryption type specification will be used by MIT Kerberos

# if uncommented. In general, the defaults in the MIT Kerberos code are

# correct and overriding these specifications only serves to disable new

# encryption types as they are added, creating interoperability problems.

# default_tgs_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5

# default_tkt_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5

# permitted_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5

# The following libdefaults parameters are only for Heimdal Kerberos.

# v4_instance_resolve = false

# v4_name_convert = {

# host = {

# rcmd = host

# ftp = ftp

# }

# plain = {

# something = something-else

# }

# }

# fcc-mit-ticketflags = true

[realms]

YOUR_ORG.NET = {

admin_server = YOUR_ORG.NET

kdc = XX.XX.XXX.XXX

default_realm = YOUR_ORG.NET

}

[domain_realm]

.your_org.net = YOUR_ORG.NET

your_org.net = YOUR_ORG.NET

Squid Changes:

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp

auth_param ntlm children 30

auth_param ntlm keep_alive on

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic

auth_param basic children 5

auth_param basic realm Squid proxy-caching web server

auth_param basic credentialsttl 2 hours

acl ntlm proxy_auth REQUIRED src=10.0.0.0/8

http_access allow ntlm

Smb.conf

# Global parameters

[global]

workgroup = YOUR_ORG

realm = YOUR_ORG.NET

preferred master = no

server string = Samba file and print server

security = ADS

encrypt passwords = yes

log level = 3

log file = /var/log/samba/%m

max log size = 50

# winbind separator = +

password server = XX.XX.XXX.XXX

printcap name = cups

printing = cups

idmap uid = 10000-20000

idmap gid = 10000-20000


nsswitch.conf

# /etc/nsswitch.conf

#

# Example configuration of GNU Name Service Switch functionality.

# If you have the `glibc-doc-reference' and `info' packages installed, try:

# `info libc "Name Service Switch"' for information about this file.

passwd: compat winbind

group: compat winbind

shadow: compat winbind

hosts: files dns wins

networks: files

protocols: db files

services: db files

ethers: db files

rpc: db files

netgroup: nis

Key exchange btw linux and domain

# kinit adnan.shahzad@your_org.net

For Domain joing

# net ads join -S XX.XX.XXX.XXX -U Shahzad

You are here How To / Tutorials Fully Transparent + Tproxy + Bridge + Interception + Windows Authentication