2009/1/8 Michael Renner [email protected]:
A server should appear like a a 'normal' https webserver to others. More or less interesting, or just a 404 error message. However: it should appear harmless to others, just like a webserver. Behind this should work a proxy server (squid). Only authorized users should be able to use it.
If I understand well what you want to do, I think my patch "Identification Propagation patch using stunnel client certificates" can be useful : - Use my stunnel patch
Using squid as a proxy : - In stunnel config file : select pertinent fields of the certiificate : DN -> identFields=1023 - Get a squid version compiled with --enable-ident-lookups option - In squid : use a home-made external authentification program which returns ok if the DN provided is good. Squid documentation will tell you what is the need for the home-made authentification program.
I think it's easier with DansGuardian proxy : - In stunnel config file : select pertinent fields of the certiificate : only Issuer_CN -> identFields=32 - in /etc/dansguardian/dansguardian.conf, create 2 groups : filtergroups = 2 filtergroupslist = '/etc/dansguardian/lists/filtergroupslist' - create filter groups in /etc/dansguardian/lists/filtergroupslist. (All not matching users will go in group 1) : put a line like "your issuer CN equals 2" - in /etc/dansguardian/dansguardianf1.conf, put "groupmode=0" , ie banned - in /etc/dansguardian/dansguardianf2.conf, put "groupmode=2" , ie non filtered
Note that the authentification of the users is done by stunnel. Stunnel forwards the identification to the proxy which does not need to authenticate since it was done by stunnel.
If the ident provided by my patch is not convenient, you can modify it to match your needs.
Hope this helps