IDS on traffic passing through web proxy

[jmange]

Most internet traffic is encrypted these days, so without decryption, a lot is going to slip passed any IDS.  I have the web proxy configured on my system, and my assumption was that the Suricata service would take advantage of this and scan the traffic as it was decrypted by the web proxy.  This doesn't seem to be the case however.  Is there any way to have Squid pass the traffic to Suricata for scanning?

Thanks

[opnsensler]

Hi,

we have the same "problem", is there any solution? In my Tests Suricata doesn't scan the Web Proxy Traffic. I tested with the eicar.com test virus.

Greetz

[meyergru]

Before asking to solve that problem, are you aware of how this really works?

Basically, you can do one of two things:

1. You can have a (transparent) proxy which handles two TLS connections as a man-in-the-midlle (MITM). In this case, all traffic is first decrypted, then analysed and - if O.K. - re-encrypted for the target. In order to do that, the proxy will have to present its own (faked) certificate for the target that is being accessed to the clients. In order to to that, you need at least the proxy CA installed on all affected clients. Note that this works only for some clients - you cannot install alternate CAs on most IoT clients, for example. Also, if certificate pinning is used, like with some banks, encryption will break unless you have whitelisted those sites which in turn has those exempt from inspection.

You will also notice a speed penalty for this type of inspection.

2. The only thing you can do without MITM is analyze the initial phase of the HTTPS TLS connection, where the host part of the URL is specified. That is a bit better than to use the IP only, because so it can discriminate between different sites on the same host, thereby enabling blocking based on presumed content type of the specific website (i.e. the connection is dropped directly after a malicious or otherwise unwanted site is detected).

However it cannot look at the content of the pages or downloaded files, i.e. virus-scanning is impossible. Once the encrypted connection is established, this type of "inspection" is essentially blind.


For zenarmor, the first (deep) type of inspection is contained only in the paid version, AFAIK.

[opnsensler]

Hi,

thanks for your answer. At the moment, we use your first option. We have a own CA for the MITM Proxy and it works with our clients and our usecase. So that is fine.
But the IDS/IPS doen't work. I don't know what I have to do, that the IDS/IPS scan the decrypted HTTPS traffic.

[Patrick M. Hausen]

That decrypted traffic is nowhere to be seen on any network interface. The internal connection is encrypted as well as the external one. Only the web proxy process itself sees the plain text data.

So there needs to be some plugin/pipe/communication/thing from web proxy to IDS and vice versa.

Best contact the Suricata folks I guess.

[meyergru]

Suricata itself does not cover antivirus inspection, that is simply not what it does.

Also, if you use Squid for this purpose, you have to configure an ICAP service (https://docs.opnsense.org/manual/how-tos/proxyicapantivirusinternal.html) to actually inspect the traffic (Squid does not do it by itself, either).

Or you use an integrated solution like Zenarmor, but as I said, for MITM, you have to use the paid version of it.

[Greg_E]

And it is still MITM which can be detected on some browsers and fail the connection. We are moving more and more security tasks to the endpoints because of all this stuff.

[Enoch58]

Thank you for your response. Currently, we're utilizing the first greenleafguru option you provided. We've established our Certificate Authority (CA) for the MITM Proxy, and it's functioning well with our clients and our specific use case, which is satisfactory for us. However, we're encountering an issue with herbalhighsociety the Intrusion Detection System (IDS) / Intrusion Prevention System (IPS). We're unsure of the steps needed to enable the IDS/IPS to scan the decrypted HTTPS traffic. Any guidance on this matter would be greatly appreciated.