Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am using havp and squid. How do I scan HTTPS connections with havp anti-virus?

Right now, testing eicar http://www.eicar.org/85-0-Download.html proves that anti-virus havp is working with havp. On HTTP only. HTTPS, the fake virus file downloads without warning.

I've read a few blurbs on sslbump from squid, but nothing coherent.

share|improve this question

1 Answer 1

https sessions are encrypted so scanning it for viruses is a futile exercise. Since any virus would be masked by the encryption.

On the HAVP website there is only 1 topic regarding this. Basically you need to turn the request into a http request and scan that instead of the https request:

  1. You will need to create a CA-root, then sign a wildcard certificate with the CA-root, then tell apache to use these files.
  2. You need to import the root in your browser.
  3. You can set up a virtualhost on port 8443, transparently forward all outgoing SSL traffic to this port, then tag all SSL-traffic with a extra header, then let it through HAVP, and then read off this header at the other end to decide if the connection should be SSL or not, and then rewrite the urls so they go through HAVP proxy.
  4. Then you need a virtualhost on 8448, accepting standard HTTP, that tags traffic for HTTP and send it to HAVP.

That topic also has one and two example apache configurations.

share|improve this answer
    
Thanks, that's solid info but doesn't help troubleshooting. I ran into a mysterious error: <br> [Mon Mar 11 15:55:13 2013] [warn] Init: Session Cache is not configured [hint: SSLSessionCache], upon restarting apachectl restart. –  user108754 Mar 12 '13 at 14:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.