{"id":401,"date":"2013-04-22T16:06:10","date_gmt":"2013-04-22T14:06:10","guid":{"rendered":"http:\/\/dety.net.ua\/?p=401"},"modified":"2013-04-22T16:06:10","modified_gmt":"2013-04-22T14:06:10","slug":"squid-java-applets-client-bank","status":"publish","type":"post","link":"https:\/\/dety.net.ua\/?p=401","title":{"rendered":"Squid + Java applets + Client Bank"},"content":{"rendered":"

Very useful feature for chain: Client Bank + Squid + NTLM authorization.<\/p>\n

\u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b Java-\u0430\u043f\u043f\u043b\u0435\u0442\u043e\u0432 \u0441 \u0421\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u00abiBank\u00bb \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 Squid \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u0430\u0432\u0438\u043b:<\/p>\n

1. \u041d\u0435 \u0434\u043e\u043b\u0436\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 – Squid \u043d\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0442\u044c \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0435\u0433\u043e \u0438\u043c\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c. \u0421\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0443<\/p>\n

acl <acl_name> proxy_auth REQUIRED<\/p>\n

\u0432 \u0444\u0430\u0439\u043b\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a squid.conf.<\/p>\n

\u0415\u0441\u043b\u0438 \u0436\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u044d\u0442\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b, \u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 iBank. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0443\u0436\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 squid.conf \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0441\u0442\u0440\u043e\u0447\u043a\u0438:<\/p>\n

acl ibank_dst dst 195.239.34.170\/255.255.255.255 (ip \u0430\u0434\u0440\u0435\u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 iBank)<\/p>\n

acl ibank_ports port 443 9091<\/p>\n

http_access allow ibank_dst<\/p>\n

http_access allow CONNECT ibank_ports<\/p>\n

\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0434\u0432\u0435 \u0441\u0442\u0440\u043e\u0447\u043a\u0438 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0437\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u0434\u043e \u0441\u0442\u0440\u043e\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0442.\u0435. \u0435\u0441\u043b\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 access-\u043b\u0438\u0441\u0442, \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c, users \u0432 \u0432\u0438\u0434\u0435<\/p>\n

acl users proxy_auth REQUIRED<\/p>\n

\u0442\u043e \u043d\u0430\u0448\u0438 \u0434\u0432\u0435 \u0441\u0442\u0440\u043e\u043a\u0438 \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0441\u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u0434\u043e \u0441\u0442\u0440\u043e\u043a\u0438<\/p>\n

http_access allow users<\/p>\n

2. \u0420\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0430 TCP-\u043f\u043e\u0440\u0442\u044b 443, 9091 \u0421\u0435\u0440\u0432\u0435\u0440\u0430 \u00abiBank\u00bb. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442:<\/p>\n

acl ibank_ports port 443 9091<\/p>\n

http_access allow CONNECT ibank_ports<\/p>\n

\u041f\u0440\u0438\u0447\u0435\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0441\u0442\u0440\u043e\u0447\u043a\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0440\u0430\u0441\u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u0434\u043e \u0441\u0442\u0440\u043e\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0437\u0430\u043f\u0440\u0435\u0442 \u043d\u0430 \u043f\u043e\u0440\u0442\u044b \u0432\u044b\u0448\u0435 1023. \u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0435 Squid \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u044b \u043f\u043e\u0440\u0442\u044b: 80, 21, 443, 563, 70, 210, 1025-65535. \u041c\u043d\u043e\u0433\u0438\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e 80, 443, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u0434\u0435\u0441\u044c \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c.<\/p>\n

3. \u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0430\u043f\u043f\u043b\u0435\u0442\u043e\u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u044b iBank \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043d\u0443\u0436\u043d\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c ip \u0430\u0434\u0440\u0435\u0441 \u0438 \u043f\u043e\u0440\u0442 (3128 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e) proxy-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Squid.<\/p><\/blockquote>\n

source: http:\/\/www.opennet.ru\/openforum\/vsluhforumID12\/3938.html<\/a><\/p>\n

I resolved this issue this way: permitted all traffic from LAN to the bank’s site directly but also reconfigured SQUID later.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Very useful feature for chain: Client Bank + Squid + NTLM authorization. \u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b Java-\u0430\u043f\u043f\u043b\u0435\u0442\u043e\u0432 \u0441 \u0421\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u00abiBank\u00bb \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 Squid \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u0430\u0432\u0438\u043b: 1. \u041d\u0435 \u0434\u043e\u043b\u0436\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 – Squid \u043d\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0442\u044c \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0435\u0433\u043e \u0438\u043c\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c. \u0421\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0443 acl <acl_name> proxy_auth REQUIRED \u0432 \u0444\u0430\u0439\u043b\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,1,12],"tags":[],"class_list":["post-401","post","type-post","status-publish","format-standard","hentry","category-novosti","category-uncategorized","category-windows"],"_links":{"self":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=401"}],"version-history":[{"count":1,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/401\/revisions"}],"predecessor-version":[{"id":402,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/401\/revisions\/402"}],"wp:attachment":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}