E.2. Squid Proxy

Obtain a keypair and certificate for the HTTPS port of the Squid proxy server. You can obtain this keypair the same way that you would obtain a keypair for another SSL/TLS service. The keypair is in the form of two PEM files which contain the private key and the signed certificate. For this procedure, we assume that they are named proxy.key and proxy.cer.

Choose a host name for the proxy. Then, choose the other components of the distinguished name of the certificate for the proxy.

openssl x509 -in /etc/pki/ovirt-engine/ca.pem -noout -subject

# openssl x509 -in /etc/pki/ovirt-engine/ca.pem -noout -subject

subject= /C=US/O=Example Inc./CN=engine.example.com.81108

subject= /C=US/O=Example Inc./CN=engine.example.com.81108

/C=US/O=Example Inc./CN=proxy.example.com

/C=US/O=Example Inc./CN=proxy.example.com

Log in to the proxy machine and generate a certificate signing request:

openssl req -newkey rsa:2048 -subj '/C=US/O=Example Inc./CN=proxy.example.com' -nodes -keyout proxy.key -out proxy.req

# openssl req -newkey rsa:2048 -subj '/C=US/O=Example Inc./CN=proxy.example.com' -nodes -keyout proxy.key -out proxy.req

The command generates two files: proxy.key and proxy.req. proxy.key is the private key. Keep this file safe. proxy.req is the certificate signing request. proxy.req does not require any special protection.

To generate the signed certificate, copy the certificate signing request file from the proxy machine to the Manager machine:

scp proxy.req engine.example.com:/etc/pki/ovirt-engine/requests/.

# scp proxy.req engine.example.com:/etc/pki/ovirt-engine/requests/.

Log in to the Manager machine and sign the certificate:

/usr/share/ovirt-engine/bin/pki-enroll-request.sh --name=proxy --days=3650 --subject='/C=US/O=Example Inc./CN=proxy.example.com'

# /usr/share/ovirt-engine/bin/pki-enroll-request.sh --name=proxy --days=3650 --subject='/C=US/O=Example Inc./CN=proxy.example.com'

This signs the certificate and makes it valid for 10 years (3650 days). Set the certificate to expire earlier, if you prefer.

The generated certificate file is available in the directory /etc/pki/ovirt-engine/certs and should be named proxy.cer. On the proxy machine, copy this file from the Manager machine to your current directory:

scp engine.example.com:/etc/pki/ovirt-engine/certs/proxy.cer .

# scp engine.example.com:/etc/pki/ovirt-engine/certs/proxy.cer .

Ensure both proxy.key and proxy.cer are present on the proxy machine:

ls -l proxy.key proxy.cer

# ls -l proxy.key proxy.cer

Install the Squid proxy server package on the proxy machine:

yum install squid

# yum install squid

Move the private key and signed certificate to a place where the proxy can access them, for example to the /etc/squid directory:

cp proxy.key proxy.cer /etc/squid/.

# cp proxy.key proxy.cer /etc/squid/.

Set permissions so that the squid user can read these files:

chgrp squid /etc/squid/proxy.*
chmod 640 /etc/squid/proxy.*

# chgrp squid /etc/squid/proxy.*
# chmod 640 /etc/squid/proxy.*

The Squid proxy must verify the certificate used by the engine. Copy the Manager certificate to the proxy machine. This example uses the file path /etc/squid:

scp engine.example.com:/etc/pki/ovirt-engine/ca.pem /etc/squid/.

# scp engine.example.com:/etc/pki/ovirt-engine/ca.pem /etc/squid/.

Set permissions so that the squid user can read the certificate file:

chgrp squid /etc/squid/ca.pem
chmod 640 /etc/squid/ca.pem

# chgrp squid /etc/squid/ca.pem
# chmod 640 /etc/squid/ca.pem

If SELinux is in enforcing mode, change the context of port 443 using the semanage tool to permit Squid to use port 443:

yum install policycoreutils-python
semanage port -m -p tcp -t http_cache_port_t 443

# yum install policycoreutils-python
# semanage port -m -p tcp -t http_cache_port_t 443

Replace the existing Squid configuration file with the following:

https_port 443 key=/etc/squid/proxy.key cert=/etc/squid/proxy.cer ssl-bump defaultsite=engine.example.com
cache_peer engine.example.com parent 443 0 no-query originserver ssl sslcafile=/etc/squid/ca.pem name=engine login=PASSTHRU
cache_peer_access engine allow all
ssl_bump allow all
http_access allow all

https_port 443 key=/etc/squid/proxy.key cert=/etc/squid/proxy.cer ssl-bump defaultsite=engine.example.com
cache_peer engine.example.com parent 443 0 no-query originserver ssl sslcafile=/etc/squid/ca.pem name=engine login=PASSTHRU
cache_peer_access engine allow all
ssl_bump allow all
http_access allow all

Restart the Squid proxy server:

systemctl restart squid.service

# systemctl restart squid.service