1

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and mirrored from a switch. It works great except I want to decrypt my SSL traffic. I would very much prefer to have the decryption take place on the fly instead of manually decrypting with wireshark that way Snort sees everything as well. I installed squid on the firewall to try to proxy my traffic but it is not working right. It forwards everything on but I can't get it to decrypt (run live capture on the firewall and it is still encrypted). If I can get this working, will that be enough (using the firewall's private key to decrypt)? If so, how would I go about setting this up in Security Onion? Thank you for your help.

Improve this question

2 Answers 2

Reset to default
1

To set up general TLS decryption Security Onion will need to have a certificate trusted by your endpoints. Usually this certificate has a CN of * so it can sign anything.

So you'd generate a TLS keypair for encryption. Its cerificate will need to be added to your root store either on your ActiveDirectory Domain Controllers, some other central store for other systems, or in the individual endpoints. This keypair will allow Security Onion to act as a TLS proxy yet still be able to be trusted by endpoints.

The firewall cert is unrelated as TLS is end-to-end encryption where the server has the private key and no one else. TLS decryption subverts this by introducing a proxy that can decrypt, inspect, and re-encrypt TLS traffic. This only works if the certificate used for re-encryption is trusted by the endpoints. It is a controlled MitM.

CAUTION: This is very dangerous if done improperly since it can enable malicious MitM if the keypair is stolen.

Improve this answer
1
  • Note that my answer only works if the decrypting proxy is inline (it can't act as a proxy otherwise). The firewall still won't see unencrypted traffic. Given the way keying works in TLS it isn't practical to decrypt mirrorred traffic.
    – Alain O'Dea
    Jul 1, 2015 at 21:51
1

The SslBump feature in Squid allows the proxy to inspect the decrypted web traffic, but the tools on the Security Onion node (Snort, Zeek etc.) will still only see the encrypted traffic because they don't support passive TLS decryption.

You will need to replay the proxied network traffic in decrypted form to a network interface in order to enable the tools on your Security Onion node to sniff them.

Here's how you can configure Security Onion to sniff decrypted TLS traffic:

  1. Install a TLS proxy, like PolarProxy or SSLsplit in your network
  2. Configure all clients to trust the root CA cert used by this proxy
  3. Configure your pfSense firewall to forward TLS traffic (TCP 443) to the proxy
  4. Push the decrypted traffic from the proxy to a network interface using tcpreplay
  5. Allow Security Onion to sniff the decrypted packets from that interface

We have created a guide on how to install PolarProxy in Security Onion here: https://netresec.com/?b=2013af4

Disclosure: We develop and maintain PolarProxy

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .