squid代理上网

Squid介绍

Squid是一个高性能的代理缓存服务器，Squid支持FTP、gopher、HTTPS和HTTP协议。
和一般的代理缓存软件不同，Squid用一个单独的、非模块化的、I/O驱动的进程来处理所有的客户端请求。

Squid是一种用来缓冲Internet数据的软件。它是这样实现其功能的，接受来自人们需要下载的目标（object）的请求并适当地处理这些请求。
也就是说，如果一个人想下载一web页面，他请求Squid为他取得这个页面。Squid随之连接到远程服务器
（比如：www.baidu.com）并向这个页面发出请求。然后，Squid显式地聚集数据到客户端机器，而且同时复制一份。当下一次有人需要同一页面时，Squid可以简单地从磁盘中读到它，那样数据迅即就会传输到客户机上。当前的Squid可以处理HTTP，FTP，GOPHER，SSL和WAIS等协议。但它不能处理如POP，NNTP，RealAudio以及其它类型的东西。

1、 安装squid代理组件

yum -y install squid httpd-tools

2、 生成密码文件

创建存放密码的目录
mkdir /etc/squid3/
创建用户
htpasswd -cd /etc/squid3/passwords test0001 #创建用户test0001
输入密码 回车
再输入密码 回车 

3、 测试密码文件

/usr/lib64/squid/basic_ncsa_auth /etc/squid3/passwords
密码存放的位置：/etc/squid3/passwords
输入用户名 密码 之后，（用户名和密码之间有空格）出来验证ok  ；ctrl + c 结束即可。

4、 配置squid.conf文件

vi /etc/squid/squid.conf
在最后添加：
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid3/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
# Squid的监听端口
http_port 0.0.0.0:端口号  #这里是设置客户端连接的代理端口号，防火墙要允许端口号。

5、 配置上网权限规则

squid的权限控制很灵活，具体配置方法可以参考 官方文档， 或者 Squid中文权威指南， 具体工作原理有点像iptables，用规则去卡控流量。
默认的配置只能允许内网用户访问，如果有更多需求，你还可以指定很多规则！

默认配置如下：
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed

#允许连接代理上网的内网地址段
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

# 定义SSL_ports为443
acl SSL_ports port 443
#允许通过的协议
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
# 定义CONNECT代表http里的CONNECT请求方法
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
#拒绝所有其他不安全的端口
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
# 允许本机管理缓存
http_access allow localhost manager
# 拒绝其他地址管理缓存
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
# 允许局域网用户的请求
http_access allow localnet
# 允许本机用户的请求
http_access allow localhost

# And finally deny all other access to this proxy
# 拒绝其他所有请求
http_access deny all
# Squid normally listens to port 3128
# 默认Squid的监听端口，也就是客户代理的端口
#http_port 3128

# Uncomment and adjust the following to add a disk cache directory.
# 磁盘缓存目录
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
# squid挂掉后，临终遗言要放到哪里
coredump_dir /var/spool/squid

# 刷新缓存规则
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

#配置客户端连接代理用户认证
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid3/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
#配置squid 监听端口号
http_port 0.0.0.0:1404

6、 启动服务

Systemctl start squid
Systemctl enable squid
Systemctl status squid

7、 在客户端设置代理方法

代理格式：proxy = http://username:password@proxy_ip:port

设置全局环境变量代理:
echo "export http_proxy="http://test0001:[email protected]:1404"" >> /etc/profile
echo "export https_proxy="http://test0001:[email protected]:1404"" >> /etc/profile
yum代理设置：
echo "proxy=http://test0001:[email protected]:1404" >> /etc/yum.conf
wget代理设置：
echo "http_proxy=http://test0001:[email protected]:1404/" >> /etc/wgetrc
echo "https_proxy=http://test0001:[email protected]:1404/" >> /etc/wgetrc
echo "ftp_proxy=http://test0001:[email protected]:1404/" >> /etc/wgetrc
curl代理设置： 
echo "alias curl="curl -x http://test0001:[email protected]:1404"" >> ~/.bashrc
#去掉默认的npm：
npm config set proxy null
num代理设置
npm config set proxy http://test0001:[email protected]:1404
npm config set https-proxy http://test0001:[email protected]:1404
git代理设置
git config --global http.proxy http://test0001:[email protected]:1404
git config --global https.proxy http://test0001:[email protected]:1404

整理一下整体的代理脚本如下：

    echo "export http_proxy="http://test0001:[email protected]:1404"" >> /etc/profile
    echo "export https_proxy="http://test0001:[email protected]:1404"" >> /etc/profile
    echo "proxy=http://test0001:[email protected]:14041" >> /etc/yum.conf
    echo "http_proxy=http://test0001:[email protected]:1404/" >> /etc/wgetrc
    echo "https_proxy=http://test0001:[email protected]:1404/" >> /etc/wgetrc
    echo "ftp_proxy=http://test0001:[email protected]:1404/" >> /etc/wgetrc
    echo "alias curl="curl -x http://test0001:[email protected]:1404"" >> ~/.bashrc
    npm config set proxy null
    npm config set proxy http://test0001:[email protected]:1404
    npm config set https-proxy http://test0001:[email protected]:1404
    git config --global http.proxy http://test0001:[email protected]:1404
    git config --global https.proxy http://test0001:[email protected]:1404

    source /etc/profile

8、 查看squid日志

在代理服务器上：
more /var/log/squid/access.log
more /var/log/squid/cache.log

9、 客户端测试

curl www.baidu.com
yum update