squid配置

Squid 配置

我们采用活动目录做认证，因此需要将squid server加入域。

DC&DNS：192.168.0.5 192.168.0.6

PROXY: 192.168.0.7

1、安装软件

 # aptitude install samba winbind krb5-config ntp

2、修改相关配置文件

    为了加入域，需要修改下列文件的配置。

1） krb5.conf配置

#cp /etc/krbr.conf /etc/krbr.conf.bak

#vim /etc/krbr.conf

  clockskew = 300

[realms]

CSCTEK.COM.CN = {

kdc = OA.csctek.com.cn

                default_domain = csctek.com.cn

                admin_server = OA.csctek.com.cn

                     }

 

[logging]

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmin.log

default = FILE:/var/log/krb5lib.log

 

[domain_realm]

.csctek.com.cn = CSCTEK.COM.CN

csctek.com.cn = CSCTEK.COM.CN

 

2） nsswitch.conf配置

 # cp /etc/nsswitch.conf  nsswitch.conf.bak

 # vim nsswitch.conf

 passwd: compat

group: compat

…to this…

asswd: compat winbind

group: compat winbind

 

3) smb.conf 配置

#vim /etc/samba/smb.conf

[global]

workgroup = CSCTEK

netbios name = PROXY

server string = PROXY (Samba Server)

load printers = no

log file = /var/log/samba/log.%m

max log size = 500

realm = CSCTEK.COM.CN

security = ads

auth methods = winbind

winbind separator = /

encrypt passwords = yes

winbind cache time = 15

winbind enum users = yes

winbind enum groups = yes

winbind use default domain = yes

idmap uid = 10000-20000

idmap gid = 10000-20000

local master = no

os level = 233

domain master = no

preferred master = no

domain logons = no

wins server = 192.168.0.5

dns proxy = no

ldap ssl = no

4)ntp.conf配置

  #Vim /etc/net.conf

  在默认配置文件中添加如下配置：

server 192.168.0.5 192.168.0.6

 

3、重新启动samab 和winbind服务

#/etc/init.d/samba restart
#/etc/init.d/winbind restart

 

4、加入域

net ads join -S csctek.com.cn -U Administrator

若出现问题：ads_connect: Preauthentication failed，编辑 /etc/samba/smb.conf ，将其中securit = domain改为 securit = ads

wbinfo –t

出现checking the trust secret via RPC calls succeeded说明主机信任已成功建立。
执行wbinfo -u 可列出debian中的用户和win2003 域中的用户信息
执行 wbinfo -g 可列出debian中的组和win2003 域中的组信息

 

5、编译squid

  1）aptitude install gcc make

  2）准备编译

   ./configure -prefix=/usr -localstatedir=/var -libexecdir=${prefix}/lib/squid -datadir=${prefix}/share/squid -sysconfdir=/etc/squid -enable-delay-pools -enable-snmp -enable-cache-digests -enable-basic-auth-helpers=NCSA -enable-external-acl-helpers=wbinfo_group -enable-external-acl-helpers=winbind_group -enable-ntlm-auth-helpers=SMB

3） make and make install

 

6、编辑/etc/squid/squid.conf文件

 1）配置文件

cache_dir ufs /var/cache/squid 100 16 256 read-only # 关闭cache

access_log /var/log/squid/access.log squid  #日志文件

cache_log /var/log/squid/cache.log

cache_store_log /var/log/squid/store.log

 

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic

auth_param basic children 5  #认证

auth_param basic realm Squid proxy-caching web server

auth_param basic credentialsttl 2 hours

 

#deny access from member of noiniternet in domain controler 192.168.0.5

external_acl_type winbind_group_helper %LOGIN /lib/squid/wbinfo_group.pl

acl denygroup external winbind_group_helper nointernet

http_access deny denygroup

 

#acl AuthorizedUsers proxy_auth REQUIRED

#http_access allow AuthorizedUsers

http_access allow all #访问控制

 

acl denyssl urlpath_regex -i ^https:\\ #不缓存https://url

no_cache deny denyssl

 

delay_pools 1     #限制网速

delay_class 1 1

delay_access 1 allow all

delay_parameters 1 50000/50000 # 50k/s

delay_initial_bucket_level 50 #Squid

cache_mgr [email protected]  # 管理员邮箱

 

2）squid启动

mkdir /var/log/squidtouch access.log cache.log store.log

chmod 777 access.log cache.log store.log

mkdir /var/cache/squid

chmod 777 /var/cache/squid

squid -z #创建cache

squid #启动squid 或squid –NCdl

 

7、install sarg and config

sarg是分析squidaccess.log日志的工具，其配置很简单。

 Vim /etc/squid/sarg.conf

 output dir /home/squid-reports/curr

 

8、create squid report sell files

 Squid_report_day

 Squid_log_bak

9、设置定时任务

 #Vim /etc/crontab

 每天23：50执行Squid_report_day（生成日报告），每周23：55执行Squid_log_bak（生成周报告）。

 

10、install apache2 and config squid report website

# aititude install apache2

 # vim /etc/apache2/site-available/squid

 ServerName squid.csctek.com.cn

 DocumentRoot /home/squid_reports/

# a2ensite squid

# /etc/init.d/apache2 restart

这样就可以通过http://squid.csctek.com.cn 访问squid report 了！

到此为止，我们的squid server 已经配置完成。