Centos 6.6搭建squid代理服务
学习Centos 6也有一阵子了，对基本的命令和shell都有个的了解，于是乎开始搭建一个squid代理环境在我的虚拟化环境中。
Squid代理：Squid是一个缓存和过滤网页内容的代理服务器。Squid代理被使用于不同的组织和ISP为了减少带宽和增加响应时间。
Squid代理服务将缓存请求网页内容和重复利用给进一步请求相同的内容。
通过上面的图示可以知道，当用户第一次请求Google内容时需要代理服务器去从ISP请求，然后ISP回应给代理server，紧接着server回应给用户，用户2若也需访问Google，就不需要再次从ISP去请求，而是直接从代理server中去获得，这样就节省了大量的网络带宽和响应时间。
安装Squid代理和依赖使用如下命令
yum install squid -y
默认的squid配置文件位于"/etc/squid/squid.conf"将包含推荐的最小化的配置且squid缓存特征将工作不做任何修改。推荐最小化配置类似于如下截图
[root@Daniel ~]# cat /etc/squid/squid.conf # # Recommended minimum configuration: # visible_hostname Daniel acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT #ACL blocksites acl blocksites dstdomain "/etc/squid/blockedsites.squid" #ACL blockkeywords acl blockkeywords url_regex -i "/etc/squid/blckkeywords.squid" # # Recommended minimum Access Permission configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost # http_access deny manager #Deny access to blocksites ACL http_access deny blocksites #Deny access to blockkeywords ACL http_access deny blockkeywords # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed http_access allow localnet http_access allow localhost # And finally deny all other access to this proxy http_access deny all # Squid normally listens to port 3128 http_port 3128 # Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /var/spool/squid 100 16 256 # Leave coredumps in the first cache dir coredump_dir /var/spool/squid # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320
2.启动squid服务
service squid start
使用如下命令让squid在开机时自动启动
chkconfig --levels 235 squid on
3.设置浏览器访问代理，端口为3128
IE : Tools Internet options Connections LAN settings Choose “Use a proxy server for your LAN” Type your Proxy server ip (192.168.1.11 ) and port no 3128
Firefox : Options / Preferences Advanced Network Settings Choose “Manual proxy configuration ” Type your Proxy server ip (192.168.1.11 ) and port no 3128
4.在代理服务器上浏览一些站点并检查访问日志文件
cat /var/log/squid/accesss.log
排错环节
如果你不能浏览使用代理设置，禁用防火墙和selinux服务在你的squid proxy中。
service iptables stop
chkconfig iptables off
禁用Selinux /etc/selinux/config
SELINUX=enforcing
替换为
SELINUX=disabled
重启服务器
配置squid 代理作为web过滤
你可以限制用户访问特定的网站或使用关键字的ACL
限制访问指定的网站
比如说，我们可以block facebook.com 和gmail.com
创建一个位于此目录的文件/etc/squid/blocksites.squid
[root@Daniel ~]# cat /etc/squid/blockedsites.squid
#blcoked sites
www.qq.com
打开/etc/squid/squid.conf并创建一个新的acl"blocksites"acl类型为"dstdomain"在acl部分
acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT #ACL blocksites acl blocksites dstdomain "/etc/squid/blockedsites.squid"
增加一下行“http_access deny blocksites”到http_section拒绝访问acl"blocksites”
#Deny access to blocksites ACL
http_access deny blocksites
重启squid服务
service squid restart
4.访问qq.com如下所示
拒绝日志如下
[root@Daniel ~]# tail -f /var/log/squid/access.log 1453708617.351 55 10.66.7.56 TCP_DENIED/403 3889 GET http://www.qq.com/ - NONE/- text/html 1453708664.335 5724 10.66.7.56 TCP_MISS/304 346 GET http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl - DIRECT/23.49.31.148 application/pkix-crl 1453708673.249 8899 10.66.7.56 TCP_MISS/304 325 GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl - DIRECT/23.75.23.163 application/pkix-crl 1453708678.022 4760 10.66.7.56 TCP_MISS/304 331 GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab? - DIRECT/125.56.199.8 application/octet-stream 1453708678.150 75 10.66.7.56 TCP_MISS/304 324 GET http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl - DIRECT/23.75.23.163 application/pkix-crl 1453708747.852 119973 10.66.7.56 TCP_MISS/200 7997 CONNECT iecvlist.microsoft.com:443 - DIRECT/68.232.45.200 - 1453708747.852 119973 10.66.7.56 TCP_MISS/200 22530 CONNECT iecvlist.microsoft.com:443 - DIRECT/68.232.45.200 - 1453708747.853 119921 10.66.7.56 TCP_MISS/200 8146 CONNECT r20swj13mr.microsoft.com:443 - DIRECT/68.232.45.200 -
除了对网站做限制，squid还可以针对关键字，特定的IP地址或完全访问指定的IP等等。
squid功能非常强大，对于企业内部做上网代理等非常有效果。