Difference between revisions of "Squid"
(→Installation: style) |
(Remove suggestion for Polipo, as it is unmaintained and on the Polipo page asks users to try Squid resulting in a Circular Dependency) |
||
Line 10: | Line 10: | ||
:Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It runs on Unix and Windows and is licensed under the GNU GPL. | :Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It runs on Unix and Windows and is licensed under the GNU GPL. | ||
− | While squid works wonderfully in large corporations and schools, it can also benefit the home user too | + | While squid works wonderfully in large corporations and schools, it can also benefit the home user too. |
== Installation == | == Installation == |
Revision as of 16:16, 4 October 2017
From the squid website:
- Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It runs on Unix and Windows and is licensed under the GNU GPL.
While squid works wonderfully in large corporations and schools, it can also benefit the home user too.
Contents
Installation
Configuration
By default, the cache directories will be created in /var/cache/squid
, and the appropriate permissions set up for those directories. However, for greater control, we need to delve into /etc/squid/squid.conf
.
Everything is well commented, but if you want to strip the comments out you should run:
sed -i "/^#/d;/^ *$/d" /etc/squid/squid.conf
The following options might be of some use to you. If you do not have the option present in your configuration file, add it!
http_port
- Sets the port that Squid binds to on your local machine. You can have Squid bind to multiple ports by specifying multiple http_port lines. By default, Squid binds to port 3128.
http_port 3128 http_port 3129
http_access
- This is an access control list for who is allowed to use the proxy. By default only localhost is allowed to access the proxy. For testing purposes, you may want to change the optionhttp_access deny all
tohttp_access allow all
, which will allow anyone to connect to your proxy. If you wanted to just allow access to your subnet, you can do:
acl ip_acl src 192.168.1.0/24 http_access allow ip_acl http_access deny all
cache_mgr
- This is the email address of the cache manager.
cache_mgr squid.admin@example.com
shutdown_lifetime
- Specifies how long Squid should wait when its service is asked to stop. If you're running squid on your desktop PC, you may want to set this to something short.
shutdown_lifetime 10 seconds
cache_mem
- This is how much memory you want Squid to use to keep objects in memory rather than writing them to disk. Squid's total memory usage will exceed this! By default this is 8MB, so you might want to increase it if you have lots of RAM available.
cache_mem 64 MB
visible_hostname
- hostname that will be shown in status/error messages
visible_hostname cerberus
cache_peer
- If you want your Squid to go through another proxy server, rather than directly out to the Internet, you need to specify it here.login
- Use this option if the parent proxy requires authentication.never_direct
- Tells the cache to never go direct to the internet to retrieve a page. You will want this if you have set the option above.
cache_peer 10.1.1.100 parent 8080 0 no-query default login=user:password never_direct allow all
maximum_object_size
- The largest size of a cached object. By default this is 4 MB, so if you have a lot of disk space you will want to increase the size of it to something reasonable.
maximum_object_size 10 MB
squid -zN
-z for Create missing swap directories and -N for No daemon mode. cache_dir
- This is your cache directory, where all the cached files are stored. There are many options here, but the format should generally go like:
cache_dir <storage type> <directory> <size in MB> 16 256
So, in the case of a school's internet proxy:
cache_dir diskd /cache0 200000 16 256
If you change the cache directory from defaults, you must set the correct permissions on the cache directory before starting Squid, else it won't be able to create its cache directories and will fail to start.
Accessing services on local hostnames
If you plan to access web servers on the LAN using hostnames that are not fully-defined (e.g. http://mywebapp
), you may need to enable the dns_defnames
option. Without this option, Squid will make a DNS request for the hostname verbatim (mywebapp
), which may fail, depending on your LAN's DNS setup. With the option enabled, Squid will append any domain configured in /etc/resolv.conf
when making the request (e.g. mywebapp.company.local
).
dns_defnames on
Starting
Once you have finished your configuration, you should check that your configuration file is correct:
# squid -k check
Then create your cache directories:
# squid -z
Then you can start/enable squid.service
.
Content Filtering
If you're looking for a content filtering solution to work with Squid, you should check out the very powerful DansGuardian.
Frontend
If you'd like a web-based frontend for managing Squid, Webmin is your best bet.
Ad blocking with adzapper
Adzapper is a plugin for Squid. It catches ads of all sorts (even Flash animations) and replaces them with an image of your choice, so the layout of the page isn't altered very much.
Installation
Adzapper is no longer in the community repository, but it can be found in the AUR.
Configuration
echo "redirect_program /usr/bin/adzapper.wrapper" >> /etc/squid/squid.conf
(squid 2.6.STABLE13-1)
echo "url_rewrite_program /usr/bin/adzapper.wrapper" >> /etc/squid/squid.conf echo "url_rewrite_children 10" >> /etc/squid/squid.conf
If you want, you can configure adzapper to your liking. The configuration out of the box works wonderfully well though.
nano /etc/adzapper/adzapper.conf
Anti-virus layer
Adding Anti-virus capabilities to Squid is done using the HAVP program to interface it with ClamAV.
Installing dependencies
Follow ClamAV to install ClamAV on your system. When it is installed, install havpAUR[broken link: archived in aur-mirror] from AUR.
Configuration
Once HAVP is installed, create a user group for the HAVP instance:
useradd havp
Change the owner of the antivirus logs and temporary file-testing directories to havp :
chown -R havp:havp /var/run/havp chown -R havp:havp /var/log/havp
Add the mandatory lock option to your filesystem (needed by HAVP) : In your /etc/fstab, modify :
[...] / ext3 defaults 1 1
to :
[...] / ext3 defaults,mand 1 1
Then reload your filesystem :
mount -o remount /
Add this info in your /etc/squid/squid.conf :
cache_peer 127.0.0.1 parent 8080 0 no-query no-digest no-netdb-exchange default cache_peer_access 127.0.0.1 allow all
Make sure your port in your /etc/havp/havp.config matches the cache_peer port in /etc/squid/squid.conf.
Testing
Restart the squid.service
systemd unit and start the havp.service
systemd unit. Enable both systemd units to have them launch at boot.
You can try the antivirus capabilities with a test virus (not a real virus) available here.
Transparent web proxy
Transparency happens by redirecting all www requests eth0 picks up, to Squid. You'll need to indicate Squid that it is running like a transparent web proxy by adding the intercept
(for squid 3.2) parameter to the http_port
option:
http_port 3128 intercept
iptables
From a terminal with root privileges, run:
# gid=`id -g proxy` # iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner $gid -j ACCEPT # iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination SQUIDIP:3128 # iptables-save > /etc/iptables/iptables.rules
Then start the iptables.service
systemd unit.
Replace SQUIDIP with the public IP(s) which squid may use for its listening port and outbound connections.
intercept
option in the http_port line.Shorewall
Edit /etc/shorewall/rules and add
REDIRECT loc 3128 tcp www # redirect to Squid on port 3128 ACCEPT $FW net tcp www # allow Squid to fetch the www content
Restart the shorewall
systemd unit.
HTTP Authentication
Squid can be configured to require a user and password in order to use it. We will use digest http auth
First create a users file with htdigest -c /etc/squid/users MyRealm username
. Enter a password when prompted.
Then add these lines to your squid.conf
:
auth_param digest program /usr/lib/squid/digest_file_auth -c /etc/squid/users auth_param digest children 5 auth_param digest realm MyRealm acl users proxy_auth REQUIRED http_access allow users
And restart squid. Now you will be prompted to enter a username and password when accessing the proxy.
You can add more users with htdigest /etc/squid/users MyRealm newuser
. You probably would like to install Apache package, which contains htdigest
tool.
http_access
rules cascade, so you need to set them in the desired order.NTLM
Set up samba and winbindd and test it with
ntlm_auth --username=DOMAIN\\user
Grant r-x access to /var/cache/samba/winbindd_privileged/ directory for squid user/group
Then add something like this to squid.conf:
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp auth_param ntlm children 5 auth_param ntlm max_challenge_reuses 0 auth_param ntlm max_challenge_lifetime 2 minutes auth_param ntlm keep_alive off
acl ntlm_users proxy_auth REQUIRED http_access allow ntlm_users http_access deny all
Troubleshooting
Squid needs to be restarted after boot
If you are using both squid and NetworkManager, the following error means that squid is launched before the wifi connection is enabled by NetworkManager (/etc/resolv.conf
is empty).
/var/log/squid/cache.log
Warning: Could not find any nameservers. Trying to use localhost Please check your /etc/resolv.conf file or use the 'dns_nameservers' option in squid.conf.
You can:
- Enable NetworkManager-wait-online.service systemd unit.
- Using NetworkManager dispatcher instead of systemd to start squid
Disable the squid.service
systemd unit.
/etc/NetworkManager/dispatcher.d/10_squid
if [ $1 == 'wlp2s0' ] then if [ $2 == 'up' ] then systemctl start squid else systemctl stop squid fi fi
sudo chmod u+x /etc/NetworkManager/dispatcher.d/10_squid