Squid代理服务部署

Posted 2021-01-09 luoyan01

构建Squid代理服务器
1、配置IP地址

2、编译安装Squid软件
[[email protected] ~]# tar -zxvf squid-3.4.6.tar.gz -C /usr/src/
[[email protected] ~]# cd /usr/src/squid-3.4.6/
[[email protected] squid-3.4.6]# ./configure --prefix=/usr/local/squid --sysconfdir=/etc --enable-arp-acl --enable-linux-netfilter --enable-linuxtproxy
--enable-async-io=100 --enable-err-language="Simplify_Chinese" --enable-underscore --enable-poll --enable-gnuregex
[[email protected] squid-3.4.6]# ./configure
--prefix=/usr/local/squid //指定安装目录
--sysconfdir=/etc //指定配置文件目录
--enable-arp-acl //启用防止arp攻击功能
--enable-linux-netfilter //启用内核过滤功能
--enable-linux-tproxy //启用透明代理
--enable-async-io=100 //调整IO线程参数
--enable-err-language="Simplify_Chinese" //中文
--enable-underscore
--enable-poll
--enable-gnuregex
[[email protected] squid-3.4.6]# make
[[email protected] squid-3.4.6]# make install

3、创建用户并优化路径
[[email protected] ~]# useradd -M -s /sbin/nologin squid
[[email protected] ~]# ln -s /usr/local/squid/sbin/* /usr/local/sbin/
[[email protected] ~]# chown -R squid:squid /usr/local/squid/var/
[[email protected] ~]# chmod -R 757 /usr/local/squid/var/

4、检查语法并启动
[[email protected] ~]# squid -k parse
[[email protected] ~]# squid -z
[[email protected] ~]# squid
[[email protected] ~]# netstat -anpt | grep squid
[[email protected] ~]# echo "/usr/local/squid/sbin/squid" >> /etc/rc.local
[[email protected] ~]# killall -9 squid //停止squid服务

+++++++++++配置传统代理+++++++++++
-----WEB服务器------------Squid代理-------------Clinet--------
192.168.1.1 192.168.1.10 192.168.1.100

传统代理:需要手动配置(为客户端指定代理服务器的IP和端口)

1、修改squid.conf配置文件
[[email protected] ~]# vim /etc/squid.conf 添加:
http_port 3128
reply_body_max_size 10 MB //允许下载的文件大小为10M
http_access allow all //此行要放在http_access deny all之前

2、重启Squid服务
[[email protected] ~]# killall -9 squid
[[email protected] ~]# squid

3、客户端设置代理 打开IE浏览器:打开“工具”---“Internet选项”。“连接”---“局域网设置”中进行设置:
IP地址:192.168.1.10 端口:3128

//验证语法并显示有效的配置项 //清除缓存
//启动squid服务

linux客户端设置：
[[email protected] ~]# vim /etc/profile
HTTP_PROXY=http://192.168.56.200:3128
HTTPS_PROXY=http://192.168.56.200:3128
FTP_PROXY=http://192.168.56.200:3128
NO_PROXY=http://192.168.1.

4、验证:
客户端client访问WEB服务器http://192.168.1.1/

1)Squid代理服务器:
[[email protected] ~]# tail -f /usr/local/squid/var/logs/access.log

2)WEB服务器:
[[email protected] ~]# tail -f /etc/httpd/logs/access_log

+++++++++++配置透明代理+++++++++++
-----WEB服务器------------Squid代理--------------Clinet------
9.9.9.9 eth1:9.9.9.1
eth0:192.168.1.1

1、配置IP地址
注意:指定网关

2、开启路由转发功能
[[email protected] ~]# vim /etc/sysctl.conf 修改:
net.ipv4.ip_forward = 1
[[email protected] ~]#sysctl -p

2、修改squid.conf配置文件
[[email protected] ~]# vim /etc/squid.conf 添加:
http_port 192.168.1.1:3128 transparent
//客户端访问了WEB服务
//Squid服务器访问了WEB服务器

3、重启Squid服务
[[email protected] ~]# killall -9 squid
[[email protected] ~]# squid

4、设置防火墙规则
[[email protected] ~]#iptables -t nat -I PREROUTING -i eth0 -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
[[email protected] ~]#iptables -t nat -I PREROUTING -i eth0 -s 192.168.1.0/24 -p tcp --dport 443 -j REDIRECT --to-ports 3128

5、验证:
客户端client访问WEB服务器http://9.9.9.9/

1)Squid代理服务器:
[[email protected] ~]# tail -f /usr/local/squid/var/logs/access.log

2)WEB服务器:
[[email protected] ~]# tail -f /etc/httpd/logs/access_log
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE 动态转换开启配置文件中的deny全部注释

+++++++++++配置ACL+++++++++++
1、拒绝访问列表hehe
[[email protected] ~]# vim /etc/squid.conf 添加:
acl hehe src all
http_access deny hehe
2、拒绝指定ip和域名访问
[[email protected] ~]# vi /etc/squid/ip_list 添加:
192.168.1.0/24
1.1.1.1/8
[[email protected] ~]# vi /etc/squid/dns_list 添加:
.qq.com
.msn.com
[[email protected] ~]# vi /etc/squid.conf 添加:
acl haha dst "/etc/squid/ip_list"
acl xixi dstdomain "/etc/squid/dns_list"
http_access deny haha
http_access deny xixi
[[email protected] ~]# killall -9 squid
[[email protected] ~]# squid
客户端验证:
客户端访问,能否成功!
+++++++++++配置透Squid日志分析系统+++++++++++
[[email protected] ~]#yum -y install gd gd-devel
[[email protected] ~]#tar -zxvf sarg-2.3.7.tar.gz -C /usr/src/
[[email protected] ~]#cd /usr/src/sarg-2.3.7/
[[email protected] sarg-2.3.7]#./configure
--prefix=/usr/local/sarg
--sysconfdir=/etc/sarg
--enable-extraprotection
[[email protected] sarg-2.3.7]#make && make install
[[email protected] ~]# vim /etc/sarg/sarg.conf 添加:
access_log /usr/local/squid/var/logs/access.log
title "Squid User Access Reports"
output_dir /var/www/html/sarg
user_ip no
topuser_sort_field BYTES reverse
user_sort_field BYTES reverse
exclude_hosts /usr/local/sarg/noreport
overwrite_report no
mail_utility mail.postfix
charset UTF-8
weekdays 0-6
hours 7-12,14,16,18-20
www_document_root /var/www/html
[[email protected] ~]# service httpd restart
客户端:
[[email protected] ~]# firefox http://192.168.1.1/sarg &