1 基础理论

1.1 介绍

Squid是支持HTTP、HTTPS、FTP等协议的Web缓存服务器

1.2 作用

– Squid通过缓存和重用频繁请求的页面来减少带宽并缩短响应时间
– Squid拥有广泛的访问控制

1.3 适合的系统

– Unix
– Linux
– Windows

1.4 应用场景

– 为用户提供Web访问加速（提高性能与节省带宽）
– 将请求路由到其他服务器（优化网络吞吐量和缓存服务器的层次结构）
– 提供网页访问速度和减轻后端服务器的压力
– 构建Web的负载均衡集群

1.5 命中率

– Squid系统目前的命中率大约是75%
– Squid系统处于大流量环境，页面缓存可高达100%

2. 实践部分

2.1 系统环境配置

2.1.1 基本配置信息

Squid Server:
IP Address = 10.168.0.80
Gateway = 10.168.0.1
hostname = squid.cmdschool.org
Operating System = CentOS 7.x x86_64

Squid Client:
IP Address = 10.168.0.x
Gateway = 10.168.0.1
hostname = client.cmdschool.org
Operating System = CentOS 7.x x86_64

2.1.2 更新系统

yum -y update

2.1.3 删除firewalld

yum remove -y firewalld

2.1.4 安装iptables服务

yum install -y iptables-services

检查存在默认配置，

cat /etc/sysconfig/iptables

可见如下配置，

# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

另外，建议直接添加如下端口的配置，

vi /etc/sysconfig/iptables

加入如下配置：

-A INPUT -p tcp -m state --state NEW -m tcp --dport 3128 -j ACCEPT

确认以上配置无误，方可启动服务并配置服务自动运行，

systemctl start iptables.service
systemctl enable iptables.service

2.1.5 关闭SELinux

setenforce 0
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

2.1.6 配置时间同步

yum install -y chrony

确认以下时间服务器的配置符合环境需求，

grep ^server /etc/chrony.conf

可见如下服务配置，

server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst

启动服务并配置自启动

systemctl start chronyd.service
systemctl enable chronyd.service

2.2 软件配置

2.2.1 安装常用的工具

yum install -y vim bzip2 sudo wget

2.2.3 下载安装包

cd ~
wget http://www.squid-cache.org/Versions/v4/squid-4.6.tar.bz2

2.2.4 解压软件包

cd ~
tar -xf squid-4.6.tar.bz2

2.3 编译安装Squid

2.3.1 安装编译工具

yum install -y perl gcc gcc-c++ autoconf automake make

2.3.2 预编译

cd ~/squid-4.6
./configure --prefix=/usr \
            --bindir=/usr/sbin \
            --sbindir=/usr/sbin \
            --sysconfdir=/etc/squid \
            --libdir=/usr/lib64  \
            --libexecdir=/usr/libexec/squid \
            --mandir=/usr/share/man \
            --includedir=/usr/include \
            --datadir=/usr/share \
            --localstatedir=/var \
            --with-logdir=/var/log/squid  \
            --with-default-user=squid

我们可能需要根据需求解决以下依赖关系，

yum install -y libxml2-devel libcap-devel

如果从bzr引导和构建还需要如下依赖包，

yum install -y libtool-ltdl-devel

2.3.3 编译

make

2.3.4 安装

make install | tee install.log

2.3.5 创建运行用户

groupadd  -g 23 squid
useradd -u 23 -g 23 -d /var/spool/squid -s /sbin/nologin squid

2.4 测试Squid启动

2.4.1 创建缓存目录

squid -z

注：
– z参数，创建缓存目录并退出
另外，根据运行的错误提示，你可能需要解决一些问题，如创建cache日志文件，

touch /var/log/squid/cache.log
chown :squid /var/log/squid/cache.log
chmod g+w /var/log/squid/cache.log

2.4.2 尝试运行

squid -N -D -d1

注：
– 以上程序你可通过【Ctrl+C】结束进程
– N参数，主进程工作在前台并且不派生子进程
– D参数，标记进程为已过时并计划删除
– d参数，以调试指定的调试级别输出到标准错误流
另外，根据运行的提示解决，你可能需要解决以下错误，如创建access日志文件，

touch /var/log/squid/access.log
chown :squid /var/log/squid/access.log
chmod g+w /var/log/squid/access.log

2.4.3 尝试手动运行程序

squid -f /etc/squid/squid.conf

注：
– f参数，指定启动时读取的配置文件

2.4.4 确认运行状态

pgrep -a squid
netstat -antp | grep squid

2.4.5 手动关闭进程

kill 2 `pgrep -u root squid`

注：以上命令结束进程比较缓慢，需要等待一会

2.5 配置Squid启动控制

2.5.1 创建启动脚本

vim /usr/lib/systemd/system/squid.service

加入如下配置：

[Unit]
Description=Squid caching proxy
After=syslog.target network.target nss-lookup.target

[Service]
Type=forking
LimitNOFILE=16384
EnvironmentFile=/etc/sysconfig/squid
ExecStartPre=/usr/libexec/squid/cache_swap.sh
ExecStart=/usr/sbin/squid $SQUID_OPTS -f $SQUID_CONF
ExecReload=/usr/sbin/squid $SQUID_OPTS -k reconfigure -f $SQUID_CONF
ExecStop=/usr/sbin/squid -k shutdown -f $SQUID_CONF
TimeoutSec=0

[Install]
WantedBy=multi-user.target

2.5.2 创建环境配置

vim /etc/sysconfig/squid

加入如下配置：

# default squid options
SQUID_OPTS=""

# Time to wait for Squid to shut down when asked. Should not be necessary
# most of the time.
SQUID_SHUTDOWN_TIMEOUT=100

# default squid conf file
SQUID_CONF="/etc/squid/squid.conf"

2.5.3 创建配置文件

vim /etc/squid/squid.conf

修改配置如下：

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

2.5.4 创建缓存转换脚本

vim /usr/libexec/squid/cache_swap.sh

创建如下配置：

#!/bin/bash
if [ -f /etc/sysconfig/squid ]; then
        . /etc/sysconfig/squid
fi

SQUID_CONF=${SQUID_CONF:-"/etc/squid/squid.conf"}

CACHE_SWAP=`sed -e 's/#.*//g' $SQUID_CONF | \
        grep cache_dir | awk '{ print $3 }'`

for adir in $CACHE_SWAP; do
        if [ ! -d $adir/00 ]; then
                echo -n "init_cache_dir $adir... "
                squid -N -z -F -f $SQUID_CONF >> /var/log/squid/squid.out 2>&1
        fi
done

另外，你还需要修改该执行文件的权限，

chmod 755 /usr/libexec/squid/cache_swap.sh

2.5.5 重载是配置生效

systemctl daemon-reload

2.5.6 启动服务并配置自启动

systemctl start squid.service
systemctl enable squid.service

如果遇到如下错误，

FATAL: Ipc::Mem::Segment::create failed to shm_open(/squid-cf__metadata.shm): (17) File exists

请执行如下操作即可解决，

rm -rf /dev/shm/squid-cf__*.shm

其他可选命令，

systemctl status squid.service
systemctl stop squid.service
systemctl restart squid.service

2.6 客户端测试

2.6.1 删除客户端的默认路由

route del default

注：以上是为了防止信息通过路由出局

2.6.2 指定代理服务器

export http_proxy="http://user1:passwd1@10.168.0.80:3128"
export https_proxy="http://user1:passwd1@10.168.0.80:3128"

由于配置没有开启认证，请省略用户名和密码，

export http_proxy="http://10.168.0.80:3128"
export https_proxy="http://10.168.0.80:3128"

2.6.3 测试代理通讯

curl http://www.cmdschool.org
curl https://www.cmdschool.org

====================

Squid的编译：
—————-
https://wiki.squid-cache.org/SquidFaq/CompilingSquid

Squid的下载：
—————-
http://www.squid-cache.org/Versions/