基于认证的代理平台搭建配置squid-20130730
功能:通过squid代理实现
(1)基于用户名密码认证的出口ip路由选择
(2)基于client源ip的出口ip路由选择
(3)基于连接本机ip的出口ip路由选择
(4)实现高度匿名代理
(5)通过snmp使用cacti监控squid的状态
一、squid 安装过程
wget http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.8.tar.gz
tar xzvf squid-3.3.8.tar.gz
cd squid-3.3.8
./configure --prefix=/usr/local/squid
make
make install
二、开启多个公网ip
公网网卡挂接多个ip地址
# cp /etc/sysconfig/network-scripts/ifcfg-em2 /etc/sysconfig/network-scripts/ifcfg-em2:1
# cp /etc/sysconfig/network-scripts/ifcfg-em2 /etc/sysconfig/network-scripts/ifcfg-em2:2
# cp /etc/sysconfig/network-scripts/ifcfg-em2 /etc/sysconfig/network-scripts/ifcfg-em2:3
修改里面的DEVICE和ip行,如下:
# more ifcfg-em2:1
DEVICE=em2:1
BOOTPROTO=none
HWADDR=90:b1:1c:37:a9:16
IPV6INIT=no
NM_CONTROLLED=yes
ONBOOT=yes
TYPE=Ethernet
UUID="db3f67fb-b389-4b64-a765-92ada4f0ce0a"
USERCTL=no
IPADDR=1.1.134.117
NETMASK=255.255.255.224
重启网络
# /etc/init.d/network restart
查看公网ip是否在线
# ifconfig
三、安装所需软件包
因用户认证需要htpasswd及ab压力测试需要,故需要安装httpd
# yum install httpd
因squid的snmp功能需要通过net-snmp代理,故需安装
yum install -y net-snmp-utils
四、squid配置文件:
# more /usr/local/squid/etc/squid_multi_instance_conf/squid_multi_instance.conf
####configured by laijingli
###only listen on private ip
http_port 192.168.0.6:65500
#http_port 1.1.134.122:65500
###允许使用代理的ip段
acl ip_allow src 1.1.134.0/24 2.2.235.0/24 192.168.0.0/24
###lable for debugging
visible_hostname squid_inst_30
cache_mgr laijingli
##auth
auth_param basic program /usr/local/squid/libexec/basic_ncsa_auth /usr/local/squid/etc/squid_multi_instance_conf/users.txt
auth_param basic children 10
auth_param basic realm proxy server
auth_param basic credentialsttl 12 hours
auth_param basic casesensitive off
##enable auth,and only allow ip_allow and authed user to use this proxy
acl ncsa_users proxy_auth REQUIRED
http_access allow all
#http_access allow ip_allow ncsa_users
#http_access allow ncsa_users
##route outgoing ip address by authed user name
acl u1 proxy_auth u1
acl u2 proxy_auth u2
acl u3 proxy_auth u3
tcp_outgoing_address 1.1.134.117 u1
tcp_outgoing_address 1.1.134.118 u2
tcp_outgoing_address 1.1.134.119 u3
##route outgoing ip address by connected ip or client's source ip
#acl ip1 myip 1.1.134.123
acl ip1 src 192.168.0.200
tcp_outgoing_address 1.1.134.107 ip1
#acl ip2 src 192.168.0.15
#tcp_outgoing_address 1.1.134.124 ip2
#acl ip3 src 192.168.0.0/24
#tcp_outgoing_address 1.1.134.125 ip3
###logs
pid_filename /usr/local/squid/var/logs/squid_30.pid
cache_log /usr/local/squid/var/logs/cache_30.log
access_log /usr/local/squid/var/logs/access_30.log
###snmp monitor by cacti
acl CactiServer src 127.0.0.1 #写本机,因为要用net-snmp做代理
acl SNMP snmp_community community_cacti
snmp_port 3401
snmp_access allow SNMP CactiServer
snmp_access deny ALL
### anonymous 匿名代理
#forwarded_for off #HTTP_X_FORWARDED_FOR: unknown
request_header_access Allow allow all
request_header_access Authorization allow all
re
功能:通过squid代理实现
(1)基于用户名密码认证的出口ip路由选择
(2)基于client源ip的出口ip路由选择
(3)基于连接本机ip的出口ip路由选择
(4)实现高度匿名代理
(5)通过snmp使用cacti监控squid的状态
一、squid 安装过程
wget http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.8.tar.gz
tar xzvf squid-3.3.8.tar.gz
cd squid-3.3.8
./configure --prefix=/usr/local/squid
make
make install
二、开启多个公网ip
公网网卡挂接多个ip地址
# cp /etc/sysconfig/network-scripts/ifcfg-em2 /etc/sysconfig/network-scripts/ifcfg-em2:1
# cp /etc/sysconfig/network-scripts/ifcfg-em2 /etc/sysconfig/network-scripts/ifcfg-em2:2
# cp /etc/sysconfig/network-scripts/ifcfg-em2 /etc/sysconfig/network-scripts/ifcfg-em2:3
修改里面的DEVICE和ip行,如下:
# more ifcfg-em2:1
DEVICE=em2:1
BOOTPROTO=none
HWADDR=90:b1:1c:37:a9:16
IPV6INIT=no
NM_CONTROLLED=yes
ONBOOT=yes
TYPE=Ethernet
UUID="db3f67fb-b389-4b64-a765-92ada4f0ce0a"
USERCTL=no
IPADDR=1.1.134.117
NETMASK=255.255.255.224
重启网络
# /etc/init.d/network restart
查看公网ip是否在线
# ifconfig
三、安装所需软件包
因用户认证需要htpasswd及ab压力测试需要,故需要安装httpd
# yum install httpd
因squid的snmp功能需要通过net-snmp代理,故需安装
yum install -y net-snmp-utils
四、squid配置文件:
# more /usr/local/squid/etc/squid_multi_instance_conf/squid_multi_instance.conf
####configured by laijingli
###only listen on private ip
http_port 192.168.0.6:65500
#http_port 1.1.134.122:65500
###允许使用代理的ip段
acl ip_allow src 1.1.134.0/24 2.2.235.0/24 192.168.0.0/24
###lable for debugging
visible_hostname squid_inst_30
cache_mgr laijingli
##auth
auth_param basic program /usr/local/squid/libexec/basic_ncsa_auth /usr/local/squid/etc/squid_multi_instance_conf/users.txt
auth_param basic children 10
auth_param basic realm proxy server
auth_param basic credentialsttl 12 hours
auth_param basic casesensitive off
##enable auth,and only allow ip_allow and authed user to use this proxy
acl ncsa_users proxy_auth REQUIRED
http_access allow all
#http_access allow ip_allow ncsa_users
#http_access allow ncsa_users
##route outgoing ip address by authed user name
acl u1 proxy_auth u1
acl u2 proxy_auth u2
acl u3 proxy_auth u3
tcp_outgoing_address 1.1.134.117 u1
tcp_outgoing_address 1.1.134.118 u2
tcp_outgoing_address 1.1.134.119 u3
##route outgoing ip address by connected ip or client's source ip
#acl ip1 myip 1.1.134.123
acl ip1 src 192.168.0.200
tcp_outgoing_address 1.1.134.107 ip1
#acl ip2 src 192.168.0.15
#tcp_outgoing_address 1.1.134.124 ip2
#acl ip3 src 192.168.0.0/24
#tcp_outgoing_address 1.1.134.125 ip3
###logs
pid_filename /usr/local/squid/var/logs/squid_30.pid
cache_log /usr/local/squid/var/logs/cache_30.log
access_log /usr/local/squid/var/logs/access_30.log
###snmp monitor by cacti
acl CactiServer src 127.0.0.1 #写本机,因为要用net-snmp做代理
acl SNMP snmp_community community_cacti
snmp_port 3401
snmp_access allow SNMP CactiServer
snmp_access deny ALL
### anonymous 匿名代理
#forwarded_for off #HTTP_X_FORWARDED_FOR: unknown
request_header_access Allow allow all
request_header_access Authorization allow all
re