1.Squid代理服务器
Squid是一个高性能的代理缓存服务器，Squid支持FTP、gopher、HTTPS和HTTP协议。和一般的代理缓存软件不同，Squid用一个单独的、非模块化的、I/O驱动的进程来处理所有的客户端请求。
2.工作机制
代替客户机向网站请求数据，隐藏用户的真实IP，将获得的网页数据保存在缓存中发送给客户机，那么下次请求一样数据的时候会更快速。
3.代理的类型
- 传统代理：需要在客户机指定代理服务器的地址和端口
- 透明代理：客户机不需要指定代理服务器的地址和端口，而是通过默认路由、防火墙将web访问重定向给代理服务器
- 反向代理：如果反向代理服务器中缓存了该请求的数据，那么直接将请求的护具返回给客户端，否则反向代理服务器将向后台的Web服务器请求数据，然后将请求的应答返回给客户端，同时将其缓存在本地，以便下一个请求者使用，但是确认是否缓存在了本地需要通过配置文件定义
日志管理工具：sarg
4.安装Squid
[root@localhost opt]# yum install -y gcc gcc-c++ make
[root@localhost opt]# tar xvf squid-3.5.27.tar.gz
[root@localhost opt]# cd squid-3.5.27/
[root@localhost squid-3.5.27]# ./configure --prefix=/usr/local/squid --sysconfdir=/etc --enable-arp-acl --enable-linux-netfilter --enable-linux-tproxy --enable-async-io=100 --enable-err-language="Simplify_Chinese" --enable-underscore --enable-poll --enable-gnuregex
--prefix=/usr/local/squid //安装目录
--sysconfdir=/etc/ //单独将配置文件修改到/etc目录下
--enable-arp-acl //可在ACL中设置通过MAC地址进行管理，防止IP欺骗
--enable-linux-netfilter //使用内核过滤
--enable-linux-tproxy //支持透明模式
--enable-async-io=100 //异步I/O，提升储存性能，值可修改
--enable-err-language="Simplify_Chinese" //错误信息的显示语言
--enable-underscore //允许uri中有下划线
--enable-poll //使用Poll()模式，提升性能
--enable-gnuregex //使用gnu正则表达式
[root@localhost squid-3.5.27]# make && make install
[root@localhost squid-3.5.27]# ln -s /usr/local/squid/sbin/* /usr/local/sbin
[root@localhost squid-3.5.27]# useradd -M -s /sbin/nologin squid
[root@localhost squid-3.5.27]# chown -R squid:squid /usr/local/squid/var/
[root@localhost squid-3.5.27]# vim /etc/squid.conf
[root@localhost opt]# squid -k parse //检查配置文件
2021/07/28 23:28:39| Startup: Initializing Authentication Schemes ...
2021/07/28 23:28:39| Startup: Initialized Authentication Scheme 'basic'
2021/07/28 23:28:39| Startup: Initialized Authentication Scheme 'digest'
2021/07/28 23:28:39| Startup: Initialized Authentication Scheme 'negotiate'
2021/07/28 23:28:39| Startup: Initialized Authentication Scheme 'ntlm'
2021/07/28 23:28:39| Startup: Initialized Authentication.
2021/07/28 23:28:39| Processing Configuration File: /etc/squid.conf (depth 0)
2021/07/28 23:28:39| Processing: acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
2021/07/28 23:28:39| Processing: acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
2021/07/28 23:28:39| Processing: acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
2021/07/28 23:28:39| Processing: acl localnet src fc00::/7 # RFC 4193 local private network range
2021/07/28 23:28:39| Processing: acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
2021/07/28 23:28:39| Processing: acl SSL_ports port 443
2021/07/28 23:28:39| Processing: acl Safe_ports port 80 # http
2021/07/28 23:28:39| Processing: acl Safe_ports port 21 # ftp
2021/07/28 23:28:39| Processing: acl Safe_ports port 443 # https
2021/07/28 23:28:39| Processing: acl Safe_ports port 70 # gopher
2021/07/28 23:28:39| Processing: acl Safe_ports port 210 # wais
2021/07/28 23:28:39| Processing: acl Safe_ports port 1025-65535 # unregistered ports
2021/07/28 23:28:39| Processing: acl Safe_ports port 280 # http-mgmt
2021/07/28 23:28:39| Processing: acl Safe_ports port 488 # gss-http
2021/07/28 23:28:39| Processing: acl Safe_ports port 591 # filemaker
2021/07/28 23:28:39| Processing: acl Safe_ports port 777 # multiling http
2021/07/28 23:28:39| Processing: acl CONNECT method CONNECT
2021/07/28 23:28:39| Processing: http_access deny !Safe_ports
2021/07/28 23:28:39| Processing: http_access deny CONNECT !SSL_ports
2021/07/28 23:28:39| Processing: http_access allow localhost manager
2021/07/28 23:28:39| Processing: http_access deny manager
2021/07/28 23:28:39| Processing: http_access allow localnet
2021/07/28 23:28:39| Processing: http_access allow localhost
2021/07/28 23:28:39| Processing: http_access allow all
2021/07/28 23:28:39| Processing: http_access deny all
2021/07/28 23:28:39| Processing: http_port 3128
2021/07/28 23:28:39| Processing: cache_effective_user squid
2021/07/28 23:28:39| Processing: cache_effective_group squid
2021/07/28 23:28:39| Processing: coredump_dir /usr/local/squid/var/cache/squid
2021/07/28 23:28:39| Processing: refresh_pattern ^ftp: 1440 20% 10080
2021/07/28 23:28:39| Processing: refresh_pattern ^gopher: 1440 0% 1440
2021/07/28 23:28:39| Processing: refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
2021/07/28 23:28:39| Processing: refresh_pattern . 0 20% 4320
[root@localhost opt]# squid –k rec //重新加载配置文件
[root@localhost opt]# squid -zX //初始化缓存目录
[root@localhost opt]# squid //开启
[root@localhost opt]# netstat -anpt | grep squid 、、检查是否开启
tcp6 0 0 :::3128 :::* LISTEN 115198/(squid-1)
- 编写squid脚本，优化启动
[root@localhost ~]# vim /etc/init.d/squid
#!/bin/bash
#chkconfig: 35 90 25
#config: /etc/squid.conf
#pidfile: /usr/local/squid/var/run/squid.pid
#Description: Squid - Internet Object Cache
PID="/usr/local/squid/var/run/squid.pid"
CONF="/etc/squid.conf"
CMD="/usr/local/squid/sbin/squid"
case "$1" in
start)
netstat -utpln | grep squid &>/dev/null
if [ $? -eq 0 ]
then
echo "Squid is running"
else
$CMD
fi
;;
stop)
$CMD -k kill &>/dev/null
rm -rf $PID &>/dev/null
;;
status)
[ -f $PID ] &>/dev/null
if [ $? -eq 0 ]
then
netstat -utpln | grep squid
else
echo "Squid is not running"
fi
;;
restart)
$0 stop &>/dev/null
echo "正在关闭Squid..."
$0 start &>/dev/null
echo "正在启动Squid..."
;;
reload)
$CMD -k reconfigure
;;
check)
$CMD -k parse
;;
*)
echo "用法：{start | stop | restart | reload | check | status}"
esac
[root@localhost ~]# chmod +x /etc/init.d/squid
[root@localhost ~]# chkconfig --add squid
[root@localhost ~]# chkconfig squid on //开启
[root@localhost ~]# service squid restart
正在关闭Squid...
正在启动Squid...
5.传统代理
squid 192.168.20.11
web1 192.168.20.22
web2 192.168.20.33
win10 192.168.20.40
[root@squid ~]# vim /etc/squid.conf
[root@squid ~]# systemctl restart squid
[root@squid ~]# netstat -anpt | grep squid
tcp6 0 0 :::3128 :::* LISTEN 115802/(squid-1)
- 配置防火墙规则
[root@squid ~]# iptables -F //清空
[root@squid ~]# iptables -I INPUT -p tcp --dport 3128 -j ACCEPT
- web1
[root@web1 ~]# yum -y install httpd
[root@web2 ~]# systemctl start httpd
[root@web2 ~]# netstat -natp | grep 80
tcp 0 0 192.168.20.33:51026 202.141.176.110:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40228 124.70.125.96:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40736 202.201.0.160:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35916 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:41792 36.156.207.241:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35924 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35926 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50134 219.216.128.25:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50468 202.202.1.140:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40642 36.156.96.248:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35922 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50494 202.202.1.140:80 TIME_WAIT -
tcp 0 0 192.168.20.33:55796 124.70.125.98:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35930 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40074 39.155.141.16:80 TIME_WAIT -
tcp 0 0 192.168.20.33:53420 112.21.165.134:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35928 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35892 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:56866 180.209.98.28:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50126 219.216.128.25:80 TIME_WAIT -
tcp 0 0 192.168.20.33:51004 202.141.176.110:80 TIME_WAIT -
tcp 0 0 192.168.20.33:44008 202.120.58.157:80 TIME_WAIT -
tcp6 0 0 :::80 :::* LISTEN 25359/httpd
- web2
[root@web2 ~]# yum -y install httpd
[root@web2 ~]# systemctl start httpd
[root@web2 ~]# netstat -natp | grep 80
tcp 0 0 192.168.20.33:51026 202.141.176.110:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40228 124.70.125.96:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40736 202.201.0.160:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35916 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:41792 36.156.207.241:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35924 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35926 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50134 219.216.128.25:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50468 202.202.1.140:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40642 36.156.96.248:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35922 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50494 202.202.1.140:80 TIME_WAIT -
tcp 0 0 192.168.20.33:55796 124.70.125.98:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35930 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:40074 39.155.141.16:80 TIME_WAIT -
tcp 0 0 192.168.20.33:53420 112.21.165.134:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35928 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:35892 101.6.8.193:80 TIME_WAIT -
tcp 0 0 192.168.20.33:56866 180.209.98.28:80 TIME_WAIT -
tcp 0 0 192.168.20.33:50126 219.216.128.25:80 TIME_WAIT -
tcp 0 0 192.168.20.33:51004 202.141.176.110:80 TIME_WAIT -
tcp 0 0 192.168.20.33:44008 202.120.58.157:80 TIME_WAIT -
tcp6 0 0 :::80 :::* LISTEN 25359/httpd
- 在WIN10设置中设置代理服务器
- 当持续刷新页面是日志也会随之更新
6.透明代理
增加一块网卡，并设置为局域网模式
- squid
[root@squid ~]# cd /etc/sysconfig/network-scripts/
[root@squid network-scripts]# cp ifcfg-ens33 ifcfg-ens37
[root@squid network-scripts]# vim ifcfg-ens37
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens37
DEVICE=ens37
ONBOOT=yes
IPADDR=192.168.26.1
[root@squid network-scripts]# systemctl restart network
[root@squid network-scripts]# vim /etc/squid.conf
[root@squid network-scripts]# systemctl restart squid
[root@squid network-scripts]# echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
[root@squid network-scripts]# sysctl -p
net.ipv4.ip_forward = 1
[root@squid network-scripts]# iptables -F
[root@squid network-scripts]# iptables -t nat -F
[root@squid network-scripts]# iptables -t nat -I PREROUTING -i ens37 -s 192.168.26.0/24 -p tcp --dport 80 -j REDIRECT --to 3128 //将来源为26网段的流量重定向到3128端口
[root@squid network-scripts]# iptables -t nat -I PREROUTING -i ens37 -s 192.168.26.0/24 -p tcp --dport 443 -j REDIRECT --to 3128
[root@squid network-scripts]# iptables -I INPUT -p tcp --dport 3128 -j ACCEPT
- web1
[root@web1 ~]# route add -net 192.168.26.0/24 gw 192.168.20.11 //添加静态路由
- 关闭win10的代理服务
- 将ip设置26网段的ip，并且网关指向ens37ip
- 网文web1依然能够访问
7.反向代理
- squid
[root@squid sarg]# systemctl start firewalld
[root@squid sarg]# systemctl stop httpd
[root@squid sarg]# iptables -F
[root@squid sarg]# iptables -t nat -F
[root@squid sarg]# iptables -I INPUT -p tcp --dport 3128 -j ACCEPT
[root@squid sarg]# vim /etc/squid.conf
[root@squid sarg]# service squid restart
正在关闭Squid...
正在启动Squid...
[root@squid sarg]# service squid reload
- web1
[root@web1 ~]# echo "this is tom" >> /var/www/html/index.html
- web2
[root@web2 ~]# echo "this is jerry" >> /var/www/html/index.html
- WIN10
修改C:\Windows\System32\drivers\etc\hosts 文件
添加192.168.20.11 www.tom.com
访问www.tom.com
- 刷新
8.ACL控制
再配置文件squid.conf中，ACL访问控制通过两个步骤来实现
- 通过acl配置定义需要控制的条件
- 通过http_access配置对已定义的列表做允许和拒绝的访问控制
定义访问控制列表
acl 列表名称 列表类型 列表内容
[root@squid ~]# vim /etc/squid.conf //修改配置文件
acl localhost src 192.168.26.1/24 #源地址为192.168.26.1
acl MYLAN src 192.168.20.0/24 #客户机网段
acl destinationhost dst 192.168.20.11/32 #目标地址为192.168.20.11
acl MC20 maxconn 20 #最大并发连接20
acl PORT port 21 #目标端口21
acl DMBLOCK dstdomain .qq.com #目标域，匹配域内所有站点
acl BURL url_regex -i ^rtsp:// ^emule:// #以rtsp://. emule://开头的URL，-i表示忽略大小写
acl PURL urlpath_regex -i \.mp3$ \.mp4$ \.rmvb$ #以 .mp3、.mp4、.rmvb结尾的URL路径
acl WORKTIME time MTWHF 08:30-17:30 #时间为周一-至周五8:30~17:30， "MTWHF"为每个星期的英文首字母
- 通过http_access配置项
[root@squid network-scripts]# mkdir /etc/squid
[root@squid network-scripts]# vim /etc/squid/dest.list
192.168.26.1
192.168.26.0/24
[root@squid network-scripts]# vim /etc/squid.conf
- 重启并访问web1
9.sarg日志分析
[root@squid ~]# yum install -y gd gd-devel pcre-devel
[root@squid ~]# mkdir /usr/local/sarg
[root@squid opt]# tar zxvf sarg-2.3.7.tar.gz -C /opt/
[root@squid sarg-2.3.7]# ./configure --prefix=/usr/local/sarg --sysconfdir=/etc/sarg --enable-extraprotection
[root@squid sarg-2.3.7]# vim /etc/sarg/sarg.conf
7 access_log /usr/local/squid/var/logs/access.log //指定访问日志文件
25 title "Squid User Access Reports" //网页标题
120 output_dir /var/www/html/sarg //报告输出目录
178 user_ip no //使用用户名显示
184 topuser_sort_field connect reverse //top排序中，指定连接次数采用降序排列，升序是normal
190 user_sort_field connect reverse //对于用户访问记录，连接次数按降序排序
206 exclude_hosts /usr/local/sarg/noreport //指定不计入排序的站点列表的文件
257 overwrite_report no //同名同日期的日志是否覆盖
289 mail_utility mailq/postfix //发送邮件报告命令
434 charset UTF-8 //指定字符集
518 weekdays 0-6
525 hours 0-23
633 www_document_root /var/www/html
[root@squid sarg-2.3.7]# touch /usr/local/sarg/noreport
[root@squid sarg-2.3.7]# ln -s /usr/local/sarg/bin/sarg /usr/local/bin/
[root@squid sarg-2.3.7]# sarg //启动
SARG: 纪录在文件: 168, reading: 100.00%
SARG: 成功的生成报告在 /var/www/html/sarg/2021Jul28-2021Jul31
- 添加计划任务，每天执行生成报告
[root@squid sarg-2.3.7]# vim /usr/local/sarg/report.sh
#!/bin/bash
#Get current date
TODAY=$(date +%d/%m/%Y)
#Get one week ago today
YESTERDAY=$(date -d "1 day ago" +%d/%m/%Y)
/usr/local/sarg/bin/sarg -l /usr/local/squid/var/logs/access.log -o /var/www/html/sarg -z -d $YESTERDAY-$TODAY &> /dev/null
exit 0
[root@squid sarg-2.3.7]# chmod +x /usr/local/sarg/report.sh
[root@squid sarg-2.3.7]# crontab -e
0 0 * * * /usr/local/sarg/report.sh
10.总结
squid 会有三种模式：
1、传统代理（需要指向squid）
2、透明代理(常用，不需要指向squid)
3、反向代理（需要指向squid）
497
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
