基于认证的代理平台搭建配置squid-20130730

基于认证的代理平台搭建配置squid-20130730


功能：通过squid代理实现
(1)基于用户名密码认证的出口ip路由选择
(2)基于client源ip的出口ip路由选择
(3)基于连接本机ip的出口ip路由选择
(4)实现高度匿名代理
(5)通过snmp使用cacti监控squid的状态


一、squid 安装过程
wget http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.8.tar.gz
tar xzvf squid-3.3.8.tar.gz 
cd squid-3.3.8
./configure --prefix=/usr/local/squid
make
make install


二、开启多个公网ip
公网网卡挂接多个ip地址
# cp /etc/sysconfig/network-scripts/ifcfg-em2   /etc/sysconfig/network-scripts/ifcfg-em2:1
# cp /etc/sysconfig/network-scripts/ifcfg-em2   /etc/sysconfig/network-scripts/ifcfg-em2:2
# cp /etc/sysconfig/network-scripts/ifcfg-em2   /etc/sysconfig/network-scripts/ifcfg-em2:3


修改里面的DEVICE和ip行，如下：
# more ifcfg-em2:1
DEVICE=em2:1
BOOTPROTO=none
HWADDR=90:b1:1c:37:a9:16
IPV6INIT=no
NM_CONTROLLED=yes
ONBOOT=yes
TYPE=Ethernet
UUID="db3f67fb-b389-4b64-a765-92ada4f0ce0a"
USERCTL=no
IPADDR=1.1.134.117
NETMASK=255.255.255.224


重启网络
# /etc/init.d/network restart


查看公网ip是否在线
# ifconfig 


三、安装所需软件包
因用户认证需要htpasswd及ab压力测试需要，故需要安装httpd
# yum install httpd


因squid的snmp功能需要通过net-snmp代理，故需安装
yum install -y net-snmp-utils




四、squid配置文件：
# more /usr/local/squid/etc/squid_multi_instance_conf/squid_multi_instance.conf 
####configured by laijingli


###only listen on private ip 
http_port 192.168.0.6:65500
#http_port 1.1.134.122:65500


###允许使用代理的ip段
acl ip_allow src 1.1.134.0/24 2.2.235.0/24 192.168.0.0/24 


###lable for debugging
visible_hostname squid_inst_30
cache_mgr laijingli


##auth
auth_param basic program /usr/local/squid/libexec/basic_ncsa_auth /usr/local/squid/etc/squid_multi_instance_conf/users.txt
auth_param basic children 10
auth_param basic realm  proxy server
auth_param basic credentialsttl 12 hours
auth_param basic casesensitive off


##enable auth,and only allow ip_allow and authed user to use this proxy
acl ncsa_users proxy_auth REQUIRED
http_access allow all
#http_access allow ip_allow ncsa_users
#http_access allow ncsa_users


##route outgoing ip address by authed user name
acl u1 proxy_auth u1
acl u2 proxy_auth u2
acl u3 proxy_auth u3
tcp_outgoing_address 1.1.134.117 u1
tcp_outgoing_address 1.1.134.118 u2
tcp_outgoing_address 1.1.134.119 u3


##route outgoing ip address by connected ip or client's source ip
#acl ip1  myip 1.1.134.123 
acl ip1  src 192.168.0.200
tcp_outgoing_address 1.1.134.107 ip1


#acl ip2  src 192.168.0.15
#tcp_outgoing_address 1.1.134.124 ip2


#acl ip3  src 192.168.0.0/24
#tcp_outgoing_address 1.1.134.125 ip3




###logs
pid_filename /usr/local/squid/var/logs/squid_30.pid
cache_log /usr/local/squid/var/logs/cache_30.log 
access_log /usr/local/squid/var/logs/access_30.log


###snmp monitor by cacti
acl CactiServer src 127.0.0.1 #写本机,因为要用net-snmp做代理
acl SNMP snmp_community community_cacti
snmp_port 3401
snmp_access allow SNMP CactiServer
snmp_access deny ALL




### anonymous 匿名代理
#forwarded_for off #HTTP_X_FORWARDED_FOR: unknown
request_header_access Allow allow all
request_header_access Authorization allow all
re