- 论坛徽章:
- 0
|
我自己做的SQUID 配置笔记:
前段时间,有朋友问到 solaris 9 下, squid 代理服务器的配置问题. 我就找时间在Ultra1上做出来了. 不足之处请指正!!
这里也包括DNS域名解析服务器的配置, 觉得有必要贴出来. 用着的地方. 需要转载请注明出处!
一. squid 的工作是建立在 DNS 的服务之上的, 所以首先要配置好你的DNS服务,方可进行squid
的安装和配置工作. 否则squid 会报错而无法运行!
1.DNS服务的安装和配置.
bash-2.05# pkgadd -d ./bind-9.4.1pl1-sol9-sparc-local---安装.
named 服务是默认安装在/usr/local/sbin 的目录下面的.
a. 编辑主配置文件
root@xiao.com # vi /etc/named.conf ---写入以下内容.
options {
directory "/usr/local/sbin/var/named";
forwarders { 210.21.4.130; 202.96.128.86; };----为了能访问外网的转发器.
};
// // a caching only nameserver config
//
zone "." IN {
type hint;
file "named.ca";
};
zone "xiao.com" IN {
type master;
file "xiao.com.zone"; -指明正向解释的文件.在这个目录下/usr/local/sbin/var/named/
allow-update { none; };
};
zone "0.168.192.in-addr.arpa" IN {
type master;
file "xiao.com.local";-指明反向解释的文件.在这个目录下/usr/local/sbin/var/named/
allow-update { none; };
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "localhost.local";-指明反向解释的文件.在这个目录下/usr/local/sbin/var/named/
allow-update { none; };
};
b. rndc.key 和 rndc.conf 文件的配置生成.
root@xiao.com # /usr/local/sbin/rndc-confgen -用这个命令.
# Start of rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "Sc1rFA4LnK9jNqnU0F7mDA==";
};
options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
# End of rndc.conf ---------取这一段复制到并保存在 /etc/rndc.conf
# Use with the following in named.conf, adjusting the allow list as needed:
# key "rndc-key" {
# algorithm hmac-md5;
# secret "Sc1rFA4LnK9jNqnU0F7mDA==";
# };
#
# controls {
# inet 127.0.0.1 port 953
# allow { 127.0.0.1; } keys { "rndc-key"; };
# }; ----------取这一段复制到并保存在 /etc/rndc.key
c. 编辑named.pid; 正反向解释文件.
bash-2.05# mkdir /usr/local/sbin/run
bash-2.05# touch /usr/local/sbin/run/named.pid --建个进程文件.
bash-2.05# mkdir -p /usr/local/sbin/var/named
root@xiao.com # vi /usr/local/sbin/var/named/named.ca --写入以下内容.域名配置文件.
;This is file holds the information on root name servers needed to
; initialize cache of Internet domain name servers
; (e.g. reference this file in the "cache . <file>"
; configuration file of BIND domain name servers).
;
; This file is made available by InterNIC
; under anonymous FTP as
; file /domain/named.cache
; on server FTP.INTERNIC.NET
; -OR- RS.INTERNIC.NET
;
; last update: Jan 29, 2004
; related version of root zone: 2004012900
;
;
; formerly NS.INTERNIC.NET
;
. 3600000 IN NS A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
;
; formerly NS1.ISI.EDU
;
. 3600000 NS B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201
;
; formerly C.PSI.NET
;
. 3600000 NS C.ROOT-SERVERS.NET.
C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
;
; formerly TERP.UMD.EDU
;
. 3600000 NS D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
;
; formerly NS.NASA.GOV
;
. 3600000 NS E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
;
; formerly NS.ISC.ORG
;
. 3600000 NS F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
;
; formerly NS.NIC.DDN.MIL
;
. 3600000 NS G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
;
; formerly AOS.ARL.ARMY.MIL
;
. 3600000 NS H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
;
; formerly NIC.NORDU.NET
;
. 3600000 NS I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
;
; operated by VeriSign, Inc.
;
. 3600000 NS J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
;
; operated by RIPE NCC
;
. 3600000 NS K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
;
; operated by ICANN
;
. 3600000 NS L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12
;
; operated by WIDE
;
. 3600000 NS M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
; End of File
root@xiao.com # vi /usr/local/sbin/var/named/localhost.local--域名解释内容
$TTL 86400
@ IN SOA xxx.xiao.com. root.xxx.xiao.com. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS xxx.xiao.com. -----记得末尾加个点的符号
root@xiao.com # vi /usr/local/sbin/var/named/xiao.com.local --反向解释内容
$TTL 86400
@ IN SOA ns.xiao.com. root.xiao.com. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS ns.xiao.com.
213 IN PTR xxx.xiao.com. -----记得末尾加个点的符号
213 IN PTR mail.xiao.com. -----记得末尾加个点的符号
bash-2.05 # vi /usr/local/sbin/var/named/xiao.com.zone -- 正向解释内容
$TTL 86400
@ IN SOA ns.xiao.com. root.xiao.com. (
42 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
IN NS xxx.xiao.com. -----记得末尾加个点的符号
www IN A 192.168.0.213
ns IN A 192.168.0.213
ftp IN A 192.168.0.213
c. 运行
bash-2.05 # /usr/local/sbin/named 运行这两个命令.
bash-2.05 # /usr/sbin/in.named
d. 测试:
bash-2.05 # /usr/local/bin/host 192.168.0.213 ---反向解释成功.这样DNS的配置就算完成了
213.0.168.192.in-addr.arpa domain name pointer xxx.xiao.com.
root@xiao.com # /usr/local/bin/nslookup ---以下正反向解释都是成功的.
> xxx.xiao.com ----输入你的域名
Server: 192.168.0.213
Address: 192.168.0.213#53
Name: xxx.xiao.com -----返回的结果
Address: 192.168.0.213 -----返回的结果
> 192.168.0.213 ----输入主机的IP地址
Server: 192.168.0.213
Address: 192.168.0.213#53
213.0.168.192.in-addr.arpa name = xxx.xiao.com. ------返回的结果.
213.0.168.192.in-addr.arpa name = mail.xiao.com. -----返回的结果.
二. squid 的安装.
1. 在安装之前, 请检查 DNS 服务是否起用了;输入以下的命令,看到有下面的结果返回说明DNS服务正常.
bash-2.05# netstat -anv |grep 53
127.0.0.1.53 Idle
192.168.0.213.53 Idle
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 LISTEN
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 IDLE
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 LISTEN
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 LISTEN
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 LISTEN
2. 安装的软件包. 下载地址:http://www.sunfreeware.com/indexsparc9.html
a. 需要的软件包列表(包含DNS软件):
bind-9.4.1pl1-sol9-sparc-local
libgcc-3.3-sol9-sparc-local
sasl-2.1.21-sol9-sparc-local
db-4.2.52.NC-sol9-sparc-local
libiconv-1.11-sol9-sparc-local
squid-2.6.STABLE16-sol9-sparc-local
expat-1.95.5-sol9-sparc-local
openldap-2.3.35-sol9-sparc-local
gcc-3.4.6-sol9-sparc-local
openssl-0.9.8f-sol9-sparc-local
b. 把上面有依赖关系的软件包逐一都安装好,squid默认是安装在/usr/local/squid目录下.
bash-2.05# pkgadd -d ./squid-2.6.STABLE16-sol9-sparc-local
The following packages are available:
1 SMCsquid squid
(sparc) 2.6.STABLE16
Select package(s) you wish to process (or 'all' to process
all packages). (default: all) [?,??,q]: all
bash-2.05# cd /usr/local/squid/ ---安装好squid,目录下面的文件.
bash-2.05# ls
bin doc etc libexec sbin share var
c. 设置squid的运行环境,添加squid用户和它的组.---squid 是以squid 自己的身份去运行的.
bash-2.05# useradd squid
bash-2.05# groupadd squid
d. 为了让squid能运行起来,需要手动添加及改动其配置文件.(也不是一定要手动生成.
如果在第一次运行squid时,根据运行脚本的提示,报错信息来决定)
并把他们加入到squid组和为squid所有. 文件的权限设为644.
bash_2.05# mkdir /usr/local/squid/var/cache
bash-2.05# touch /usr/local/squid/var/logs/squid.pid
bash-2.05# touch /usr/local/squid/var/logs/access.log
bash-2.05# touch /usr/local/squid/var/logs/store.log
bash-2.05# touch /usr/local/squid/var/logs/cache.log
bash-2.05# chown squid:squid /usr/local/squid/var/logs/*
bash-2.05# chomd 644 var/logs/*
bash-2.05# ls -l var/logs/
total 116
-rw-r--r-- 1 squid squid 0 Nov 20 14:26 access.log
-rw-r--r-- 1 squid squid 58062 Nov 21 15:39 cache.log
-rw-r--r-- 1 root squid 4 Nov 21 15:39 squid.pid
-rw-r--r-- 1 squid squid 0 Nov 20 15:11 store.log
编辑配置文件:
bash-2.05# vi /usr/local/squid/etc/squid.conf
第936行:去掉注释并插入( 本主机的IP和端口,默认是3128 )
http_port 192.168.0.213:3128
在第632(写入你允许访问的网段)和633行去掉注释,
并特别注意636行是否有这个声明--允许的条件写在它的前面(所有的字符区分大小写):
631 # be allowed
632 acl our_networks src 192.168.0.0/24 192.168.1.0/24 192.168.2.0/24
633 http_access allow our_networks
634
635 # And finally deny all other access to this proxy
636 http_access deny all
在第2969行,更改它的默认用户(默认没有设置),去掉注释:
# supplementary group list from the from groups membership of
2966 # cache_effective_user.
2967 #
2968 #Default:
2969 cache_effective_user squid ---(这里设为squid,这个比较重要,否则会启动不了.报有关无法写入cache, cache.log的错误)
在第2981行,更改它的默认组(默认没有设置),去掉注释:
2977 # If Squid is not started as root the user starting Squid must be member of the specified
2978 # group.
2979 #
2980 #Default:
2981 cache_effective_group squid ---(这里设为squid)
在第2997行,更改它的错误报告发送主机名(默认没有设置),去掉注释:
2993 # get errors about IP-forwarding you must set them to have individual
2994 # names with this setting.
2995 #
2996 #Default:
2997 visible_hostname 192.168.0.213 ---(这里指定IP地址)
e. 运行squid.
(1.)运行前检查DNS服务要正常启用:
bash-2.05# netstat -avn |grep 53
127.0.0.1.53 Idle
192.168.0.213.53 Idle
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 LISTEN
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 IDLE
*.* 0 00000000 00000000 49152 00000000 00000000 3375 536 LISTEN
(2.)第一次运行squid前先建立cache_swap的目录文件.
bash-2.05# /usr/local/squid/sbin/squid -z ---运行此命令,返回下面结果,表示cache建立成功.
2007/11/21 15:39:16| Starting Squid Cache version 2.6.STABLE16 for sparc-sun-solaris2.9...
2007/11/21 15:39:16| Process ID 363
2007/11/21 15:39:16| With 32768 file descriptors available
2007/11/21 15:39:16| Using poll for the IO loop
2007/11/21 15:39:16| Performing DNS Tests...
2007/11/21 15:39:16| Successful DNS name lookup tests...
2007/11/21 15:39:16| DNS Socket created at 0.0.0.0, port 32815, FD 5
2007/11/21 15:39:16| Adding nameserver 192.168.0.213 from /etc/resolv.conf
2007/11/21 15:39:16| Unlinkd pipe opened on FD 10
2007/11/21 15:39:16| Swap maxSize 102400 KB, estimated 7876 objects
2007/11/21 15:39:16| Target number of buckets: 393
2007/11/21 15:39:16| Using 8192 Store buckets
2007/11/21 15:39:16| Max Mem size: 8192 KB
2007/11/21 15:39:16| Max Swap size: 102400 KB
2007/11/21 15:39:16| Rebuilding storage in /usr/local/squid/var/cache (DIRTY)
2007/11/21 15:39:16| Using Least Load store dir selection
2007/11/21 15:39:16| Set Current Directory to /usr/local/squid/var/cache
2007/11/21 15:39:16| Loaded Icons.
2007/11/21 15:39:16| Accepting proxy HTTP connections at 192.168.0.213, port 3128, FD 12
bash-2.05# /usr/local/squid/sbin/squid ---用此命令启动服务
2007/11/21 16:21:49| Squid is already running! Process ID 363
bash-2.05# netstat -avn |grep 3128 ---表示squid已经正常起用了.
192.168.0.213.3128
(3.)编辑squid服务自动起用的脚本.
bash-2.05# vi /etc/rc3.d/S50squid
#!/sbin/sh
#
#
#ident "@(#)squid"
case "$1" in
start)
[ -f /usr/local/squid/etc/squid.conf ] || exit 0
/usr/local/squid/sbin/squid
;;
stop)
pkill squid
;;
*)
echo "Usage: $0 { start | stop }"
exit 1
;;
esac
exit 0
bash-2.05# ls -l /etc/rc3.d/S50squid --此文件设定为744, sys组, 所有者为root:
-rwxr--r-- 1 root sys 301 Nov 21 10:59 /etc/rc3.d/S50squid
bash-2.05# chgrp sys /etc/rc3.d/S50squid
bash-2.05# chown root /etc/rc3.d/S50squid
bash-2.05# chmod 744 /etc/rc3.d/S50squid
3.测试:
设置:
windows 用户端: 浏览器---工具---Internet选项---连接---局域网设置---代理服务器--
输入: IP 192.168.0.213 ; 端口: 3128 ;确定,退出; 然后在IE地址拦输入你要访问的网络地址.
linux 或 Unix 用户: bash-2.05# route add default gateway 192.168.0.213 ;
或 bash-2.05# vi /etc/defaultrouter 加入代理服务器的地址: 192.168.0.213
如果觉得起用squid访问的速度慢, 你可以设置第1601行, cache_mem 把默认的8MB 改成32MB或者更大,
看机器的情况. 我这里是默认(注意: 有关default 项原配置文件是有# 号的, 改好后,记得把注释去掉, 如果没有修改,就不要去掉注释,切记!!)
bash-2.05# pwd
/usr/local/squid
bash-2.05# tail -30 var/logs/access.log ---查看访问日志文件,留下了用户访问的记录.
1195638014.409 66 192.168.0.131 TCP_MISS/304 249 http://bbs.chinaunix.net/icon/- DIRECT/60.28.166.83 -
1195638014.411 64 192.168.0.131 TCP_MISShttp://bbs.chinaunix.net/icon/DIRECT/60.28.166.83 -
1195638014.418 69 192.168.0.131 TCP_MISS/http://bbs.chinaunix.net/icon/book- DIRECT/60.28.166.83 -
1195638014.430 77 192.168.0.131 TCP_MISS/304 249http://bbs.chinaunix.net/icon/ - DIRECT/60.28.166.83 -
1195638014.449 170 192.168.0.131 TCP_MISS/http://www.chinaunix.net/top100_ - DIRECT/60.28.166.84 -
1195638014.467 163 192.168.0.131 TCP_MISS/http://www.chinaunix.net/job_banner160 - DIRECT/60.28.166.84 -
1195638014.478 170 192.168.0.131 TCP_MISShttp://www.chinaunix.net/download- DIRECT/60.28.166.84
4. 结束.
有关squid的配置文件多达4500行,有很多高级的配置应用.功能很强大.如 acl 访问控制列表; cache_mem;
也可以配置成防火墙,监控用户访问,监控你的企业网络等等
下面是这里过滤了注释的配置文件(但不包含默认的,注释了的部分)
bash-2.05# cat etc/squid.conf |grep -v "#"|grep " "
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl our_networks src 192.168.0.0/24 192.168.1.0/24 192.168.2.0/24
http_access allow our_networks
http_access deny all
icp_access allow all
http_port 192.168.0.213:3128
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
access_log /usr/local/squid/var/logs/access.log squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
cache_effective_user squid
cache_effective_group squid
visible_hostname 192.168.0.213
coredump_dir /usr/local/squid/var/cache
5. 一点心得.
此次配置是参考RHEL4下的配置完成的. 是一步一步根据运行的错误信息来排除解决问题的,需要说明
值得注意的是; cache_effective_user 和 cache_effective_group 必需指明正确;这里都是squid;
还有cache_mem 这个数据,默认是8MB , 为了加快访问速度把这个设得尽可能的大,128MB;256MB,一般
是你机器内存的一半.
有更好的方法, 希望多多交流, 不足请指正!!
想继续深入了解请参考:
官方网站: http://www.squid-cache.org
[ 本帖最后由 zhushuyun 于 2007-12-9 21:22 编辑 ] |
|
免费注册
发表于 2007-11-22 22:11