Skip to content

Squid proxy

Squid

squid : Optimising Web Delivery

Install

Ubuntu

$ sudo apt-get install squid

OSX (Homebrew)

$ brew install squid

Windows

Config

$ sudo vim /etc/squid3/squid.conf

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
### ここにプロキシサーバ接続許可ネットワークを記述 ###
                :
                :
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet  #コメント解除
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

$ sudo service squid3 restart

ポート開放

$ sudo ufw allow 3128

動作確認

# Ubuntu
$ sudo netstat -lpn | grep squid

# OSX
$ lsof -i :3128

エラーページのカスタマイズ

  1. squid.confのTAG: error_directoryにて以下を追記
    • error_directory /usr/share/squid3/custom_errors
    • ※ "custom_errors" の名称や配置場所は任意
  2. /usr/share/squid3/に custom_errorsディレクトリを作成
  3. ERR_ACCESS_DENIEDなどのファイル（中身はHTML）を作成
    • /usr/share/squid3/errors/Japaneseのファイル群を参考に
  4. restart

Default directory path

Ubuntu

  • squid
    • ?
  • service
    • service squid start
    • service squid stop
  • squid.conf
    • /etc/squid3/squid.conf
  • error_directory
    • /usr/share/squid3/errors/Japanese

OSX (Homebrew)

  • squid
    • /usr/local/sbin/squid
  • squid.conf
    • /usr/local/etc/squid.conf
  • error_directory
    • /usr/local/opt/squid/share/errors/ja-jp
  • pid
    • /usr/local/var/run/squid.pid
  • auth programs
    • basic (NCSA)
      /usr/local/opt/squid/libexec/basic_ncsa_auth
    • digest
      /usr/local/opt/squid/libexec/digest_file_auth
auth_param digest program /usr/local/opt/squid/libexec/digest_file_auth /usr/local/opt/squid/passwd
auth_param digest children 20 startup=0 idle=1
auth_param digest realm proxy
auth_param digest nonce_garbage_interval 5 minutes
auth_param digest nonce_max_duration 30 minutes
auth_param digest nonce_max_count 50

acl password proxy_auth REQUIRED

http_access allow password

Tips

kill -HUPだとうまく機能しなかった、--helpも効かないのでそのうち調べる 

$ kill $(cat /usr/local/var/run/squid.pid)
reload the squid after making changes to squid.conf file 
$ /usr/local/sbin/squid -k reconfigure

Black List / White List

Launch on Startup (OSX)

with ログイン項目

  • システム環境設定 > ユーザとグループ > ユーザ名 > ログイン項目 にsquidを追加

with launchctl

  • Installing Squid Proxy Server on Mac OS X Snow Leopard | Biboroku 
    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>squid</string>
    <key>OnDemand</key>
    <false/>
    <key>ProgramArguments</key>
    <array>
      <string>/usr/local/sbin/squid</string>
    </array>
    <key>ServiceIPC</key>
    <false/>
  </dict>
</plist>

    $ sudo launchctl load -w /Library/LaunchDaemons/squid.plist

Memo

  • acl myaclname で定義して http_access allow myaclname で利用
  • http_access は上から評価され、マッチするとそこで切り上げる。
    例えば allow localnet の下に allow password を記述しても、localnet 内の端末は常に許可される。

Articles