Squid

Squid是一套Proxy軟體。

安裝

Ubuntu 22.04

在Ubuntu上可以直接透過系統的套件裝Squid：

sudo apt install -y squid; sudo apt clean

但如果需要讓Squid吃SSL Certificate提供HTTPS介面，會需要裝OpenSSL的版本（預設的GnuTLS無法吃intermediate certificate），另外因為軟體授權的關係，在Ubuntu 22.04以後有另外的套件：

sudo apt install -y squid-openssl; sudo apt clean

Ubuntu 20.04

如果是20.04下要自己編OpenSSL版本的Squid，可以自己拉下來改，再打包成deb安裝：

sudo apt install -y ed libltdl-dev pkg-config build-essential cdbs debhelper dpkg-dev lsb-release dh-apparmor libcppunit-dev libcap2-dev libdb-dev libecap3-dev libexpat1-dev libgnutls28-dev libkrb5-dev comerr-dev libldap2-dev libnetfilter-conntrack-dev libpam0g-dev libsasl2-dev libxml2-dev nettle-dev libssl-dev
mkdir squid
cd squid
apt-get source squid
cd squid-4.10
sed -i -e 's/--with-gnutls/--with-openssl/' debian/rules
vim debian/changelog # add a new entry for "+1openssl1" version.
dpkg-buildpackage -rfakeroot -uc -b

編完以後再依序安裝.deb檔（squid-common與squid），這邊的檔名可能會改變：

sudo dpkg -i squid-common_4.10-1ubuntu1.7+1openssl1_all.deb
sudo dpkg -i squid_4.10-1ubuntu1.7+1openssl1_amd64.deb

後續可以考慮用apt-mark避免自動升級：

sudo apt-mark manual squid squid-common

範例

Forward Proxy

在/etc/squid/squid.conf裡：

#
acl whitelist dstdom_regex "/etc/squid/whitelist.txt"
http_access allow whitelist
http_access deny all
#
access_log none
cache deny all
cache_dir null /tmp
cache_log /dev/null
cache_mem 8 MB
forwarded_for off
http_port 3128

其中有些欄位可以調整：

acl whitelist src 1.2.3.4/32
access_log daemon:/var/log/squid/access.log logformat=squid rotate=7

在/etc/squid/whitelist.txt裡：

(^|.)archive\.ubuntu\.com$

如果有設定log的話，記得放一個/etc/cron.d/squid-log並且設定為0755：

#!/bin/bash
/usr/sbin/squid -k rotate

Reverse Proxy

在/etc/squid/squid.conf裡：

#
acl all src 0.0.0.0/0
acl PURGE method PURGE
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl localnet src 10.0.0.0/255.0.0.0
#
http_access allow manager localhost
http_access deny manager
http_access allow PURGE localhost
http_access allow PURGE localnet
http_access deny PURGE
http_access deny all
#
access_log daemon:/home/logs/squid/access.log squid
cache_dir aufs /big/cache 358400 32 256 # FIXME
cache_effective_group nogroup
cache_effective_user nobody
cache_log /home/logs/squid/cache.log
cache_mem 1024 MB
cache_peer 10.1.2.3 parent 80 0 no-query round-robin originserver monitorurl=http://host/robots.txt # FIXME
cache_peer 10.1.2.4 parent 80 0 no-query round-robin originserver monitorurl=http://host/robots.txt # FIXME
cache_replacement_policy heap LFUDA # FIXME
cache_store_log daemon:/home/logs/squid/store.log
cache_swap_high 95
cache_swap_low 80
client_db off
coredump_dir /home/logs
follow_x_forwarded_for allow localnet
forwarded_for on
half_closed_clients off
http_port 80 accel defaultsite=default.domain.tld # FIXME
logfile_daemon /usr/local/squid/libexec/logfile-daemon
logfile_rotate 3
maximum_object_size 307200 KB # FIXME
maximum_object_size_in_memory 102400 KB # FIXME
memory_pools_limit 1331 MB # FIXME
minimum_expiry_time 604800 seconds
minimum_object_size 1 KB # FIXME
refresh_pattern . 60 90% 604800 override-expire ignore-reload ignore-no-cache ignore-no-store
store_avg_object_size 10 MB # FIXME

外部連結

• 官方網站 （英文）