squid 代理服务
squid代理服务分为两种方式： 一、正向代理（用在企业的办公环境中，员工上网需要通过Squid代理来上网） 客户端发送请求到代理服务器，代理服务器去向真正的服务器请求结果，并将结果返回给客户端
二、反向代理（常用于网站静态项(图片、html、流媒体、js、css等)的缓存服务器） 客户端发送请求，代理服务器从缓存中找结果返回，或向服务器请求到结果后缓存一份以供下次使用，并把结果返回客户端。
其中：它有两种传输模式：
1.同步模式：（如：squid）用户发起请求，请求立即被转到后端的服务器，于是在浏览器和后端服务器之间就建立了一个连接，在请求完成前这个连接是一直存在的。 2.异步模式：（如：nginx）用户发起的请求会发送到nginx，nginx接收到所有的数据后在转发到后端的服务器，后端服务器处理完成后把数据返回给nginx，nginx在返回给用户。
一、正向代理
[root@localhost ~]# yum install -y squid [root@localhost ~]# squid -v //查看squid版本 Squid Cache: Version 3.1.10 [root@localhost ~]# rm -f /etc/squid/squid.conf //不使用默认配置 [root@localhost ~]# vim /etc/squid/squid.conf //加入 http_port 3128 acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 8080 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access allow localhost http_access allow all cache_dir aufs /data/cache 1024 16 256 cache_mem 128 MB hierarchy_stoplist cgi-bin ? coredump_dir /var/spool/squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern \.(jpg|png|gif|mp3|xml) 1440 50% 2880 ignore-reload refresh_pattern . 0 20% 4320 [root@localhost ~]# squid -kcheck //检测一下是否有语法错误 1.提示信息： squid: ERROR: No running copy --> squid还未启动，没有关系，显示成这样说明配置文件没有问题了。 2. 提示信息： WARNING: Could not determine this machines public hostname. Please configure one or set 'visible_hostname'. --> [root@localhost ~]# vim /etc/squid/squid.conf //加入 visible_hostname aminglinux.com #可自定义 [root@localhost ~]# mkdir -p /data/cache //初始化缓存目录 [root@localhost ~]# chown -R squid:squid /data/cache/ [root@localhost ~]# squid -z 2013/06/12 16:25:14| Creating Swap Directories 2013/06/12 16:25:14| /data/cache exists //初始化完成 [root@localhost ~]# /etc/init.d/squid start 正在启动 squid：. [确定]
测试：
1. [root@localhost ~]# curl -xlocalhost:3128 http://www.baidu.com/ //看到了一大串，说明squid正向代理设置ok 2. [root@localhost ~]# curl -xlocalhost:3128 http://www.lishiming.net/static/image/common/logo.png -I HTTP/1.0 200 OK Server: nginx/1.0.0 Date: Sat, 08 Jun 2013 04:30:17 GMT Content-Type: image/png Content-Length: 7785 Last-Modified: Wed, 13 Jan 2010 03:33:47 GMT Accept-Ranges: bytes X-Cache: HIT from dx_cache216.5d6d.com X-Cache: MISS from localhost.localdomain X-Cache-Lookup: MISS from localhost.localdomain:3128 Via: 1.0 dx_cache216.5d6d.com:80 (squid), 1.0 localhost.localdomain (squid/3.1.10) Connection: keep-alive [root@localhost ~]# curl -xlocalhost:3128 http://www.lishiming.net/static/image/common/logo.png -I HTTP/1.0 200 OK Server: nginx/1.0.0 Content-Type: image/png Content-Length: 7785 Last-Modified: Wed, 13 Jan 2010 03:33:47 GMT Accept-Ranges: bytes Date: Sat, 08 Jun 2013 04:30:17 GMT X-Cache: HIT from dx_cache216.5d6d.com Age: 360898 Warning: 113 localhost.localdomain (squid/3.1.10) This cache hit is still fresh and more than 1 day old X-Cache: HIT from localhost.localdomain X-Cache-Lookup: HIT from localhost.localdomain:3128 Via: 1.0 dx_cache216.5d6d.com:80 (squid), 1.0 localhost.localdomain (squid/3.1.10) Connection: keep-alive 3. 配置白名单 ，表示机器只可以访问白名单的网站 [root@localhost ~]# vim /etc/squid/squid.conf ... ... acl CONNECT method CONNECT #在此下面添加 acl http proto HTTP acl good_domain dstdomain .lishiming.net .aminglinux.com http_access allow http good_domain http_access deny http !good_domain [root@localhost ~]# /etc/init.d/squid restart [root@localhost ~]# curl -xlocalhost:3128 http://www.baidu.com/ -I HTTP/1.0 403 Forbidden Server: squid/3.1.23 Mime-Version: 1.0 Date: Fri, 15 Apr 2016 16:32:28 GMT Content-Type: text/html Content-Length: 3274 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from localhost.localdomain X-Cache-Lookup: NONE from localhost.localdomain:3128 Via: 1.0 localhost.localdomain (squid/3.1.23) Connection: keep-alive 4. 配置黑名单，表示机器不可以访问黑名单 acl http proto HTTP acl bad_domain dstdomain .sina.com .souhu.com http_access allow http !bad_domain http_access deny http bad_domain
situation：
在办公室里，常常网络管理人员需要将一些端口和网络的进行封锁，为保持安全，也为了让员工们积极工作
这时，我们搭建正向代理服务器（选择机房里其他能够访问外网的服务器）进行搭建
===============我是分割线。==============================
二、反向代理
[root@localhost ~]# vim /etc/squid/squid.conf http_port 3128 #改为http_port 80 accel vhost vport ... ... #文件最尾增加 cache_peer 123.125.119.147 parent 80 0 originserver name=a cache_peer 61.135.169.125 parent 80 0 originserver name=b cache_peer_domain a www.qq.com cache_peer_domain b www.baidu.com [root@localhost ~]# /etc/init.d/squid restart [root@localhost ~]# curl -xlocalhost:80 http://www.baidu.com/ -I [root@localhost ~]# curl -xlocalhost:80 http://www.qq.com/ -I [root@localhost ~]# curl -xlocalhost:80 http://www.sina.com/ -I #您会发现，baidu.com和qq.com都能正常访问，然而sina.com访问503了
===============我是分割线。==============================
三、squid使用选项
1 。
[root@localhost ~]# squid -h
Usage: squid [-cdhvzCFNRVYX] [-s | -l facility] [-f config-file] [-[au] port] [-k signal]
-a port Specify HTTP port number (default: 3128).
-d level Write debugging to stderr also.
-f file Use given config-file instead of
/etc/squid/squid.conf
-h Print help message.
-k reconfigure|rotate|shutdown|interrupt|kill|debug|check|parse
Parse configuration file, then send signal to
running copy (except -k parse) and exit.
-s | -l facility
Enable logging to syslog.
-u port Specify ICP port number (default: 3130), disable with 0.
-v Print version.
-z Create swap directories
-C Do not catch fatal signals.
-D OBSOLETE. Scheduled for removal.
-F Don't serve any requests until store is rebuilt.
-N No daemon mode.
-R Do not set REUSEADDR on port.
-S Double-check swap during rebuild.
-X Force full debugging.
-Y Only return UDP_HIT or UDP_MISS_NOFETCH during fast reload.
2.
[root@localhost ~]# squid -kche //==squid -kcheck
[root@localhost ~]# squid -krec //重加载
