linux企业级应用lly squid实验报告

1、需求描述ØØ通过缓存免除客户机的服务来提高上网速度设置工作实现思路ØØØ编写 iptables 规则，实现 SNAT、REDIRECT 应用构建 squid 服务器，支持合理使用 ACL 列表，进行类型：的基本类型§§使用§§：适用于 Internet，需明确指定服务端：适用于共享上网网关，不需指定服务端的好处提高 Web速度隐藏客户机的真实 IP 地址Squid 常见配置项：http_port 3128默认服务端口日志文件储存路径供给 squid 使用的内存缓存目录大小access_log /var/l

2、og/squid/access.log squidcache_mem 64 MBcache_dir ufs /var/spool/squid 100 16 256visible_hostname dns_testnamesum_object_size 4096 KB reply_body_max_size 10240000 allow all1.前期准备：准备 web 服务器：缓存的最大对象的最大对象roothttpServer Desktop# vim /etc/sysconfig/network-scripts/ifcfg-eth0DEVICE=eth0HWADDR=00:0c:29:d0

3、:9e:c4TYPE=EthernetUUID=ac1bc5a9-99dc-45ca-9d49-1a64de7c93ed ONBOOT=yesNM_CONTROLLED=yes传统重启网卡，查看配置roothttpServer Desktop# /etc/init.d/network restarthttp server 其实不需要两块网卡，单网卡即可roothttpServer Desktop# iptables -F roothttpServer Desktop# iptables -XroothttpServer Desktop# setenforce 0开启 httpd 服务，测试性：

4、配置 squid 服务器：（需要双网卡！）rootSquidServer Desktop# vim /etc/sysconfig/network-scripts/ifcfg-eth0【】DEVICE=eth0HWADDR=00:0c:29:a0:6b:40TYPE=EthernetUUID=ac1bc5a9-99dc-45ca-9d49-1a64de7c93ed ONBOOT=yesNM_CONTROLLED=yes BOOTPROTO=noneUSERCTL=noBOOTPROTO=none USERCTL=noIPV6INIT=noIPADDR=72NETMASK=2

5、 GATEWAY=【内网】rootSquidServer Desktop# vim /etc/sysconfig/network-scripts/ifcfg-eth1重启网卡服务：rootSquidServer Desktop# iptables -FrootSquidServer Desktop# iptables -XrootSquidServer Desktop# setenforce 0# Please read /usr/share/doc/initscripts-*/sysconfig.txt # for the documentati

6、on of these parameters.DEVICE=eth1BOOTPROTO=noneTYPE=EthernetHWADDR=00:0c:29:a0:6b:4a IPADDR=NETMASK= IPV6INIT=noONBOOT=yes USERCTL=noIPV6INIT=noIPADDR=NETMASK=由功能rootSquidServer Desktop# echo 1 > /proc/sys/net/ipv4/ip_forward配置 windows 客户机：测试http 服

7、务器，（172 网段服务器）查看 http 服务器日志文件：roothttpServer # tail -3 /usr/local/httpd/logs/access_log前期准备完成！2.编译安装 squid 服务rootSquidServer # tar -zxf squid-3.4.6.tar.gz -C /usr/src/ rootSquidServer # cd /usr/src/squid-3.4.6/rootSquidServer squid-3.4.6# ./configure -prefix=/usr/local/squid -sysconfdir=/etc -enable

8、-arp-acl -enable-linux-netfilter -enable-linux-tproxy -enable-async-io=100 -enable-err-language="Simplify_" -enable-underscore -enable-poll -enable-gnuregex注释：【漫长的等待】【优化路径】【创建程序用户 squid】rootSquidServer squid-3.4.6# make -j8 && make installrootSquidServer squid-3.4.6# ln -s /usr/loc

9、al/squid/sbin/* /usr/local/sbin/ rootSquidServer squid-3.4.6# useradd -M -s /sbin/nologin squidrootSquidServer squid-3.4.6# chown -R squid.squid /usr/local/squid/var/自写服务：rootSquidServer run# vim /etc/init.d/squid-prefix=/usr/local/squid安装路径-sysconfdir=/etc单独将配置文件修改到其他位置-enable-arp-acl可以再规则中设置直接通过客户

10、端 mac 地址进行管理，防止客户机 ip-enable-linux-netfilter使用内核过滤-enable-linux-tproxy支持透明模式-enable-async-io=100异步 i/o，提升储存性能-enable-err-language="Simplify_"错误信息提示语言-enable-underscoreURL 中有下划线-enable-poll使用 Poll（）模式，提升性能-enable-gnuregex使用 GUN 正则表达式#!/bin/bash# chkconfig: 2345 90 25# pidfile: /usr/loca/squ

11、id/var/run/squid.pid # config: /etc/squid/squid.conf# BEGIN INIT INFO# Provides: squid# Short-Description: starting and stopping Squid Internet Object Cache # Description: Squid - Internet Object Cache. Internet object caching is # # # #a way to store requested Internet objects (i.e., data available

12、 via the HTTP, FTP, and gopher protocols) on a system closer to the requesting site than to the source. Web browsers can then use the local Squid cache as a proxy HTTP server, reducing access time as well as bandwidth consumption.# END INIT INFOPID="/usr/local/squid/var/run/squid.pid" CONF

13、="/etc/squid/squid.conf" CMD="/usr/local/squid/sbin/squid"STATUS()netstat -anpt | grep squid&>/dev/nullif $? -eq 0 thenecho "squid is running"ficase "$1" instart)netstat -anpt | grep squid &> /dev/null if $? -eq 0 thenecho "squid is running&

14、quot;elseecho "正在启动 squid."$CMDfi;stop)$CMD -k kill &> /dev/null rm -rf $PID &> /dev/null;status) -f $PID &> /dev/null if $? -eq 0 then STATUSelseecho "Squid is not runing"firootSquidServer # chmod +x /etc/init.d/squidrootSquidServer # chkconfig -add squid ro

15、otSquidServer # chkconfig squid on 错误提示：rootSquidServer local# /etc/init.d/squid start squid is running2015/06/26 20:33:12| WARNING: Could not determine this machines public hostname. Please configure one or set 'visible_hostname'.2015/06/26 20:33:12| WARNING: Could not determine this machin

16、es public hostname. Please configure one or set 'visible_hostname'.2015/06/26 20:33:12| WARNING: Could not determine this machines public hostname. Please configure one or set 'visible_hostname'.WARNING: Cannot write log file: /usr/local/squid/var/logs/cache.log/usr/local/squid/var/l

17、ogs/cache.log: Permission denied messages will be sent to 'stderr'.解决方案：2015/06/26 20:33:12| WARNING: Could not determine this machines public hostname. Please configure one or set2015/06/26 20:33:12 |警告:无法确定这公共主机名。请配置一个或一组“visible_hostname”。'visible_hostname'.无法确定主机名，手动写入主机名，重启服务roo

18、tSquidServer Desktop# vim /etc/squid.confWARNING: Cannot write log file: /usr/local/squid/var/logs/cache.log/usr/local/squid/var/logs/cache.log: Permission denied messages will be sent to 'stderr'.警告:不能写日志文件:/usr/local/squid/var/logs/cache.log/usr/local/squid/var/logs/cache.日志:拒绝消息将被到 stderr

19、。权限不足导致无权写入文件，因为在之前将其宿主设置为 squid 用户，而现在以 root 用户运行服务，出现文件。处理方案：rootSquidServer local# chown -R squid:squid /usr/local/squid/var/logs/ rootSquidServer local# chmod -R 777 /usr/local/squid/var/logs/rootSquidServer local# /etc/init.d/squid restartvisible_hostname localhost.localdomain【改成本机主机名】;restart)

20、$0 stop &>/dev/null echo "正在关闭 squid."$0 start &>/dev/null echo "正在启动 squid."reload)$CMD -k reconfigure;check)$CMD -k parse;*)echo "Usage: $0 start|stop|status|reload|check|restart"esac正在关闭 squid. 正在启动 squid. 处理方案：rootwww squid-3.4.6# vim /etc/squid.conf【手

21、动指定用户以及组】3.配置传统：rootSquidServer Desktop# vim /etc/squid.conf重启服务：rootSquidServer Desktop# /etc/init.d/squid restart正在关闭 squid.正在启动 squid.为客户机设置：windows：55 # And finally deny all other access to this proxy56 http_access allow all默认是 deny，手动改为 allow 57 reply_body_max_size 10 MB的最大附件大小58 # Squid normal

22、ly listens to port 312859 http_port 3128默认端312873 # Uncomment and adjust the following to add a disk cache directory.74 cache_dir ufs /usr/local/squid/var/cache/squid 100 16 256开启本地缓存60 cache_effective_user squid61 cache_effective_group squidLinux 客户机：rootlocalhost # vim /etc/profile【此操作只对 wget、elin

23、ks 等文本浏览器生效，对第浏览器无效】rootlocalhost # . /etc/profilerootlocalhost 123# wget-2015-06-26 21:37:32-正在连接72:80. 已连接。已发出 HTTP 请求，正在等待回应. 200 OK长度：44 text/html正在保存至: “index.html”100%=> 44-.-K/sin 0s2015-06-26 21:37:32 (10.2 MB/s) - 已保存 “index.html” 44/44)HTTP_PROXY= HTTPS_PROXY= FTP_PROXY=NO_PR

24、OXY=192.168.4.,export HTTP_PROXY HTTPS_PROXY FTP_PROXY NO_PROXY：服务器：4.【日志】rootSquidServer Desktop# tail /usr/local/squid/var/logs/access.loghttp 服务器：roothttpServer local# tail -5 /usr/local/httpd/logs/access_log【日志】5.配置配置 squid 支持rootSquidServer Desktop# vim /etc/squid.conf重启服务rootlocalhost squid-3.

25、4.6# /etc/init.d/squid restart正在关闭 squid.正在启动 squid.使用 iptables 进行重定向rootSquidServer Desktop# iptables -t nat -I PREROUTING -i eth1 -s /24 -p tcp -dport 80 -j REDIRECT -to 3128rootSquidServer Desktop# iptables -t nat -I PREROUTING -i eth1 -s /24 -p tcp -dport 443 -j REDIRECT -t

26、o58 # Squid normally listens to port 3128 59 http_port 3128 transparent3128将目标网段测试：客户机关闭80,443 的请求重定向到本机的 3128 端口，清除缓存Squid 服务器：6.ACl根据源地址、目标 URL、文件类型等定义列表（自定义 ACL）acl列表名称 列表类型已定义的 acl 列表进行限制http_accessallow 或 deny列表内容 .（ACL）列表名称 .语法定义如下：acl aclname acltype string1acl aclname acltype "file"

27、;/acltype 可以是（src、dst、srcdomain、dstdomain、url_regex、urlpath_regex、time、port、proto、method）(1) src：源地址。定义如下：acl aclname src ip-address/netmask . 客户ip 地址acl:aclname src addr1-addr2/netmask . 地址范围(2)dst：目标地址acl aclname dst ip-address/netmask .(3)srcdomain：客户所属的域acl aclname srcdomain .(4)dstdomain：请求服务器所

28、属的域acl aclnamedstdomain .(5)time：时间acl aclnametime day-abbrevs h1:m1-h2:m2hh:mm-hh:mm1S：指代 Sunday2M：指代 Monday3T：指代 Tuesday4W：指代 Wednesday5H：指代 Thursday6F：指代 Friday7A：指代 Saturday(6)port：端口。可以指定多个端口acl aclnameport 80 70 21 .acl aclnameport 0-1024 . 指定一个端口范围(7)proto：使用协议acl aclname proto HTTP FTP .(8)m

29、ethod：请求acl aclname method GET POST .(9)url_regex：URL 规则表达式匹配acl aclname url_regex-i pattern(10)urlpath_regex：URL-path 规则表达式匹配acl aclname urlpath_regex-i pattern2http_access列表。最后的条目设为“deny all”或“allow all”来避免根据列表或某一类用户安全性隐患。http_access Action1 AND2 AND 多个，http_access间用或运算连接，但每个条目的元素间用与运算连接，列表中的规则总是遵

30、循由上而下的顺序。3实例应用（1）IP 地址为 00 的客户机上网acl client src http_access deny client（2）网段 10-50 上网acl client src 0-0/32http_access deny client（3）拒绝web 的ipacl client dst http_access deny client（4）限制 URL 以 某些内容 开头acl client url_regex indexhttp_access deny client（

31、5）限制 URL 以 某些内容 结尾acl client urlpath_regex .htmlhttp_access deny client（6）限制时间段acl client time MTWHFA 9:00-18:00http_access deny client（7）限制 443 端口上网acl http port 443http_access deny http（8）限制用户并发连接数为：5acl clientsrc 5acl conn5 max 5http_access deny client conn5（9）*.mp3$ *.exe$ *.zip$ *.rar

32、$ *.doc$类型的文件acl clienturlpath_regex -i .mp3$ .exe$.zip$.rar$.doc$http_access修改配置文件deny client【添加在配置文件首部！】rootlocalhost squid-3.4.6# /etc/init.d/squid restart正在关闭 squid. 正在启动 squid. 测试：rootlocalhost squid-3.4.6# vim /etc/squid.conf#ACL #acl upload urlpath_regex -i .3gp$ .mp4$ .f4v$ .mkv$ .rmvb$ .avi

33、$ http_access deny upload#域acl balckdomain dstdomain http_access deny balckdomain#使用时间段acl truetime time MTWHF 08:30-17:30 http_access allow truetimehttp_access deny allum_object_size4 MB可以文件不后缀为不.avi可以正常网页7.配置日志分析SARG 的全称是：Squid Analysis Report GeneratorSARG 非常好用的 Squid 日志分析工具,它输出 html 格式，可以详细列出了每一

34、位用户internet 的站点信息，时间占用信息，排名，连接次数， 的主页：a.配置 yum，安装 GD 库：量，量等。rootSquidServer # mkdir /media/cdromrootSquidServer # mount /dev/cdrom /media/cdrommount: block device /dev/sr0 is write-protected, mounting read-only rootSquidServer # mv /etc/yum.repos.d/* /root/rootSquidServer # cp /root/CentOS-Media.rep

35、o /etc/yum.repos.d/base.repo【配置 yum，内容省略】rootSquidServer # vim /etc/yum.repos.d/base.reporootSquidServer # yum clean all已加载插件：fastestmirror, refresh-packagekit, security Cleaning repos: c6-media一切Cleaning up list of fastest mirrorsrootSquidServer # yum -y install gd gd-develb.安装 sarg【学校那个源码包有。】root

36、SquidServer Desktop# tar -zxvf sarg-2.3.1.tar.gz -C /usr/src/root SquidServer Desktop# cd /usr/src/sarg-2.3.1/root SquidServer sarg-2.3.1# ./configure -prefix=/usr/local/sarg -sysconfdir=/etc/sarg -enable-extraprotectionrootlocalhost sarg-2.3.1# make && make installC.配置 sargrootlocalhost sarg-2.3.1# vim /etc/sarg/sarg.confD.运行rootSquidServer # touch /usr/local/sarg/noreport【创建top，加入则不进行排序】rootSquidServer # ln -s /usr/local/sarg/bin/sarg /usr/local/bin/【优化命令路径】rootSquidServer # sarg在文件: 222, reading: 100.00%的生成报告在 /usr/local/httpd/htdocs/squid-reports/2015Jun28-2015Jun28SARG:SA