squid.conf

squid.md

squid ip 白名单授权 or auth_user 授权

一开始需要定义一个safe_host 将所有有权限使用squid的主机定义到其中,并在自定义规则的前面定义一条 http_access deny !safe_host ,来明确禁止非安全主机访问,因为使用auth_user认证时无法使用ip限制,使用该规则可以先把非法ip排除在外;

auth_ip 通过 src 地址认证,不验证用户密码

指定ip可以连指定域名, 可以代理yum仓库等公共地址 http_access allow localnet ip_auth_domain http_access allow localnet ip_auth_host

auth_user 通过账户认证不限制ip

指定用户可以连指定域名 http_access allow auth_user user_auth_domain http_access allow auth_user user_auth_host

添加用户

htpasswd /etc/squid/squid.user user1

常用命令

squid -k parse -f squid.conf #验证配置文件有效性

squid -k reconfigure #重载配置

#
# Recommended minimum configuration:
#
 
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/squid.user
acl auth_user proxy_auth REQUIRED

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
# 有一条规程会拒绝所有非 safe_host; 所有要运行的host必须先在这里面定义好
# 开ip访问规则时禁止使用该acl,可以单独再定义一个小范围的主机组
acl safe_host src 10.0.0.0/8
acl safe_host src 172.16.0.0/12
acl safe_host src  127.0.0.1/32


acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 127.0.0.1      # RFC1918 possible internal network
 
acl exp_host src 10.111.0.0/16
acl local_test_1 src 10.111.0.0/16

#定义非http请求的端口, 如https,tcp请求
acl SSL_ports port 443
#acl SSL_ports port 51234
acl Safe_ports port 80          # http
#acl Safe_ports port 21         # ftp
acl Safe_ports port 443         # https
#acl Safe_ports port 70         # gopher
#acl Safe_ports port 210                # wais
#acl Safe_ports port 1025-65535 # unregistered ports
#acl Safe_ports port 280                # http-mgmt
#acl Safe_ports port 488                # gss-http
#acl Safe_ports port 591                # filemaker
#acl Safe_ports port 777                # multiling http
#acl Safe_ports port 51234       # multiling http
#acl Safe_ports port 465
#acl Safe_ports port 587
#发邮件可以单独加其他代理
acl CONNECT method CONNECT
 
#deny_domain
acl deny_domain dstdomain xx.xx.xx
#deny_host
acl deny_host dst 172.20.0.0/16
acl deny_host dst 169.254.0.0/16
#deny_src   禁止指定的ip/网段使用代理
acl deny_src src 1.2.3.4/32
#acl deny_src src 1.1.1.0/24

acl user_auth_host dst 1.2.3.4
acl user_auth_domain dstdomain www.google.com
 
acl ip_auth_domain dstdomain amazonlinux-2-repos-ap-southeast-1.s3.ap-southeast-1.amazonaws.com
acl ip_auth_host dst 8.8.8.8 
#acl Noti_domain dstdomain .dingtalk.com
#acl Noti_domain dstdomain .slack.com
 
#http_access allow localhost
 
#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
http_access deny !safe_host
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
 
#http_access allow localhost  localhost  #本机测试使用
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
forwarded_for delete     #删除代理 xff头暴露内网ip
 
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
http_access deny to_localhost
http_access deny deny_domain 
http_access deny deny_host
http_access deny deny_src      #禁止指定的源地址访问
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# 允许所有机器连通知域名
#http_access allow notifynet Noti_domain


# local_test_1
# http_access allow local_test_1 ip_auth_domain
# http_access allow local_test_1 ip_auth_host

# auth_ip 通过 src 地址认证,不验证用户密码
http_access allow localnet ip_auth_domain
http_access allow localnet ip_auth_host

# auth_user 通过账户认证不限制ip
http_access allow auth_user user_auth_domain
http_access allow auth_user user_auth_host


# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
#http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
#http_access deny all
 
# Squid normally listens to port 3128
http_port 3128
 
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256
 
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
 
#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320