Andrew Dorokhov
Squid is a caching forward/reverse HTTP proxy.
Installation (CentOS)
yum install squid
Config file:
/etc/squid/squid.conf
Example listen port:
http_port 7777
Access control lists (ACL)
Format:
acl aclname acltype parameters
acl aclname acltype "file"
When using a file, put one value per line.
src — client IP or network
acl aclname src ip-address/netmask
Examples:
# Single host 192.168.1.1
acl vasya src 192.168.1.1/255.255.255.255
# Subnet 192.168.1.0/24
acl office src 192.168.1.1/255.255.255.0
dst — destination server
acl aclname dst ip-address/netmask
Access rules (http_access)
Format:
http_access allow|deny [!]aclname ...
Example:
acl all src 0.0.0.0/0.0.0.0
acl office src 192.168.1.0/255.255.255.0
http_access allow office
http_access deny all
Rules are evaluated in order; the first match wins.
The last http_access line is the default when nothing else matches. A final deny all blocks everyone not explicitly allowed; a final allow all permits everyone not explicitly denied. In most setups, end with deny all.
Authentication
Authentication uses auth_param:
auth_param scheme parameter [setting]
Basic auth helpers
Password storage backends include NCSA, LDAP, MSNT, PAM, SMB, getpwam, SASL, NTLM, Negotiate, and Digest.
NCSA password file
Install htpasswd:
yum -y install httpd-tools
Create the password file and a user:
htpasswd -c /etc/squid/users dataminer
Find the NCSA auth helper:
rpm -ql squid | grep ncsa_auth
Config:
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/users
auth_param basic children 5
auth_param basic realm Corporate proxy server
auth_param basic credentialsttl 2 hours
ACL for authenticated users:
acl ncsa_users proxy_auth REQUIRED
http_access allow ncsa_users
Further reading: open_in_new Squid proxy authentication using ncsa_auth .