Por Félix Molinuevo, FMSI Sistemas de Informática
El archivo de configuración por defecto de Squid es suficiente para obtener un proxy básico funcionando. Se deben realizar los siguientes cambios:
http_port 8080
maximum_object_size 153600 KB
cache_dir aufs /var/spool/squid 10240 16 256
dns_nameservers 172.16.11.1 172.16.11.2
# Debian refresh_pattern -i \.deb$ 129600 100% 129600 refresh_pattern -i \.gz$ 129600 100% 129600 refresh_pattern -i \.bz2$ 129600 100% 129600 # Imagenes refresh_pattern -i \.gif$ 14400 80% 43200 refresh_pattern -i \.tiff?$ 14400 80% 43200 refresh_pattern -i \.bmp$ 14400 80% 43200 refresh_pattern -i \.jpe?g$ 14400 80% 43200 refresh_pattern -i \.xbm$ 14400 80% 43200 refresh_pattern -i \.png$ 14400 80% 43200 refresh_pattern -i \.wrl$ 14400 80% 43200 refresh_pattern -i \.ico$ 14400 80% 43200 refresh_pattern -i \.pnm$ 14400 80% 43200 refresh_pattern -i \.pbm$ 14400 80% 43200 refresh_pattern -i \.pgm$ 14400 80% 43200 refresh_pattern -i \.ppm$ 14400 80% 43200 refresh_pattern -i \.rgb$ 14400 80% 43200 refresh_pattern -i \.ppm$ 14400 80% 43200 refresh_pattern -i \.rgb$ 14400 80% 43200 refresh_pattern -i \.xpm$ 14400 80% 43200 refresh_pattern -i \.xwd$ 14400 80% 43200 refresh_pattern -i \.pict?$ 14400 80% 43200 # Movies refresh_pattern -i \.mov$ 14400 80% 43200 refresh_pattern -i \.mpe?g?$ 14400 80% 43200 refresh_pattern -i \.avi$ 14400 80% 43200 refresh_pattern -i \.qtm?$ 14400 80% 43200 refresh_pattern -i \.viv$ 14400 80% 43200 refresh_pattern -i \.swf$ 14400 80% 43200 # Sounds refresh_pattern -i \.wav$ 14400 80% 43200 refresh_pattern -i \.aiff?$ 14400 80% 43200 refresh_pattern -i \.au$ 14400 80% 43200 refresh_pattern -i \.ram?$ 14400 80% 43200 refresh_pattern -i \.snd$ 14400 80% 43200 refresh_pattern -i \.mid$ 14400 80% 43200 refresh_pattern -i \.mp2$ 14400 80% 43200 refresh_pattern -i \.mp3$ 14400 80% 43200 # Archives refresh_pattern -i \.sit$ 14400 80% 43200 refresh_pattern -i \.zip$ 14400 80% 43200 refresh_pattern -i \.hqx$ 14400 80% 43200 refresh_pattern -i \.exe$ 14400 80% 43200 refresh_pattern -i \.bin$ 14400 80% 43200 refresh_pattern -i \.arj$ 14400 80% 43200 refresh_pattern -i \.lzh$ 14400 80% 43200 refresh_pattern -i \.lha$ 14400 80% 43200 refresh_pattern -i \.cab$ 14400 80% 43200 refresh_pattern -i \.msi$ 14400 80% 43200 refresh_pattern -i \.msp$ 14400 80% 43200 refresh_pattern -i \.psf$ 14400 80% 43200 refresh_pattern -i \.rar$ 14400 80% 43200 refresh_pattern -i \.tar$ 14400 80% 43200 refresh_pattern -i \.gz$ 14400 80% 43200 refresh_pattern -i \.z$ 14400 80% 43200 refresh_pattern -i \.a[0-9][0-9]$ 14400 80% 43200 refresh_pattern -i \.r[0-9][0-9]$ 14400 80% 43200 # Data files refresh_pattern -i \.txt$ 14400 80% 43200 refresh_pattern -i \.pdf$ 14400 80% 43200 refresh_pattern -i \.doc$ 14400 80% 43200 refresh_pattern -i \.rtf$ 14400 80% 43200 refresh_pattern -i \.tex$ 14400 80% 43200 refresh_pattern -i \.latex$ 14400 80% 43200 # Java-type objects refresh_pattern -i \.class$ 14400 80% 43200 refresh_pattern -i \.js$ 14400 80% 43200 refresh_pattern -i \.class$ 14400 80% 43200 # Web-type objects refresh_pattern -i \.css$ 10 20% 4320 refresh_pattern -i \.html?$ 10 20% 4320 refresh_pattern \/$ 10 20% 4320 # Para evitar problemas con scripts .do refresh_pattern -i \.do$ 0 0% 1440 # Default refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320
acl intranet src 172.16.11.0/255.255.255.0
http_access allow intranet
Nota: es importante mencionar que Squid es un demonio muy complejo, que posee una enorme cantidad de opciones de configuración. Es probable que la configuración mostrada aquí sea sólo el principio de un largo trabajo de puesta a punto.
auth required /lib/security/pam_unix.so shadow nullok account required /lib/security/pam_unix.so
auth_param basic program /usr/lib/squid/pam_auth auth_param basic children 5 auth_param basic credentialsttl 2 hours auth_param basic realm Y si le marcai la user y la clave mocoreta # set up the acl name for user authentication acl localusers proxy_auth REQUIRED # set up the acl name for intranet (local network) acl intranet src 172.16.11.0/255.255.255.0 # set up acl name for manager and localhost access acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 # set up access to manager from localhost and deny manager access from anywhere else http_access allow manager localhostd http_access deny manager # set up all the denies for those not in the local network http_access deny !intranet # set up the user authentication http_access allow localusers # set up the allows for the local network http_access allow intranet # deny anything that passes beyond this point http_access deny all
This is just a quick view. There is much you can do here, you can also use http://www.squidguard.org to filter sites.
acl filter url_regex "/etc/squid/banned" deny_info XANDER_ERR filter http_access deny filter
stick partial site matches such as doubleclick into the file /etc/squid/banned to block urls containing these words in the titles.
banned file
The file XANDER_ERR is found at /etc/squid/errors/English/XANDER_ERR and is a standard html page giving a custom error message.
Have a look at the multitude of variables you can embed in the file.
delay_pools 1 delay_class 1 1 delay_access 1 allow intranet delay_access 1 deny all # Nota: intranet -> misma ACL configurada en las instrucciones anteriores delay_parameters 1 16000/16000
Nota1: 16000=16Kbps
Nota2: en este parámetro, hay muchas posibilidades. Probar según necesidades
Se puede visualizar el log de accesos con:
tail -F /var/log/squid/access.log | ccze -CA
O para analizarlos, convirtiendo los timestamps en fecha y hora, con Perl:
cat /var/log/squid/access.log | perl -p -e 's/^([0-9]*)/"[".localtime($1)."]"/e' | less