Setting up a Squid Proxy

Copyright, 24 Oct 2000 Arron Cusimano.
Revised 21/5/2001.

These are my personal notes on setting up and maintaining a proxy server.

 

Commands are in dark red, 10 point courier.

File names are in dark green, 10 point courier.


I have used RedHat6.0 – RedHat7.0 Linux for this task successfully, this document is focused on RH7, tho most stuff should be applicible to RH6+ & Mandrake 7.2+ . 

 

Upon install of Red Hat, choose the “Server option”.
Choose “web server”.
Choose “customize packages installed”. 

You will need to install squid.

Also install caching-nameserver & linuxconf.

 

As well as the daemons below you will need :
Calamaris, which is on the redhat7 power tools CD, or
http://freshmeat.net/

Make sure you remove any RPC related daemons, preferably with "rpm -e", they are a MAJOR security flaw on a gateway style machine.

 

 

Daemons used Why...
squid Good file cache for internet browsers, save download bandwidth & cost, increase apparent download speed
httpd (Apache) Easy status checking of server, also provide small private intra-net web site
ntp (ntpdate) Keep servers clock correct, no need to worry about cmos clock batteries etc. keeps cron and log timing correct
named (bind) Cache DNS requests, cache makes things go faster, & saves money. 
sshd Ability to remotely access & maintain server securely, only telnet in if absolutely necessary. telnet is a huge security risk, get rid of it with rpm -ev telnet-server .
crond Auto-rotate logs, so they don’t get too big and fill disk space. Auto-generate cache reports using calamaris

 

 

Squid (squid-2.3.STABLE4-1) setup

 

Use /etc/rc.d/init.d/squid start to start, /etc/rc.d/init.d/squid stop to stop and /etc/rc.d/init.d/squid stop ; /etc/rc.d/init.d/squid start to restart, I find /etc/rc.d/init.d/squid restart does not work with any version of redhat.

 

After choosing your cache_dir (see sample squid.conf below) run squid –z. make sure you set file permissions and especially chown the directory to squid e.g. chown squid:squid cache .

 

To speed up file system access I use the noatime option in /etc/fstab like so :

LABEL=/                 /                       ext2    defaults,noatime 1 1
LABEL=/boot             /boot                   ext2    defaults,noatime 1 2
LABEL=/home             /home                   ext2    defaults,noatime 1 2
/dev/cdrom              /mnt/cdrom              iso9660 noauto,owner,ro 0 0
/dev/fd0                /mnt/floppy             auto    noauto,owner    0 0
LABEL=/usr              /usr                    ext2    defaults,noatime 1 2
LABEL=/var              /var                    ext2    defaults,noatime 1 2
/proc                   proc    defaults        0 0 none                   
none                    /dev/pts                devpts  gid=5,mode=620  0 0
/dev/sda9               swap                    swap    defaults        0 0
/dev/hdc1               /mnt/hdc                ext2    defaults,noatime 1 1
 

 

 

/etc/squid/squid.conf

#      You may specify multiple socket addresses on multiple lines.
http_port 3128
http_port 8080

# ISP's cache
cache_peer melbourne.cache.telstra.net parent 3128 3130

# I run this on a 128M RAM machine. In reality squid WILL use 3x this amount at minimum. (with 8Meg cache mem, 8Gig disk cache, squid has 102Meg Virtual Image Size[mem size] on my server, it gets a LOT of usage tho)

cache_mem  8 MB

# make sure those MPEGs get cached …
maximum_object_size 16000 KB

# Because of limited space on /var, I used to use a custom dir on /usr partition as well as the /home partition, but now i have a dedicated drive for the cache.
# Earlier versions of squid dont have the "ufs" entry...
#
#cache_dir ufs /home/squid/cache 800 16 256
#cache_dir ufs /usr/local/squid/cache 800 16 256
cache_dir ufs /mnt/hdc/squid/cache 7000 32 256

#cache_access_log /var/log/squid/access.log

# only log the essentials
#cache_log /var/log/squid/cache.log
cache_log /dev/nul
#cache_store_log /var/log/squid/store.log
cache_store_log none


#Default:
refresh_pattern            ^ftp:         1440   20%    10080
refresh_pattern            ^gopher:      1440   0%     1440
refresh_pattern      .             0      20%    4320


# now the hard stuff, access control, for security.

#Defaults:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 21 443 563 70 210 1025-65535
acl Safe_ports port 280           # http-mgmt
acl Safe_ports port 488           # gss-http
acl Safe_ports port 591           # filemaker
acl Safe_ports port 777           # multiling http
acl CONNECT method CONNECT


# Arron's... I have an IPMasq'ed Class C network accessing this server. No-one else gets access!
acl localnet src 192.168.0.0/255.255.255.0

#Default configuration:

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Arron's ...
http_access allow lo

 

NTP (ntp-4.0.99j-7) setup

 

I do not use ntpd because I don’t need its accuracy (or bandwidth hogging, when you pay per meg, less traffic is better) for science projects, I just want to keep my clock reasonably accurate for logging and cron jobs. So ntpdate once a day is fine for me.

 

Don’t use my example servers. Try http://www.eecis.udel.edu/~mills/ntp/clock2.htm (I found this on http://www.google.com/) for a good listing and use a stratum 2 server geographically near you. Don’t use stratum 1 servers unless you plan to be a stratum 2 server to others, otherwise the stratum 1 servers will get overburdened and shut down.

 

Set your time zone with the setup utility.

Create a file for stuff to be done daily in /etc/cron.daily/

 

# ls -lh /etc/cron.hourly/arrons-stuff

-rwxr-xr-x    1 root     root          176 Oct 24 12:57 /etc/cron.hourly/arrons-stuff

 

/etc/cron.hourly/arrons-stuff

#!/bin/sh

 

cd /root/setiathome-3.0.i686-pc-linux-gnu-gnulibc2.1

./setiathome -nice 19 > /dev/null 2> /dev/null

 

ntpdate -vs time.ntp.com ntp.mars.edu ntp.pluto.net

 

 

 

Apache (apache-1.3.12-25) setup

 

This is very easy to setup, if only you need to upload files.

Listed below are just the options I needed to change and their values, it is NOT a complete config file.

 

/etc/httpd/conf/httpd.conf

MinSpareServers 20

MaxSpareServers 30

StartServers 20

 

# If your host doesn't have a registered DNS name, enter its IP address here.

ServerName 1.1.1.1

 

#

# Control access to UserDir directories.  The following is an example

# for a site where these directories are restricted to read-only.

#

<Directory /home/*/public_html>

    AllowOverride FileInfo AuthConfig Limit

    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec

    <Limit GET POST OPTIONS PROPFIND>

        Order allow,deny

        Allow from all

    </Limit>

    <Limit PUT DELETE PATCH PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>

        Order deny,allow

        Deny from all

    </Limit>

</Directory>

 

 

HostnameLookups Off

 

 

 

Cron

 

/etc/cron.daily/arrons-stuff

#!/bin/sh

 

squid -k rotate

 

cat /var/log/squid/access.log.[0-9] | /usr/bin/calamaris -d 20 -P 60 -r -1 -s -t 20 -p new -w -l "<p>Dendy server squid report</p>" > /var/www/html/index.html

 

 

 

/etc/cron.hourly/arrons-stuff

#!/bin/sh

 

cd /root/setiathome-3.0.i686-pc-linux-gnu-gnulibc2.1

./setiathome -nice 19 > /dev/null 2> /dev/null

 

ntpdate -vs time.esec.com.au ntp.adelaide.edu.au ntp.saard.net

 

 

 

 

 

IP Masq

 

Having 2 net cards, and acting as a bridge, I need some kind of firewall/router/masq type script. This script was bastardized from somewhere… (this is not meant to be secure, just enable IP Masq, although I think it’s reasonably secure with the private address range, but I’m no expert in security).

 

Most people will not need to alias their eth1 interface… in fact * I * don’t need to… but I find it useful and I have the IP addresses…

 

Call this from your /etc/rc.d/rc.local script.

 

/etc/rc.d/rc.firewall

#!/bin/sh

#

echo rc.firewall - Initial SIMPLE IP Masquerade test for 2.1.x and

echo               2.2.x kernels using IPCHAINS

#

 

echo Alias eth1 to 192.168.0.1/255.255.255.0

  /sbin/ifconfig eth1:0 192.168.0.1

echo Flush everything, start from scratch

  /sbin/ipchains -F input

  /sbin/ipchains -F output

  /sbin/ipchains -F forward

 

echo Load all required IP MASQ modules

#

#   NOTE:  Only load the IP MASQ modules you need.  All current IP MASQ modules

#          are shown below but are commented out from loading.

 

# Needed to initially load modules

#

/sbin/depmod -a

 

# Supports the proper masquerading of FTP file transfers using the PORT method

#

/sbin/modprobe ip_masq_ftp

 

# Supports the masquerading of RealAudio over UDP.  Without this module,

#       RealAudio WILL function but in TCP mode.  This can cause a reduction

#       in sound quality

#

/sbin/modprobe ip_masq_raudio

 

# Supports the masquerading of IRC DCC file transfers

#

/sbin/modprobe ip_masq_irc

 

 

# Supports the masquerading of Quake and QuakeWorld by default.  This modules is

#   for for multiple users behind the Linux MASQ server.  If you are going to play

#   Quake I, II, and III, use the second example.

#

#   NOTE:  If you get ERRORs loading the QUAKE module, you are running an old

#   -----  kernel that has bugs in it.  Please upgrade to the newest kernel.

#

#Quake I / QuakeWorld (ports 26000 and 27000)

#/sbin/modprobe ip_masq_quake

#

#Quake I/II/III / QuakeWorld (ports 26000, 27000, 27910, 27960)

#/sbin/modprobe ip_masq_quake 26000,27000,27910,27960

 

 

# Supports the masquerading of the CuSeeme video conferencing software

#

/sbin/modprobe ip_masq_cuseeme

 

#Supports the masquerading of the VDO-live video conferencing software

#

/sbin/modprobe ip_masq_vdolive

 

 

echo CRITICAL:  Enable IP forwarding since it is disabled by default since

#

#           Redhat Users:  you may try changing the options in /etc/sysconfig/network from:

#

#                       FORWARD_IPV4=false

#                             to

#                       FORWARD_IPV4=true

#

echo "1" > /proc/sys/net/ipv4/ip_forward

 

 

echo CRITICAL:  Enable automatic IP defragmenting since it is disabled by default in 2.2.x kernels

#

#           This used to be a compile-time option but the behavior was changed in 2.2.12

#

echo "1" > /proc/sys/net/ipv4/ip_always_defrag

 

 

echo Dynamic IP users:

#

#   If you get your IP address dynamically from SLIP, PPP, or DHCP, enable this following

#       option.  This enables dynamic-ip address hacking in IP MASQ, making the life

#       with Diald and similar programs much easier.

#

echo "1" > /proc/sys/net/ipv4/ip_dynaddr

 

 

# Enable the LooseUDP patch which some Internet-based games require

#

#  If you are trying to get an Internet game to work through your IP MASQ box,

#  and you have set it up to the best of your ability without it working, try

#  enabling this option (delete the "#" character).  This option is disabled

#  by default due to possible internal machine UDP port scanning

#  vunerabilities.

#

#echo "1" > /proc/sys/net/ipv4/ip_masq_udp_dloose

 

 

echo MASQ timeouts

#

#   2 hrs timeout for TCP session timeouts

#  10 sec timeout for traffic after the TCP/IP "FIN" packet is received

#  160 sec timeout for UDP traffic (Important for MASQ'ed ICQ users)

#

/sbin/ipchains -M -S 7200 10 160

 

 

# DHCP:  For people who receive their external IP address from either DHCP or BOOTP

#        such as ADSL or Cablemodem users, it is necessary to use the following

#        before the deny command.  The "bootp_client_net_if_name" should be replaced

#        the name of the link that the DHCP/BOOTP server will put an address on to?

#        This will be something like "eth0", "eth1", etc.

#

#        This example is currently commented out.

#

#

#/sbin/ipchains -A input -j ACCEPT -i bootp_clients_net_if_name -s 0/0 67 -d 0/0 68 -p udp

 

echo Enable simple IP forwarding and Masquerading

#

#  NOTE:  The following is an example for an internal LAN address in the 192.168.0.x

#         network with a 255.255.255.0 or a "24" bit subnet mask.

#

#         Please change this network number and subnet mask to match your internal LAN setup

#

/sbin/ipchains -P forward DENY

/sbin/ipchains -A forward -s 192.168.0.0/24 -j MASQ

 

echo Done.

 

sleep 3

 

 

 

Caching-nameserver (bind 8.2.2_P5)

 

Install with rpm -iv caching-nameserver* from the CD If you missed it during install.

edit your /etc/resolv.conf file and include yourself (127.0.0.1), before your external nameservers. 

Warning: Several security problems have been found in the bind 8.2.2 series. See : http://www.redhat.com/support/errata/RHSA-2001-007.html

 

/etc/resolv.conf

search mydomain.com.au
nameserver 127.0.0.1
nameserver 223.8.193.1
nameserver 142.109.64.17