1. 编译:
wget http://www.squid-cache.org/
tar -xvzf squid-4.0.4-20160205-r14526.
cd squid-4.0.4-20160205-r14526
编译之前做好基础准备,安装好openssl 和gcc等,这里就不废话了.
下面是编译的重中之重,
./configure '--build=x86_64-redhat-linux-
预配置完成以后,开始编译
make
等待15-20分钟
完成:
make install && cp basic_ncsa_auth /usr/bin/
这里basic_ncsa_auth是实现用户认证的关键文件,
然后运行:
squid -v
Squid Cache: Version 4.0.4-20160205-r14526
Service Name: squid
configure options: '--build=x86_64-redhat-linux-
你会发现squid确实是4.0.4了。
2. 制作证书:
cd /etc/squid/
openssl req -new -x509 -days 7777 -nodes -out vps.pem -keyout vps.pem
openssl gendh 2048 >> vps.pem
openssl x509 -subject -dates -fingerprint -in vps.pem
openssl gendh 2048 >> vps.pem
openssl x509 -subject -dates -fingerprint -in vps.pem
3. 配置 squid.conf
vi /etc/squid/squid.conf
主要做以下修改(暂时不开启用户认证):
#http_access deny all
http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem
http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem
然后ESC :wq 存盘。
启动squid
[[email protected] ~]# squid
查看后台进程:
[[email protected] ~]# ps -ef |grep squid
root 21537 1 0 12:02 ? 00:00:00 squid
squid 21539 21537 0 12:02 ? 00:00:01 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 22642 22621 0 12:40 pts/3 00:00:00 grep --color=auto squid
root 21537 1 0 12:02 ? 00:00:00 squid
squid 21539 21537 0 12:02 ? 00:00:01 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 22642 22621 0 12:40 pts/3 00:00:00 grep --color=auto squid
到此为止:服务端基本配置完毕。
4. 客户端配置:
客户端配置远远没有你们想象中那么简单,因为自签发的证书是通过 不了chrome的CA认证的!
所以,简单的建立一个https: vpsip:443的代理,chrome是无法识别, 拒绝连接的!
怎么办? 所以这里需要引入stunnel, 通过stunnel跟VPS的SSL证书握手, 因为stunnel不检查CA证书,所以没有这个问题,然后把外 部的https连接转换为普通的本地http代理, 这样chrome就不会检查证书了, 因为普通的http连接是不需要检查证书的。 下面是详细的步骤:
a. 通过winscp把上面的vps.pem证书传回本地:
b. 下载安装stunnle (https://www.stunnel.org/ downloads.html)
安装以后,主要不要签发生成stunnel自带的证书:
然后把vps.pem放入stunnel的config目录, 然后编辑stunnel.conf文件:
把里面的内容统统删光,把下面的内容粘贴进去:
[https]
client = yes
accept = 800
connect = VPS IP:443
cert = .\vps.pem
client = yes
accept = 800
connect = VPS IP:443
cert = .\vps.pem
把你的VPS IP粘贴进去,800是本地代理监听端口,可以随便改。
启动stunnel
然后chrome通过swithyomega, 新建一个http: 127.0.0.1:800的代理.
切换到此代理,OK! 搞定!现在已经可以用了! 至此squid的https通道已经完全搭建好了!
5. 实现squid用户认证:
因为你可能不希望什么人都可以随意的连接到你的VPS, 需要更严格更安全的认证,这时候需要引入squid用户认证。
前面的编译的时候已经做了铺垫,编译生成了用户认证的关键文件: basic_ncsa_auth
下面还需要生成一个密码文件:
yum install httpd
htpasswd /etc/squid/passwd user1user1就是用户名
然后输入密码
New password:
Re-type new password:
记住此密码,密码文件存放在/etc/squid/passwd最后配置squid.conf文件
vi /etc/squid/squid.conf
主要做以下修改:
# And finally deny all other access to this proxy
auth_param basic program /usr/bin/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic credentialsttl 2 hours
auth_param basic realm Example.com's Squid proxy-caching
acl auth_users proxy_auth REQUIRED
http_access allow auth_users
auth_param basic children 5
auth_param basic credentialsttl 2 hours
auth_param basic realm Example.com's Squid proxy-caching
acl auth_users proxy_auth REQUIRED
http_access allow auth_users
#http_access deny all
#http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem
#http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem
完成以后
运行: ps -ef | grep squid
终止掉squid的进程
ps -ef |grep squid
root 21537 1 0 12:02 ? 00:00:00 squid
squid 21539 21537 0 12:02 ? 00:00:01 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 22642 22621 0 12:40 pts/3 00:00:00 grep --color=auto squid
这里运行两次kill 21539
然后重启squid
[[email protected] ~]# squid
看看后台进程:
ps -ef |grep squid
root 21537 1 0 12:02 ? 00:00:00 squid
squid 21539 21537 0 12:02 ? 00:00:02 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 23148 23132 0 13:00 pts/0 00:00:00 grep --color=auto squid
squid 21539 21537 0 12:02 ? 00:00:02 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 23148 23132 0 13:00 pts/0 00:00:00 grep --color=auto squid
至此教程全部完成! 这里面最难的其实还是自编译squid SSL支持的实现,
来源: 翻墙论坛 Gary12