Implementasi Squid 3.5.27 Centos 7
Implementasi Squid 3.5.27 Centos 7
Implementasi Squid 3.5.27 Centos 7
cp /etc/sysconfig/network-scripts/ifcfg-lo /etc/sysconfig/network-scripts/ifcfg-eth0
vim /etc/sysconfig/network-scripts/ifcfg-eth0
HWADDR=00:0c:29:e0:32:d4
DEVICE=eth0
BOOTPROTO=none
IPADDR=192.168.93.50
NETMASK=255.255.255.0
NETWORK=192.168.93.0
GATEWAY=192.168.93.2
DNS1=8.8.8.8
DNS2=8.8.4.4
BROADCAST=192.168.93.255
ONBOOT=yes
NAME=eth0
vim /etc/sysconfig/network-scripts/ifcfg-eth1
HWADDR=00:0c:29:e0:32:de
DEVICE=eth1
BOOTPROTO=none
IPADDR=192.168.1.1
NETMASK=255.255.255.0
NETWORK=192.168.1.0
BROADCAST=192.168.1.255
ONBOOT=yes
NAME=eth1
chkconfig network on
make all
make install
# Squid daemons.
# chkconfig: - 58 74
# Provides: squid3.5
. /etc/init.d/functions
. /etc/sysconfig/network
prog=squid
prog_dir=/usr/local/squid/sbin/
lockfile=/var/lock/subsys/$prog
start() {
daemon $prog_dir/$prog -D
RETVAL=$?
echo
return $RETVAL
stop() {
killproc $prog_dir/$prog
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && rm -f $lockfile
return $RETVAL
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status $prog
;;
restart)
stop
start
;;
*)
exit 2
esac
touch /usr/local/squid/var/logs/cache.log
touch /usr/local/squid/var/logs/access.log
chkconfig squid3.5 on
2. Routing
vim /etc/sysctl.conf --> tulis net.ipv4.ip_forward = 1
2A. Firewall
systemctl stop firewalld
Hapus firewalld (Linux Centos 7.1.1503 & Linux Centos 7.4.1708) : rpm -e firewalld anaconda-core
anaconda-tui anaconda-gui anaconda firewall-config initial-setup initial-setup-gui
rpm -Uvh iptables-1.4.21-18.0.1.el7.centos.x86_64.rpm
Referensi :
https://confluence.atlassian.com/kb/starting-service-on-linux-throws-a-no-such-file-or-directory-error-
794203722.html
touch /var/log/squid/cache.log
touch /var/log/squid/access.log
iptables-save
chmod +x /var/www/lightsquid/*.pl
<Directory "/var/www/html/lightsquid">
AllowOverride All
</Directory>
4C1. Troubleshooting 1
Kalo ada error sewaktu menjalankan /var/www/html/lightsquid/check-setup.pl :
4C2. Troubleshooting 2
Kalo ada error sewaktu menjalankan /var/www/html/lightsquid/check-setup.pl :
10 : menyatakan menit
Dengan konfigurasi Cron Jobs tsb LightSquid akan melakukan refresh halaman web setiap 10 menit
Konfigurasi /etc/squid/squid.conf
# should be allowed
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
# web applications running on the proxy server who think the only
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
sslproxy_client_certificate /etc/squid/ssl/myca.pem
sslproxy_client_key /etc/squid/ssl/myca.pem
sslproxy_version 3
sslproxy_capath /etc/squid/ssl/
sslproxy_cafile /etc/squid/ssl/myca.pem
sslproxy_flags NO_DEFAULT_CA
#sslproxy_flags DONT_VERIFY_PEER
# tambahan untuk SSL ------end
coredump_dir /usr/local/squid/var/cache/squid
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
visible_hostname "server1"
Pengujian
7. Konfigurasi Squid 3.5.27 (RHEL 6.5 & Centos 7) Untuk HTTP & HTTPS
Instalasinya : modul openssl-devel sudah harus ada supaya proses kompilasi tidak ada error
make
make install
Membuat sertifikat SSL untuk sisi server : openssl req -new -newkey rsa:1024 -days 365 -nodes -x509
-keyout server1.pem -out server1.pem
Membuat sertifikat SSL untuk sisi client : openssl x509 -in server1.pem -outform DER -out server1.der
# should be allowed
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
# web applications running on the proxy server who think the only
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
sslproxy_client_certificate /usr/local/squid/ssl/server1.pem
sslproxy_client_key /usr/local/squid/ssl/server1.pem
# sslproxy_version 3
sslproxy_capath /usr/local/squid/ssl/
sslproxy_cafile /usr/local/squid/ssl/server1.pem
sslproxy_flags NO_DEFAULT_CA
# sslproxy_flags DONT_VERIFY_PEER
coredump_dir /usr/local/squid/var/cache/squid
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
visible_hostname "server1"
# Squid daemons.
# chkconfig: - 58 74
# Provides: squid3527
. /etc/init.d/functions
. /etc/sysconfig/network
prog=squid
prog_dir=/usr/local/squid/sbin/
lockfile=/var/lock/subsys/$prog
start() {
daemon $prog_dir/$prog -D
RETVAL=$?
echo
return $RETVAL
}
stop() {
killproc $prog_dir/$prog
RETVAL=$?
echo
return $RETVAL
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status $prog
;;
restart)
stop
start
;;
*)
esac
Intercept SSL pada protokol HTTP akan menyebabkan beberapa website HTTPS lain yang tidak termasuk
dalam daftar pemblokiran, tidak bisa dibuka, hal ini kemungkinan karena adanya masalah kompatibilitas
sertifikat SSL yang kita buat dengan sertifikat SSL website tsb.
Website HTTP sukes diblokir
Referensi :
http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/
https://www.tectut.com/2015/08/configure-squid-as-http-and-https-transparent-proxy/
https://wiki.squid-
cache.org/ConfigExamples/Intercept/SslBumpExplicit#Intercept_HTTPS_CONNECT_messages_with_SSL-
Bump
https://wiki.squid-cache.org/Features/SslBump
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch32_:_Controlling_Web_Acc
ess_with_Squid#.WwxIx-6FPIV
Selesai