208.3. Implementing a proxy server
208.3 Implementing a proxy server
Weight: 2
Description: Candidates should be able to install and configure a proxy server, including access policies, authentication and resource usage.
Key Knowledge Areas:
Squid 3.x configuration files, terms and utilities
Access restriction methods
Client user authentication methods
Layout and content of ACL in the Squid configuration files
Terms and Utilities:
squid.conf
acl
http_access
In this light weight lesson we talk about squid proxy server. Squid has a giant configuration file and covering all aspect of that needs spending more time, but for this course we just discuss about items which are important for LPIC2 exam.
What is a proxy server?
A proxy server is a computer that acts as an intermediary between a desktop computer and the internet and allows a client machine to make an indirect connection to network servers and services. There are many reasons why we might want to include a proxy server on our network:
To share internet connection on a LAN
To speed up internet surfing
To hide the IP address of the client computer for anonymous surfing
To implement internet access control
To scan outbound content
To circumvent regional restrictions
Clearly some of the above reasons are perfectly fitting for a business and some others do not.Regardless, knowing how to install and configure a proxy server is a must-have skill for a network administrator.
What is squid ?
Squid is a free and open-source full featured web proxy cache server released under GPL 3, which can be used in many other ways like a web server caching daemon to speed up websites loading, cache DNS lookups, filter the traffic and many other network protocols, right now, Squid server supports HTTP and FTP protocols, there is a limited support to other protocols like TLS and SSL, it was first released in 1996.
Installing Squid
Lets install squid on CentOS7 and see what does really look like:
The current version of squid server is version 3 , so based on our distribution we might need to mention that or version 3 will be automatically installed.
/etc/squid/squid.conf
The default configuration file for squid is located under /etc/squid3/squid.conf or /etc/squid/squid.conf.
This file contains some configuration directives that needs to be configured to affect the behavior of the Squid.
The file in Ubuntu is so huge cause of its rich documents.Lets take a look at important ones:
port [mode] [options]
This is the default port for the HTTP proxy server, by default it is 3128
cache_mem [bytes]
Defines the amount of memory Squid can use for cache. The default is 256 MB and it is commented out. This does not specify the memory usage of Squid and may be exceeded.
maximum_object_size_in_memory [bytes]
Objects greater than this size will not be attempted to kept in the memory cache. This should be set high enough to keep objects accessed frequently in memory to improve performance whilst low enough to keep larger objects from hoarding cache_mem. And the default size is 512 KB.
cache_dir aufs Directory-Name Mbytes L1 L2 [options]
The entry cache_dir defines the directory where all the objects are stored on disk. The numbers at the end indicate the maximum disk space in MB to use and the number of directories in the first and second level. "ufs" is the old well-known Squid storage format that has always been there. By default disk caching is not turned on and we can enable it by commenting it out.
cache_dir ufs /var/cache/squid/ 100 16 256 : The default is 100 MB occupied disk space in the /var/cache/squid directory and creation of 16 subdirectories inside it, each containing 256 more subdirectories.
maximum_object_size [bytes]
Set the default value for max-size parameter on any cache_dir. The value is specified in bytes, and the default is 4 MB.
And after doing some configurations (as en example here we have turned on disk cache) we need to restart squid service :
And as a next step we need to configure our browser to goes trough proxy server (we use the same computer for our demonstration):
And if you like browsing in terminal with programs like lynx:
Well, for testing purpose we need to show the speed of web surfing in our browser which is not possible here. Do not forget that each web browser has a local cache and try to clear that before reloading a page again and again.
ACLs(Access Control Lists)
ACLs allow us to restrict the access to websites, and / or monitor the access on a per user basis. We can restrict access based on day of week or time of day, or domain, for example.
The access control scheme of the Squid web proxy server consists of two different components:
1-The ACL elements are directive lines that begin with the word “acl” and represent types of data that are performed against any request transaction.
acl aclname acltype argument ...
The lines above for squid.conf represent a basic example of the usage of ACL elements.
The first word, acl, indicates that this is a ACL element directive line.
The second word, localhost or Safe_ports, specify a name for the directive.
The third word, port in this case, is an ACL element type that is used to represent a TCP port. It can be a client IP address or range of addresses. Also it is possible to use hostname, if we have some sort of DNS resolution implemented.
2-The access list rules consist of an allow or deny action followed by a number of ACL elements, and are used to indicate what action or limitation has to be enforced for a given request. There are a number of different access lists:
Lets go back to squid.conf and fine some examples:
The two lines above are access list rules and represent an explicit implementation of the ACL directives mentioned earlier and it denies access to the localhost unsafe ports.
Notes:
An access list rule consists of an allow or deny keyword, followed by a list of ACL element names.
An access list consists of one or more access list rules.
Access list rules are checked in the order they are written. List searching terminates as soon as one of the rules is a match.
If a rule has multiple ACL elements, it uses AND logic. In other words, all ACL elements of the rule must be a match in order for the rule to be a match. This means that it is possible to write a rule that can never be matched. For example, a port number can never be equal to both 80 AND 8000 at the same time.
To summarize the ACL logics can be described as: (note: AND/OR below is just for illustartion, not part of the syntax)
If none of the rules are matched, then the default action is the opposite of the last rule in the list. Its a good idea to be explicit with the default action. The best way is to use the all ACL (Cache All). For example:
So to have a big picture in mind of how squid works, it works like that :
For demonstration Lets create required ACL elements and ACL rules to avoid visiting yahoo web site on Fridays:
Do not forget to define acl rule before cache all:
and finally do not forget to restart thr service:
Squid Authentication
One another option of squid is adding user authentication . For that we need to use auth_param ACL element.
auth_param
The auth_param directive controls almost every aspect of Squid's external user authentication interface. Squid currently supports three authentication schemes: Basic, Digest, and NTLM. Basic authentication support is compiled by default (For the others, you must use the enable-auth option with ./configure.).
The auth_param directive is very complex, what we are presenting here for LPIC2 exam is HTTP Basic authentication helper, and the syntax would be:
auth_param basic program command ...
example:auth_param basic program /opt/squid/ncsa /etc/squid/passwd
So basic says what type of authentication we are going to use, so in browser it just pops up a window.
program defines what program is going to be used for Authentication, and the actual location of that program (the location might be different in different distributions, be careful and check it).
ncsa is a very simple program which uses the same apache htpasswd type format.
some others are:
And the last argument for ncsa is where the user password file is stored.
Start implementing basic user authentication in squid and as first step locate nsa_auth place in our distribution
(In ubuntu use dpkg -L squid | grep ncsa_auth ) :
Next we configure squid.conf file and search for auth_param . There are some documentations and examples :
and the default is none. We add the previously discussed basic http authentication options :
Next we need to create an ACL element and then tell it to use that element in an ACL:
do not forget that based on the order you put your rules the result would be different. So if we put it above other rules, as long as users can authenticate it works fine. part of our squid.conf file:
Now we have to create password file(for that we might need to install apach2-utils (Deb)or httpd-tools (RedHat)) :
and to make sure every thing is working properly with our passwords file:
lets restart the service and see the results:
/var/log/squid/
That is squid log file directory. The logs give us information about Squid workloads and performance. The logs record not only access information, but also system configuration errors and resource consumption (eg, memory, disk space). There are several log file maintained by Squid. Some have to be explicitely activated during compile time, others can safely be deactivated during.
/var/log/squid/access.log : Most log file analysis program are based on the entries in access.log. We can use this file to find out who is using squid server and what they are doing etc
/var/log/squid/cache.log : The cache.log file contains the debug and error messages that Squid generates.
/var/log/squid/store.log : The store.log file covers the objects currently kept on disk or removed ones. As a kind of transaction log it is ususally used for debugging purposes.
To display log files in real time use tail command:
that is all.
Links: http://www.comfsm.fm/computing/squid/FAQ-10.html
http://www.linuxmail.info/squid-acl-elements/
https://wiki.squid-cache.org/SquidFaq/SquidAcl
https://hostpresto.com/community/tutorials/how-to-install-and-configure-squid-proxy-on-centos-7/
Last updated