In Part 1 of this series, we showed how to install squid, a proxy caching server for web clients. Please refer to that post (link given below) before proceeding if you haven’t installed squid on your system yet.In this article, we will show you how to configure the Squid proxy server in order to grant or restrict Internet access, and how to configure an http client, or web browser, to use that proxy server. My Testing Environment Setup Squid Server Operating System:Debian Wheezy 7.5IP Address:192.168.0.15Hostname:dev2.gabrielcanepa.com.arClient Machine 1 Operating System:Ubuntu 12.04IP Address:192.168.0.104Hostname:ubuntuOS.gabrielcanepa.com.arClient Machine 2 Operating System:CentOS-7.0-1406IP Address:192.168.0.17Hostname:dev1.gabrielcanepa.com.arLet us remember that, in simple terms, a web proxy server is an intermediary between one (or more) client computers and a certain network resource, the most common being access to the Internet.
In other words, the proxy server is connected on one side directly to the Internet (or to a router that is connected to the Internet) and on the other side to a network of client computers that will access the World Wide Web through it.You may be wondering, why would I want to add yet another piece of software to my network infrastructure? Here are the top 3 reasons:1. Squid stores files from previous requests to speed up future transfers. For example, suppose client1 downloads CentOS-7.0-1406-x8664-DVD.iso from the Internet. When client2 requests access to the same file, squid can transfer the file from its cache instead of downloading it again from the Internet. As you can guess, you can use this feature to speed up data transfers in a network of computers that require frequent updates of some kind.2.
ACLs ( Access Control Lists) allow us to restrict the access to websites, and / or monitor the access on a per user basis. You can restrict access based on day of week or time of day, or domain, for example.3. Bypassing web filters is made possible through the use of a web proxy to which requests are made and which returns requested content to a client, instead of having the client request it directly to the Internet.For example, suppose you are logged on in client1 and want to access www.facebook.com through your company’s router. Since the site may be blocked by your company’s policies, you can instead connect to a web proxy server and have it request access to www.facebook.com.
Remote content is then returned to you through the web proxy server again, bypassing your company’s router’s blocking policies. Configuring Squid – The BasicsThe access control scheme of the Squid web proxy server consists of two different components:. The ACL elements are directive lines that begin with the word “ acl” and represent types of tests that are performed against any request transaction. The access list rules consist of an allow or deny action followed by a number of ACL elements, and are used to indicate what action or limitation has to be enforced for a given request. They are checked in order, and list searching terminates as soon as one of the rules is a match. If a rule has multiple ACL elements, it is implemented as a boolean AND operation (all ACL elements of the rule must be a match in order for the rule to be a match).Squid’s main configuration file is /etc/squid/squid.conf, which is 5000 lines long since it includes both configuration directives and documentation. For that reason, we will create a new squid.conf file with only the lines that include configuration directives for our convenience, leaving out empty or commented lines.
To do so, we will use the following commands. # mv /etc/squid/squid.conf /etc/squid/squid.conf.bkpAnd then, # grep -Eiv '(^# ^$)' /etc/squid/squid.conf.bkpOR# grep -ve ^# -ve ^$ /etc/squid/squid.conf.bkp /etc/squid/squid.conf.
Backup Squid Configuration FileNow, open the newly created squid.conf file, and look for (or add) the following ACL elements and access lists. How to log out of app store. Acl localhost src 127.0.0.1/32acl localnet src 192.168.0.0/24The two lines above represent a basic example of the usage of ACL elements.
The first word, acl, indicates that this is a ACL element directive line. The second word, localhost or localnet, specify a name for the directive. The third word, src in this case, is an ACL element type that is used to represent a client IP address or range of addresses, respectively. You can specify a single host by IP (or hostname, if you have some sort of DNS resolution implemented) or by network address.
The fourth parameter is a filtering argument that is “ fed” to the directive.The two lines below are access list rules and represent an explicit implementation of the ACL directives mentioned earlier. In few words, they indicate that http access should be granted if the request comes from the local network ( localnet), or from localhost. Specifically what is the allowed local network or local host addresses?
The answer is: those specified in the localhost and localnet directives. Httpaccess allow localnethttpaccess allow localhost.
Squid ACL Allow Access ListAt this point you can restart Squid in order to apply any pending changes. # service squid restart Upstart / sysvinit-based distributions# systemctl restart squid.service systemd-based distributionsand then configure a client browser in the local network ( 192.168.0.104 in our case) to access the Internet through your proxy as follows. Go to the Edit menu and choose the Preferences option.2.
Click on Advanced, then on the Network tab, and finally on Settings3. Check Manual proxy configuration and enter the IP address of the proxy server and the port where it is listening for connections. Configure Proxy in FirefoxNote That by default, Squid listens on port 3128, but you can override this behaviour by editing the access list rule that begins with httpport (by default it reads httpport 3128).4. Click OK to apply the changes and you’re good to go. Verifying that a Client is Accessing the InternetYou can now verify that your local network client is accessing the Internet through your proxy as follows.1.
In your client, open up a terminal and type, # ip address show eth0 grep -Ei '(inet.eth0)'That command will display the current IP address of your client ( 192.168.0.104 in the following image).2. In your client, use a web browser to open any given web site ( www.tecmint.com in this case).3. In the server, run. # tail -f /var/log/squid/access.logand you’ll get a live view of requests being served through Squid.
Check Proxy Browsing Restricting Access By ClientNow suppose you want to explicitly deny access to that particular client IP address, while yet maintaining access for the rest of the local network.1. Define a new ACL directive as follows (I’ve named it ubuntuOS but you can name it whatever you want). Acl ubuntuOS src 192.168.0.1042. Add the ACL directive to the localnet access list that is already in place, but prefacing it with an exclamation sign. This means, “ Allow Internet access to clients matching the localnet ACL directive except to the one that matches the ubuntuOS directive”. Httpaccess allow localnet!ubuntuOS3.
Now we need to restart Squid in order to apply changes. Then if we try to browse to any site we will find that access is denied now. Block Access to DomainsFinally, we must grant access to Squid for requests not matching the directive above. Httpaccess allow localnet!forbiddenOr maybe we will only want to allow access to those sites during a certain time of the day ( 10:00 until 11:00 am) only on Monday (M), Wednesday (W), and Friday (F). Acl someDays time MWF 10:00-11:00httpaccess allow forbidden someDayshttpaccess deny forbiddenOtherwise, access to those domains will be blocked. Restricting access by user authenticationSquid support several authentication mechanisms (Basic, NTLM, Digest, SPNEGO, and Oauth) and helpers (SQL database, LDAP, NIS, NCSA, to name a few).
In this tutorial we will use Basic authentication with NCSA.Add the following lines to your /etc/squid/squid.conf file. Authparam basic program /usr/lib/squid/ncsaauth /etc/squid/passwdauthparam basic credentialsttl 30 minutesauthparam basic casesensitive onauthparam basic realm Squid proxy-caching web server for Tecmint's LFCE seriesacl ncsa proxyauth REQUIREDhttpaccess allow ncsaNote: In CentOS 7, the NCSA plugin for squid can be found in /usr/lib64/squid/basicnscaauth, so change accordingly in above line. Enable NCSA AuthenticationA few clarifications:. We need to tell Squid which authentication helper program to use with the authparam directive by specifying the name of the program (most likely, /usr/lib/squid/ncsaauth or /usr/lib64/squid/basicnscaauth), plus any command line options ( /etc/squid/passwd in this case) if necessary.
The /etc/squid/passwd file is created through htpasswd, a tool to manage basic authentication through files. Enable Squid AuthenticationIf authentication succeeds, access is granted to the requested resource. Otherwise, access will be denied. Using Cache to Sped Up Data TransferOne of Squid’s distinguishing features is the possibility of caching resources requested from the web to disk in order to speed up future requests of those objects either by the same client or others.Add the following directives in your squid.conf file.
Cachedir ufs /var/cache/squid 1000 16 256maximumobjectsize 100 MBrefreshpattern.(mp4 iso) 2880A few clarifications of the above directives. ufs is the Squid storage format.
/var/cache/squid is a top-level directory where cache files will be stored. Verify Squid CachingThat is because the file was served from the Squid cache (indicated by TCPHIT/200) in the second case, as opposed to the first instance, when it was downloaded directly from the Internet (represented by TCPMISS/200).The HIT and MISS keywords, along with the 200 http response code, indicate that the file was served successfully both times, but the cache was HIT and Missed respectively. When a request cannot be served by the cache for some reason, then Squid attempts to serve it from the Internet. Squid HTTP Codes ConclusionIn this article we have discussed how to set up a Squid web caching proxy. You can use the proxy server to filter contents using a chosen criteria, and also to reduce latency (since identical incoming requests are served from the cache, which is closer to the client than the web server that is actually serving the content, resulting in faster data transfers) and network traffic as well (reducing the amount of used bandwidth, which saves you money if you’re paying for traffic).You may want to refer to the for further documentation (make sure to also check the wiki), but do not hesitate to contact us if you have any questions or comments.
We will be more than glad to hear from you!
Jre jack dorsey aftershow. It's that moment.Jack Dorsey: Yeah, it's so instant. That young revolutionaries would use it to help communicate the strategies that fueled the Arab Spring. He created the code for Twitter, with messages that - unlike e-mails - can be read by anyone in the world.Lara Logan: Twitter is so instant. And now I get to see the entire world and how they're thinking and how they're feeling and what they're doing and what they care about and where they're going.When he created Twitter seven years ago, Jack Dorsey had no idea how big it would become - that 200 million people would be sending more than a billion tweets every three days. I'm a nerd.Many believe Jack Dorsey is the intellectual successor to Jobs.
Image: Jack WallenA proxy server is a computer that acts as an intermediary between a desktop computer and the internet and allows a client machine to make an indirect connection to network servers and services. There are many reasons why you might want to include a proxy server on your network:. To share internet connection on a LAN. To speed up internet surfing. To hide the IP address of the client computer for anonymous surfing.
To implement internet access control. To scan outbound content. To circumvent regional restrictionsClearly some of the above reasons are perfectly fitting for a business and some, well, may not fall in line with your best practices. Regardless, knowing how to install and configure a proxy server is a must-have skill for a network administrator. So, let's take care of that.
I will demonstrate installing the on. More about Networking.InstallationThis installation and configuration will be handled completely from the command line, so open up a terminal window and prepare to type.The first thing we want to do (as with software installation on Ubuntu) is to update apt. From your terminal window, issue the command sudo apt-get update. Once that completes, you could also run an upgrade with the command sudo apt-get upgrade.
Of course, should this upgrade the kernel, you'll want to do a reboot, so schedule this accordingly. The installation will pick up the necessary dependencies (libecap3, libltdl7, squid-purge, and squid-langpack) and complete without issue.That is all there is to the installation.
Now we move on to the configuration of a basic proxy server. ConfigurationThe configuration of the Squid Proxy Server is handled in the /etc/squid/squid.conf.
Jasa Setting Squid Proxy In Minecraft
I will show you how to configure a very basic proxy server. The first thing we need to do is uncomment the line (by removing the # character): #httpaccess allow localnetTo find that line, issue the command: sudo grep -n httpaccess /etc/squid/squid.confAs you can see ( Figure A), the configuration option is found on line 1186 (of my installation).
Jasa Setting Squid Proxy Server
Open up the squid.conf file for editing, with the command sudo nano /etc/squid/squid.conf, and scroll down to that line and remove the # character.Figure A. Grepping the necessary configuration option.Next you want to look for the line: #acl localnet srcThere will be a number of them (for different network IP schemes). You will want to uncomment the one that matches your network (say 192.168.0.0/16) and alter it to your needs. Say you run your internal network on the 192.168.1.0/255.255.255.0 network. Your localnet configuration option would look like: acl localnet src 192.168.1.0/255.255.255.0Restart squid with the command: sudo service squid restartThat's it. You now have a basic proxy server up and running on port 3128 and the IP address of the system you just installed Squid on.
Squid Proxy Configuration
So you would then go to your client machines and configure them (either on a per-application or OS basis) to use that newly configured proxy via IP and port. Make it work for youOf course, Squid can do quite a bit more than serve as a basic proxy server. If you need to get deep into the various configuration options for Squid, make sure to take a look at the, where you can find out how to configure options for third-party applications, configure options for the neighbour selection algorithm, configure various network parameters, and much more. In the meantime, you can always take a look at the /var/log/squid/access.log and /var/log/squid/cache.log to see what Squid is doing on your network.