Saturday, February 13, 2016

关于在VPS部署squid https通道的终极教程(已经彻底解决SSL编译的问题)

这里以squid4.0.4为例,平台是centos 7:
1. 编译:
wget http://ift.tt/1TYrtyI
tar -xvzf squid-4.0.4-20160205-r14526.tar.gz
cd squid-4.0.4-20160205-r14526
编译之前做好基础准备,安装好openssl 和gcc等,这里就不废话了.
下面是编译的重中之重,直接决定了squid是否能真正支持SSL, 这也是我摸索了好久,今天终于摸索出来突破的成果:
./configure  ‘–build=x86_64-redhat-linux-gnu’ ‘–host=x86_64-redhat-linux-gnu’ ‘–program-prefix=’ ‘–prefix=/usr’ ‘–exec-prefix=/usr’ ‘–bindir=/usr/bin’ ‘–sbindir=/usr/sbin’ ‘–sysconfdir=/etc’ ‘–datadir=/usr/share’ ‘–includedir=/usr/include’ ‘–libdir=/usr/lib64’ ‘–libexecdir=/usr/libexec’ ‘–sharedstatedir=/var/lib’ ‘–mandir=/usr/share/man’ ‘–infodir=/usr/share/info’ ‘–disable-strict-error-checking’ ‘–exec_prefix=/usr’ ‘–libexecdir=/usr/lib64/squid’ ‘–localstatedir=/var’ ‘–datadir=/usr/share/squid’ ‘–sysconfdir=/etc/squid’ ‘–with-logdir=$(localstatedir)/log/squid’ ‘–with-pidfile=$(localstatedir)/run/squid.pid’ ‘–disable-dependency-tracking’ ‘–enable-eui’ ‘–enable-follow-x-forwarded-for’ ‘–enable-auth’ ‘–enable-auth-basic=DB,NCSA,NIS,POP3,RADIUS,SMB,getpwnam’  ‘–enable-auth-digest=file’ ‘–enable-auth-negotiate=kerberos’  ‘–enable-cache-digests’ ‘–enable-cachemgr-hostname=localhost’ ‘–enable-delay-pools’ ‘–enable-epoll’ ‘–enable-icap-client’ ‘–enable-ident-lookups’ ‘–enable-linux-netfilter’ ‘–enable-removal-policies=heap,lru’ ‘–enable-snmp’ ‘–enable-ssl’ ‘–enable-ssl-crtd’ ‘–enable-storeio=aufs,diskd,ufs’ ‘–enable-wccpv2’ ‘–enable-esi’   ‘–with-aio’ ‘–with-default-user=squid’ ‘–with-filedescriptors=16384’ ‘–with-dl’ ‘–with-openssl’
预配置完成以后,开始编译
make
等待15-20分钟
完成:
make install && cp basic_ncsa_auth /usr/bin/
这里basic_ncsa_auth是实现用户认证的关键文件,后面再讲,先把squid的https通道跑通再说。
然后运行:
squid -v
Squid Cache: Version 4.0.4-20160205-r14526
Service Name: squid
configure options:  ‘–build=x86_64-redhat-linux-gnu’ ‘–host=x86_64-redhat-linux-gnu’ ‘–program-prefix=’ ‘–prefix=/usr’ ‘–exec-prefix=/usr’ ‘–bindir=/usr/bin’ ‘–sbindir=/usr/sbin’ ‘–sysconfdir=/etc’ ‘–datadir=/usr/share’ ‘–includedir=/usr/include’ ‘–libdir=/usr/lib64’ ‘–libexecdir=/usr/libexec’ ‘–sharedstatedir=/var/lib’ ‘–mandir=/usr/share/man’ ‘–infodir=/usr/share/info’ ‘–disable-strict-error-checking’ ‘–exec_prefix=/usr’ ‘–libexecdir=/usr/lib64/squid’ ‘–localstatedir=/var’ ‘–datadir=/usr/share/squid’ ‘–sysconfdir=/etc/squid’ ‘–with-logdir=$(localstatedir)/log/squid’ ‘–with-pidfile=$(localstatedir)/run/squid.pid’ ‘–disable-dependency-tracking’ ‘–enable-eui’ ‘–enable-follow-x-forwarded-for’ ‘–enable-auth’ ‘–enable-auth-basic=DB,NCSA,NIS,POP3,RADIUS,SMB,getpwnam’ ‘–enable-auth-digest=file’ ‘–enable-auth-negotiate=kerberos’ ‘–enable-cache-digests’ ‘–enable-cachemgr-hostname=localhost’ ‘–enable-delay-pools’ ‘–enable-epoll’ ‘–enable-icap-client’ ‘–enable-ident-lookups’ ‘–enable-linux-netfilter’ ‘–enable-removal-policies=heap,lru’ ‘–enable-snmp’ ‘–enable-ssl’ ‘–enable-ssl-crtd’ ‘–enable-storeio=aufs,diskd,ufs’ ‘–enable-wccpv2’ ‘–enable-esi’ ‘–with-aio’ ‘–with-default-user=squid’ ‘–with-filedescriptors=16384’ ‘–with-dl’ ‘–with-openssl’ ‘build_alias=x86_64-redhat-linux-gnu’ ‘host_alias=x86_64-redhat-linux-gnu’
你会发现squid确实是4.0.4了。
2. 制作证书:
cd /etc/squid/

openssl req -new -x509 -days 7777 -nodes -out vps.pem -keyout vps.pem
openssl gendh 2048 >> vps.pem
openssl x509 -subject -dates -fingerprint -in vps.pem

3. 配置 squid.conf

vi /etc/squid/squid.conf

主要做以下修改(暂时不开启用户认证):

#http_access deny all
http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem 

然后ESC :wq 存盘。

启动squid

[root@vultr ~]# squid 

查看后台进程:

[root@vultr ~]# ps -ef |grep squid
root     21537     1  0 12:02 ?        00:00:00 squid
squid    21539 21537  0 12:02 ?        00:00:01 (squid-1)
squid    21540 21539  0 12:02 ?        00:00:00 (logfile-daemon) /var/log/squid/access.log
squid    21555 21539  0 12:03 ?        00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root     22642 22621  0 12:40 pts/3    00:00:00 grep –color=auto squid

到此为止:服务端基本配置完毕。

4. 客户端配置:

客户端配置远远没有你们想象中那么简单,因为自签发的证书是通过不了chrome的CA认证的!

所以,简单的建立一个https: vpsip:443的代理,chrome是无法识别,拒绝连接的!

怎么办? 所以这里需要引入stunnel, 通过stunnel跟VPS的SSL证书握手,因为stunnel不检查CA证书,所以没有这个问题,然后把外部的https连接转换为普通的本地http代理,这样chrome就不会检查证书了,因为普通的http连接是不需要检查证书的。 下面是详细的步骤:

a. 通过winscp把上面的vps.pem证书传回本地:

b. 下载安装stunnle (http://ift.tt/11IsvBm)

安装以后,主要不要签发生成stunnel自带的证书:

然后把vps.pem放入stunnel的config目录,然后编辑stunnel.conf文件:

把里面的内容统统删光,把下面的内容粘贴进去:

[https]
client = yes
accept  = 800
connect = VPS IP:443
cert = .\vps.pem

把你的VPS IP粘贴进去,800是本地代理监听端口,可以随便改。

启动stunnel 

然后chrome通过swithyomega,新建一个http: 127.0.0.1:800的代理.

切换到此代理,OK! 搞定!现在已经可以用了! 至此squid的https通道已经完全搭建好了!

5. 实现squid用户认证:

因为你可能不希望什么人都可以随意的连接到你的VPS,需要更严格更安全的认证,这时候需要引入squid用户认证。

前面的编译的时候已经做了铺垫,编译生成了用户认证的关键文件: basic_ncsa_auth

下面还需要生成一个密码文件:

yum install httpd

htpasswd  /etc/squid/passwd user1
user1就是用户名
然后输入密码
New password:
Re-type new password:
记住此密码,密码文件存放在/etc/squid/passwd最后配置squid.conf文件

vi /etc/squid/squid.conf

主要做以下修改:

# And finally deny all other access to this proxy

auth_param basic program /usr/bin/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic credentialsttl 2 hours
auth_param basic realm Example.com’s Squid proxy-caching
acl auth_users proxy_auth REQUIRED
http_access allow auth_users

#http_access deny all
#http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem 

完成以后

运行: ps -ef | grep squid

终止掉squid的进程

ps -ef |grep squid

root     21537     1  0 12:02 ?        00:00:00 squid
squid    21539 21537  0 12:02 ?        00:00:01 (squid-1)
squid    21540 21539  0 12:02 ?        00:00:00 (logfile-daemon) /var/log/squid/access.log
squid    21555 21539  0 12:03 ?        00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root     22642 22621  0 12:40 pts/3    00:00:00 grep –color=auto squid

这里运行两次kill 21539

然后重启squid

[root@vultr ~]# squid

看看后台进程:

ps -ef |grep squid

root     21537     1  0 12:02 ?        00:00:00 squid
squid    21539 21537  0 12:02 ?        00:00:02 (squid-1)
squid    21540 21539  0 12:02 ?        00:00:00 (logfile-daemon) /var/log/squid/access.log
squid    21555 21539  0 12:03 ?        00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root     23148 23132  0 13:00 pts/0    00:00:00 grep –color=auto squid

这里已经多了basic_ncsa_auth的用户认证进程,说明squidd的用户认证功能已经成功实现!

至此教程全部完成! 这里面最难的其实还是自编译squid SSL支持的实现

来源:  翻墙论坛 Gary12

原文:http://ift.tt/1XpnY4a




via 细节的力量 http://ift.tt/1RzmjZl

No comments:

Post a Comment