这里以squid4.0.4为例，平台是centos 7：
1. 编译：
wget http://ift.tt/1TYrtyI
tar -xvzf squid-4.0.4-20160205-r14526.tar.gz
cd squid-4.0.4-20160205-r14526
编译之前做好基础准备，安装好openssl 和gcc等，这里就不废话了.
下面是编译的重中之重，直接决定了squid是否能真正支持SSL, 这也是我摸索了好久，今天终于摸索出来突破的成果：
./configure ‘–build=x86_64-redhat-linux-gnu’ ‘–host=x86_64-redhat-linux-gnu’ ‘–program-prefix=’ ‘–prefix=/usr’ ‘–exec-prefix=/usr’ ‘–bindir=/usr/bin’ ‘–sbindir=/usr/sbin’ ‘–sysconfdir=/etc’ ‘–datadir=/usr/share’ ‘–includedir=/usr/include’ ‘–libdir=/usr/lib64’ ‘–libexecdir=/usr/libexec’ ‘–sharedstatedir=/var/lib’ ‘–mandir=/usr/share/man’ ‘–infodir=/usr/share/info’ ‘–disable-strict-error-checking’ ‘–exec_prefix=/usr’ ‘–libexecdir=/usr/lib64/squid’ ‘–localstatedir=/var’ ‘–datadir=/usr/share/squid’ ‘–sysconfdir=/etc/squid’ ‘–with-logdir=$(localstatedir)/log/squid’ ‘–with-pidfile=$(localstatedir)/run/squid.pid’ ‘–disable-dependency-tracking’ ‘–enable-eui’ ‘–enable-follow-x-forwarded-for’ ‘–enable-auth’ ‘–enable-auth-basic=DB,NCSA,NIS,POP3,RADIUS,SMB,getpwnam’ ‘–enable-auth-digest=file’ ‘–enable-auth-negotiate=kerberos’ ‘–enable-cache-digests’ ‘–enable-cachemgr-hostname=localhost’ ‘–enable-delay-pools’ ‘–enable-epoll’ ‘–enable-icap-client’ ‘–enable-ident-lookups’ ‘–enable-linux-netfilter’ ‘–enable-removal-policies=heap,lru’ ‘–enable-snmp’ ‘–enable-ssl’ ‘–enable-ssl-crtd’ ‘–enable-storeio=aufs,diskd,ufs’ ‘–enable-wccpv2’ ‘–enable-esi’ ‘–with-aio’ ‘–with-default-user=squid’ ‘–with-filedescriptors=16384’ ‘–with-dl’ ‘–with-openssl’
预配置完成以后，开始编译
make
等待15-20分钟
完成：
make install && cp basic_ncsa_auth /usr/bin/
这里basic_ncsa_auth是实现用户认证的关键文件，后面再讲，先把squid的https通道跑通再说。
然后运行：
squid -v
Squid Cache: Version 4.0.4-20160205-r14526
Service Name: squid
configure options: ‘–build=x86_64-redhat-linux-gnu’ ‘–host=x86_64-redhat-linux-gnu’ ‘–program-prefix=’ ‘–prefix=/usr’ ‘–exec-prefix=/usr’ ‘–bindir=/usr/bin’ ‘–sbindir=/usr/sbin’ ‘–sysconfdir=/etc’ ‘–datadir=/usr/share’ ‘–includedir=/usr/include’ ‘–libdir=/usr/lib64’ ‘–libexecdir=/usr/libexec’ ‘–sharedstatedir=/var/lib’ ‘–mandir=/usr/share/man’ ‘–infodir=/usr/share/info’ ‘–disable-strict-error-checking’ ‘–exec_prefix=/usr’ ‘–libexecdir=/usr/lib64/squid’ ‘–localstatedir=/var’ ‘–datadir=/usr/share/squid’ ‘–sysconfdir=/etc/squid’ ‘–with-logdir=$(localstatedir)/log/squid’ ‘–with-pidfile=$(localstatedir)/run/squid.pid’ ‘–disable-dependency-tracking’ ‘–enable-eui’ ‘–enable-follow-x-forwarded-for’ ‘–enable-auth’ ‘–enable-auth-basic=DB,NCSA,NIS,POP3,RADIUS,SMB,getpwnam’ ‘–enable-auth-digest=file’ ‘–enable-auth-negotiate=kerberos’ ‘–enable-cache-digests’ ‘–enable-cachemgr-hostname=localhost’ ‘–enable-delay-pools’ ‘–enable-epoll’ ‘–enable-icap-client’ ‘–enable-ident-lookups’ ‘–enable-linux-netfilter’ ‘–enable-removal-policies=heap,lru’ ‘–enable-snmp’ ‘–enable-ssl’ ‘–enable-ssl-crtd’ ‘–enable-storeio=aufs,diskd,ufs’ ‘–enable-wccpv2’ ‘–enable-esi’ ‘–with-aio’ ‘–with-default-user=squid’ ‘–with-filedescriptors=16384’ ‘–with-dl’ ‘–with-openssl’ ‘build_alias=x86_64-redhat-linux-gnu’ ‘host_alias=x86_64-redhat-linux-gnu’
你会发现squid确实是4.0.4了。
2. 制作证书：
cd /etc/squid/
openssl req -new -x509 -days 7777 -nodes -out vps.pem -keyout vps.pem
openssl gendh 2048 >> vps.pem
openssl x509 -subject -dates -fingerprint -in vps.pem
3. 配置 squid.conf
vi /etc/squid/squid.conf
主要做以下修改（暂时不开启用户认证）：
#http_access deny all
http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem
然后ESC :wq 存盘。
启动squid
[root@vultr ~]# squid
查看后台进程：
[root@vultr ~]# ps -ef |grep squid
root 21537 1 0 12:02 ? 00:00:00 squid
squid 21539 21537 0 12:02 ? 00:00:01 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 22642 22621 0 12:40 pts/3 00:00:00 grep –color=auto squid
到此为止：服务端基本配置完毕。
4. 客户端配置：
客户端配置远远没有你们想象中那么简单，因为自签发的证书是通过不了chrome的CA认证的！
所以，简单的建立一个https： vpsip:443的代理，chrome是无法识别，拒绝连接的！
怎么办？ 所以这里需要引入stunnel， 通过stunnel跟VPS的SSL证书握手，因为stunnel不检查CA证书，所以没有这个问题，然后把外部的https连接转换为普通的本地http代理，这样chrome就不会检查证书了，因为普通的http连接是不需要检查证书的。 下面是详细的步骤：
a. 通过winscp把上面的vps.pem证书传回本地：
b. 下载安装stunnle (http://ift.tt/11IsvBm)
安装以后，主要不要签发生成stunnel自带的证书：
然后把vps.pem放入stunnel的config目录，然后编辑stunnel.conf文件：
把里面的内容统统删光，把下面的内容粘贴进去：
[https]
client = yes
accept = 800
connect = VPS IP:443
cert = .\vps.pem
把你的VPS IP粘贴进去，800是本地代理监听端口，可以随便改。
启动stunnel
然后chrome通过swithyomega,新建一个http: 127.0.0.1:800的代理.
切换到此代理，OK! 搞定！现在已经可以用了！ 至此squid的https通道已经完全搭建好了！
5. 实现squid用户认证：
因为你可能不希望什么人都可以随意的连接到你的VPS，需要更严格更安全的认证，这时候需要引入squid用户认证。
前面的编译的时候已经做了铺垫，编译生成了用户认证的关键文件： basic_ncsa_auth
下面还需要生成一个密码文件：
yum install httpd
htpasswd /etc/squid/passwd user1
user1就是用户名
然后输入密码
New password:
Re-type new password:
记住此密码，密码文件存放在/etc/squid/passwd最后配置squid.conf文件
vi /etc/squid/squid.conf
主要做以下修改：
# And finally deny all other access to this proxy
auth_param basic program /usr/bin/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic credentialsttl 2 hours
auth_param basic realm Example.com’s Squid proxy-caching
acl auth_users proxy_auth REQUIRED
http_access allow auth_users
#http_access deny all
#http_access allow all
# Squid normally listens to port 3128
#http_port 127.0.0.1:3128
https_port 443 cert=/etc/squid/vps.pem key=/etc/squid/vps.pem
完成以后
运行： ps -ef | grep squid
终止掉squid的进程
ps -ef |grep squid
root 21537 1 0 12:02 ? 00:00:00 squid
squid 21539 21537 0 12:02 ? 00:00:01 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 22642 22621 0 12:40 pts/3 00:00:00 grep –color=auto squid
这里运行两次kill 21539
然后重启squid
[root@vultr ~]# squid
看看后台进程：
ps -ef |grep squid
root 21537 1 0 12:02 ? 00:00:00 squid
squid 21539 21537 0 12:02 ? 00:00:02 (squid-1)
squid 21540 21539 0 12:02 ? 00:00:00 (logfile-daemon) /var/log/squid/access.log
squid 21555 21539 0 12:03 ? 00:00:00 (basic_ncsa_auth) /etc/squid/passwd
root 23148 23132 0 13:00 pts/0 00:00:00 grep –color=auto squid
这里已经多了basic_ncsa_auth的用户认证进程，说明squidd的用户认证功能已经成功实现！
至此教程全部完成！ 这里面最难的其实还是自编译squid SSL支持的实现，
来源： 翻墙论坛 Gary12
via 细节的力量 http://ift.tt/1RzmjZl
No comments:
Post a Comment