Na-ahazi sava Squid Proxy site na ịnweta mmachi yana ịtọlite ndị ahịa ka ha jiri proxy - Akụkụ 5

A Linux Foundation Certified Engineerbụ ọkachamara nwere nkà nke nwere ikike ịwụnye, jikwaa na idozi ọrụ netwọk na sistemụ Linux, ma na-ahụ maka nhazi, mmejuputa na mmezi na-aga n'ihu nke usoro- sara mbara ije.

Ewebata Mmemme Asambodo Foundation Linux.

Na akụkụ 1 nke usoro isiokwu a, anyị gosiri otu esi etinye squid, ihe nkesa caching proxy maka ndị ahịa webụ. Biko rụtụ aka na post ahụ (njikọ enyere n'okpuru) tupu ịga n'ihu ma ọ bụrụ na itinyebeghị squid na sistemụ gị.

  1. Nkebi nke 1 – Wụnye ọrụ netwọkụ yana ịhazi mmalite akpaaka na Boot

N'ime edemede a, anyị ga-egosi gị otu esi ahazi sava proxy Squid iji nye ma ọ bụ gbochie ohere ịntanetị, yana otu esi ahazi onye ahịa http, ma ọ bụ ihe nchọgharị weebụ, iji jiri ihe nkesa proxy ahụ.

Operating System :	Debian Wheezy 7.5
IP Address 	 :	192.168.0.15
Hostname	 :	dev2.gabrielcanepa.com.ar

Operating System :	Ubuntu 12.04
IP Address 	 :	192.168.0.104 
Hostname	 :	ubuntuOS.gabrielcanepa.com.ar

Operating System :	CentOS-7.0-1406
IP Address 	 :	192.168.0.17 
Hostname	 :	dev1.gabrielcanepa.com.ar

Ka anyị cheta na, n'okwu dị mfe, ihe nkesa proxy webụ bụ onye na-emekọrịta ihe n'etiti otu (ma ọ bụ karịa) kọmputa ndị ahịa na ụfọdụ akụrụngwa netwọk, nke a na-ahụkarị bụ ịnweta ịntanetị. N'ikwu ya n'ụzọ ọzọ, a na-ejikọta ihe nkesa proxy n'otu akụkụ ozugbo na Ịntanetị (ma ọ bụ na rawụta ejikọrọ na Ịntanetị) na n'akụkụ nke ọzọ na netwọk nke kọmputa ndị ahịa nke ga-esi na ya nweta Web Wide Web.

Ị nwere ike ịnọ na-eche, gịnị kpatara m ga-achọ ịgbakwunye ngwa ọzọ na akụrụngwa netwọk m?

1. Squid na-echekwa faịlụ sitere na arịrịọ ndị gara aga iji mee ka mbufe n'ọdịnihu dị ngwa. Dịka ọmụmaatụ, were were budata client1 na ịntanetị CentOS-7.0-1406-x86_64-DVD.iso. Mgbe client2 rịọrọ ka ịnweta otu faịlụ ahụ, squid nwere ike ibufe faịlụ ahụ na cache ya kama ibudata ya ọzọ na ịntanetị. Dị ka ị nwere ike ịkọ, ị nwere ike iji njirimara a iji mee ka ịnyefe data dị ngwa na netwọk kọmputa nke na-achọ mmelite ugboro ugboro n'ụdị ụfọdụ.

2. ACLs (Nchịkwa Nweta Nweta) na-enye anyị ohere igbochi ohere ịnweta weebụsaịtị, yana/ma ọ bụ nyochaa ohere na otu onye ọrụ. Ị nwere ike igbochi ohere dabere na ụbọchị izu ma ọ bụ oge ụbọchị, ma ọ bụ ngalaba, dịka ọmụmaatụ.

3. Na-agafe ihe nzacha webụ na-eme ka o kwe omume site na iji proxy webụ nke a na-arịọ arịrịọ na nke na-eweghachite ọdịnaya achọrọ n'aka onye ahịa, kama ime ka onye ahịa rịọ ya ozugbo na ịntanetị.

Dịka ọmụmaatụ, were ya na ị banyere na client1 wee chọọ ịnweta www.facebook.com site na rawụta ụlọ ọrụ gị. Ebe ọ bụ na atumatu ụlọ ọrụ gị nwere ike igbochi saịtị ahụ, ị nwere ike jikọọ na sava proxy webụ wee rịọ maka ịnweta www.facebook.com. A na-eweghachite gị ọdịnaya dịpụrụ adịpụ site na sava proxy webụ ọzọ, na-agafe iwu mgbochi rawụta ụlọ ọrụ gị.

Ịhazi squid - Ihe ndabere

Atụmatụ njikwa nnweta nke sava proxy webụ Squid nwere ihe abụọ dị iche iche:

  1. Ihe ACL bụ ahịrị ntuziaka na-amalite na okwu “acl” ma na-anọchi anya ụdị ule a na-eme megide azụmahịa ọ bụla.
  2. iwu ndepụta nnweta nwere ekwe ma ọ bụ na-ajụ omume nke ọtụtụ ihe ACL na-esochi ya, a na-ejikwa ya gosi ihe omume. ma ọ bụ mmachi ga-mmanye maka arịrịọ enyere. A na-enyocha ha n'usoro, na ndepụta ọchụchọ ga-akwụsị ozugbo otu n'ime iwu bụ egwuregwu. Ọ bụrụ na iwu nwere ọtụtụ ihe ACL, a na-emejuputa ya dị ka boolean NA ọrụ (ihe niile ACL nke iwu ga-abụrịrị egwuregwu ka iwu wee bụrụ egwuregwu).

Faịlụ nhazi isi nke Squid bụ /etc/squid/squid.conf, nke bụ ahịrị ~5000 kemgbe ọ gụnyere ma ntuziaka nhazi yana akwụkwọ. Maka nke ahụ, anyị ga-emepụta faịlụ squid.conf ọhụrụ nwere naanị ahịrị ndị gụnyere ntuziaka nhazi maka ịdị mma anyị, na-ahapụ ahịrị efu ma ọ bụ nkọwapụta. Iji mee nke a, anyị ga-eji iwu ndị a.

# mv /etc/squid/squid.conf /etc/squid/squid.conf.bkp

Ọzọkwa,

# grep -Eiv '(^#|^$)' /etc/squid/squid.conf.bkp

OR

# grep -ve ^# -ve ^$ /etc/squid/squid.conf.bkp > /etc/squid/squid.conf

Ugbu a, mepee faịlụ squid.conf emepụtara ọhụrụ, wee chọọ (ma ọ bụ tinye) ihe ACL na ndepụta nnweta.

acl localhost src 127.0.0.1/32
acl localnet src 192.168.0.0/24

Ahịrị abụọ dị n'elu na-anọchi anya ihe atụ bụ isi nke ojiji nke ihe ACL.

  1. Okwu mbụ, acl, na-egosi na nke a bụ ahịrị ntụzịaka nke ACL.
  2. Okwu nke abụọ, localhost ma ọ bụ localnet, dee aha maka ntuziaka ahụ.
  3. Okwu nke atọ, src na nke a, bụ ụdị mmewere ACL nke a na-eji nọchite anya adreesị IP onye ahịa ma ọ bụ ọtụtụ adreesị, n'otu n'otu. Ị nwere ike ịkọwa otu onye ọbịa site na IP (ma ọ bụ aha nnabata, ma ọ bụrụ na ị nwere ụdị mkpebi DNS etinyere) ma ọ bụ site na adreesị netwọk.
  4. Mkpụrụkpụ nke anọ bụ arụmụka nzacha nke bụ \nri na ntuziaka.

Ahịrị abụọ dị n'okpuru bụ iwu ndesịta nnweta ma na-anọchi anya mmejuputa nke ọma nke iwu ACL ndị a kpọtụrụ aha na mbụ. N'okwu ole na ole, ha na-egosi na a ga-anabata http access ma ọ bụrụ na arịrịọ a sitere na netwọk mpaghara (localnet), ma ọ bụ site na localhost. Kpọmkwem kedu ihe netwọk mpaghara ma ọ bụ adreesị ndị ọbịa mpaghara anabatara? Azịza ya bụ: ndị akọwapụtara na ntuziaka localhost na localnet.

http_access allow localnet
http_access allow localhost

N'ebe a ị nwere ike ịmalitegharị Squid ka itinye mgbanwe ọ bụla na-echere.

# service squid restart 		[Upstart / sysvinit-based distributions]
# systemctl restart squid.service 	[systemd-based distributions]

wee hazie ihe nchọgharị onye ahịa na netwọkụ mpaghara (192.168.0.104na anyị) iji nweta ịntanetị site na proxy gị dị ka ndị a.

1. Gaa na menu Dezie wee họrọ Mmasị nhọrọ.

2. Pịa na Advanced, wee na taabụ Network, na n'ikpeazụ na Ntọala…

3. Lelee Nhazi proxy akwụkwọ ntuziaka wee tinye adreesị IP nke sava proxy yana ọdụ ụgbọ mmiri ebe ọ na-ege njikọ.

Rịba ama na site na ndabara, Squid na-ege ntị na ọdụ ụgbọ mmiri 3128, mana ị nwere ike ịkagbu omume a site na idezi iwu nweta ndepụta nke na-amalite na http_port (site na ndabara ọ na-agụ http_port 3128).

4. Pịa OK ka itinye mgbanwe na ị dị mma ịga.

Ị nwere ike ịchọpụta ugbu a na onye ahịa netwọkụ mpaghara gị na-enweta ịntanetị site na proxy gị dị ka ndị a.

1. N'ime onye ahịa gị, mepee terminal wee pịnye,

# ip address show eth0 | grep -Ei '(inet.*eth0)'

Iwu ahụ ga-egosipụta adreesị IP nke onye ahịa gị ugbu a (192.168.0.104 na foto a).

2. N'ime onye ahịa gị, jiri ihe nchọgharị weebụ mepee ebe nrụọrụ weebụ ọ bụla enyere (linux-console.net na nke a).

3. Na ihe nkesa, na-agba ọsọ.

# tail -f /var/log/squid/access.log

ma ị ga-ahụta arịrịọ a na-enye site na Squid.

Na-amachibido ịnweta site n'aka ndị ahịa

Ugbu a, were ya na ịchọrọ ịgọnarị ohere ịnweta adreesị IP onye ahịa ahụ, ka ị na-ejigide ohere maka netwọkụ mpaghara ndị ọzọ.

1. Kọwaa iwu ọhụrụ ACL dị ka ndị a (akpọrọ m ya ubuntuOS mana ị nwere ike ịkpọ ya ihe ọ bụla ịchọrọ).

acl ubuntuOS src 192.168.0.104

2. Tinye iwu ACL na ndepụta Localnet access nke dịlarị ebe, mana jiri akara mkpu wee bute ya. Nke a pụtara, \Kwe ka ndị ahịa nweta ohere ịntanetị dabara na ntuziaka ACL localnet ma ewezuga nke dabara na ntuziaka ubuntuOS.

http_access allow localnet !ubuntuOS

3. Ugbu a, anyị kwesịrị ịmalitegharịa Squid iji tinye mgbanwe. Mgbe ahụ ọ bụrụ na anyị nwaa ịchọgharị na saịtị ọ bụla, anyị ga-achọpụta na a jụghị ohere ugbu a.

Ịhazi squid - Ntụgharị dị mma

Iji gbochie ịnweta Squid site na ngalaba anyị ga-eji okwu dstdomain na ntụziaka ACL, dị ka ndị a.

acl forbidden dstdomain "/etc/squid/forbidden_domains"

Ebe forbidden_domains bụ faịlụ ederede dị larịị nke nwere ngalaba ndị anyị chọrọ ịgọnarị ịnweta.

N'ikpeazụ, anyị ga-enyerịrị ohere ịnweta Squid maka arịrịọ na-adabaghị na ntuziaka dị n'elu.

http_access allow localnet !forbidden

Ma ọ bụ ikekwe anyị ga-achọ ikwe ka ịnweta saịtị ndị ahụ n'oge ụfọdụ n'ụbọchị (10:00 ruo elekere 11:00 nke ụtụtụ) naanị na Monday (M), Ụbọchị Wenezdee (W) na Friday (F).

acl someDays time MWF 10:00-11:00
http_access allow forbidden someDays
http_access deny forbidden

Ma ọ bụghị ya, a ga-egbochi ịbanye na ngalaba ndị ahụ.

Squid na-akwado ọtụtụ usoro nyocha (Basic, NTLM, Digest, SPNEGO, na Oauth) na ndị enyemaka (SQL nchekwa data, LDAP, NIS, NCSA, ịkpọ aha ole na ole). N'ime nkuzi a anyị ga-eji nzere Basic na NCSA.

Tinye ahịrị ndị a na faịlụ /etc/squid/squid.conf gị.

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/passwd
auth_param basic credentialsttl 30 minutes
auth_param basic casesensitive on
auth_param basic realm Squid proxy-caching web server for Tecmint's LFCE series
acl ncsa proxy_auth REQUIRED
http_access allow ncsa

Mara: Na CentOS 7, NCSA ngwa mgbakwunye maka squid nwere ike ịhụ na /usr/lib64/squid/basic_nsca_auth, yabụ gbanwee ya na ahịrị dị n'elu.

Nkọwa ole na ole:

  1. Anyị kwesịrị ịgwa Squid nke mmemme inyeaka nyocha ọ ga-eji na ntuziaka auth_param site na ịkọwa aha mmemme ahụ (yikarịrị, /usr/lib/squid/ncsa_auth > ma ọ bụ /usr/lib64/squid/basic_nsca_auth), gbakwunyere nhọrọ ahịrị iwu ọ bụla (/etc/squid/passwd na nke a) ma ọ dị mkpa.
  2. A na-emepụta faịlụ /etc/squid/passwd site na htpasswd, ngwa ọrụ iji jikwaa nyocha bụ isi site na faịlụ. Ọ ga-enye anyị ohere itinye ndepụta aha njirimara (na okwuntughe ha kwekọrọ) nke a ga-ahapụ iji Squid.
  3. credentialsttl nkeji iri atọ ga-achọ itinye aha njirimara na paswọọdụ gị kwa nkeji iri atọ (ị nwekwara ike ịkọwa oge oge a yana elekere).
  4. casesensitive on na-egosi na aha njirimara na okwuntughe nwere mmetụta ikpe.
  5. realm na-anọchi anya ederede nke mkparịta ụka nyocha nke a ga-eji chọpụta na squid.
  6. N'ikpeazụ, a na-enye ohere naanị mgbe nyocha proxy (proxy_auth RỊRỊRỊD) ga-aga nke ọma.

Gbaa iwu a ka imepụta faịlụ na ịgbakwunye nzere maka onye ọrụ gacanepa (wepụ ọkọlọtọ -c ma ọ bụrụ na faịlụ ahụ adịlarị).

# htpasswd -c /etc/squid/passwd gacanepa

Mepee ihe nchọgharị weebụ na igwe ndị ahịa wee gbalịa ịchọgharị na saịtị ọ bụla enyere.

Ọ bụrụ na nyocha ga-aga nke ọma, a na-enye ohere ịnweta akụrụngwa achọrọ. Ma ọ bụghị ya, a ga-ajụ ohere.

Iji cache mee ka nnyefe data dị elu

Otu njiri mara Squid bụ ohere nke ịchekwa akụrụngwa achọrọ site na webụ gaa na diski iji mee ka arịrịọ ihe ndị ahụ dị ngwa ngwa site n'aka otu onye ahịa ma ọ bụ ndị ọzọ.

Tinye ntuziaka ndị a na faịlụ squid.conf gị.

cache_dir ufs /var/cache/squid 1000 16 256
maximum_object_size 100 MB
refresh_pattern .*\.(mp4|iso) 2880

Nkowa ole na ole nke ntuziaka dị n'elu.

  1. ufs bụ usoro nchekwa Squid.
  2. /var/cache/squid bụ akwụkwọ ndekọ aha kacha elu ebe a ga-echekwa faịlụ cache. Akwụkwọ ndekọ aha a ga-adịrịrị ma Squid ga-ede ya (Squid agaghị ekepụta gị akwụkwọ ndekọ aha a).
  3. 1000 bụ ego (na MB) iji n'okpuru akwụkwọ ndekọ aha a.
  4. 16 bụ ọnụọgụ subdirectories ọkwa nke mbụ, ebe 256 bụ ọnụọgụ nke subdirectories nke ọkwa abụọ n'ime /var/spool/squid
  5. Ntuziaka maximum_object_size na-akọwapụta oke ihe ekwenyere na cache.
  6. refresh_pattern na-agwa Squid otu esi eme ụdị faịlụ akọwapụtara (.mp4 na .iso na nke a) yana ogologo oge ọ kwesịrị. chekwaa ihe a choro na cache (nkeji 2880 = ụbọchị 2).

Nke mbụ na nke abụọ 2880 bụ oke ala na nke elu, n'otu n'otu, n'otu n'otu, ogologo oge ihe ndị na-enweghị oge njedebe ka a ga-ewere na nso nso a, ya mere cache ga-eje ozi, ebe 0% bụ pasentị nke afọ ihe (oge kemgbe mgbanwe ikpeazụ) nke ihe ọ bụla na-enweghị oge ngwụcha ka a ga-ewere na nso nso a.

Onye ahịa mbụ (IP 192.168.0.104) budata faịlụ 71 MB .mp4 n'ime nkeji 2 na nkeji iri ise na abụọ.

Onye ahịa nke abụọ (IP 192.168.0.17) na-ebudata otu faịlụ ahụ na sekọnd 1.4!

Nke ahụ bụ n'ihi na faịlụ ahụ sitere na squid cache (nke TCP_HIT/200 gosipụtara) na nke abụọ, n'adịghị ka nke mbụ, mgbe e si na ya budata ya ozugbo. ịntanetị (nke TCP_MISS/200 nọchiri anya ya).

Isi okwu HIT na MISS, yana koodu nzaghachi 200 http, na-egosi na e zigara faịlụ ahụ nke ọma ugboro abụọ, mana cache bụ HIT. na Agbaghara n'otu n'otu. Mgbe cache enweghị ike ịnye arịrịọ maka ihe ụfọdụ, mgbe ahụ Squid na-anwa ijere ya ozi site na ịntanetị.

Mmechi

N'ime edemede a, anyị atụlewo otu esi edozi Squid web caching proxy. Ị nwere ike iji ihe nkesa proxy iji nyochaa ọdịnaya site na iji njirisi ahọpụtara, yana iji belata nkwụsị (ebe ọ bụ na a na-enye arịrịọ ndị na-abata n'otu ebe site na cache, nke dị nso na onye ahịa karịa sava weebụ nke na-ejere ọdịnaya ahụ n'ezie, na-ebute ngwa ngwa. nyefe data) na okporo ụzọ netwọk (ịbelata ọnụọgụ bandwidth ejiri mee ihe, nke na-azọpụta gị ego ma ọ bụrụ na ị na-akwụ ụgwọ maka okporo ụzọ).

Ị nwere ike ịtu aka na webụsaịtị Squid maka akwụkwọ ndị ọzọ (jide n'aka na ịlele wiki ahụ), mana egbula oge ịkpọtụrụ anyị ma ọ bụrụ na ị nwere ajụjụ ọ bụla ma ọ bụ kwuo. Anyị ga-enwe obi ụtọ karịa ịnụ gị!