编译安装Squid2.6

1,设置“文件描述符”,并设置用户同时打开文件数量

# vi /usr/include/bits/typesizes.h

# vi /usr/include/linux/posix_types.h

把里边的 #define __FD_SETSIZE 1024 改成 65536

2,设置当前环境

# ulimit -Hs 65536

# ulimit -n 65536

H参数是硬性限制,s是堆栈上限,n是文件描述符上限。

3,优化cpu

以下参数可以在 http://gentoo-wiki.com/Safe_Cflags 查到自己的cpu参数

# export CHOST="i686-pc-linux-gnu"

# export CFLAGS="-march=pentium4 -O2 -pipe -fomit-frame-pointer"

# export CXXFLAGS="${CFLAGS}"

 

1:下载

Wget http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.4.tar.gz

Tar zxvf squid-3.1.4.tar.gz

Cd squid-3.1.4

2:编译squid

./configure --prefix=/usr/local/squid --localstatedir=/var/log/squid1 --enable-gnuregex --enable-icmp --enable-kill-parent-hack --enable-snmp --disable-ident-lookups --enable-cahce-digests --enable-arp-acl --enable-default-err-languages="Simplify_Chinese" --enable-linux-netfilter --enable-auth-modules --enable-follow-x-forwarded-for --enable-storeio=aufs,ufs --with-maxfd=65536 --with-pthreads --enable-dlmalloc --enable-poll --enable-underscore --enable-stacktraces --enable-removal-policies=heap,lru --enable-delay-pools

 

参数详解:

--prefix=/usr/local/squid1       \安装路径(注意因我的机器装有两种版本,所以命名不一样)

--localstatedir=/var/log/squid        \日志文件的安装路径

--sysconfdir=/etc                      \ 配置文件的安装路径

--enable-gnuregex                     \ :由于Squid大量使用字符串处理做各种判断,加入此项能更好的处理。

--enable-icmp                         \加入icmp支持

--enable-kill-parent-hack                \:关掉suqid的时候,要不要连同父进程一起关掉,这个当然要啦

--enable-snmp                                \:此选项可以让MRTG使用SNMP协议对服务器的流量状态进行监测,因此必须选择此项,使Squid支持SNMP接口。

--disable-ident-lookups                      \:防止系统使用RFC931规定的身份识别方法。

--enable-cahce-digests                        \:加快请求时,检索缓存内容的速度。

--enable-arp-acl                               \:可以在规则设置中直接通过客户端的MAC地址进行管理,防止客户使用IP欺骗

--enable-default-err-languages="Simplify_Chinese" \ :指定出错是显示的错误页面为简体中文

--enable-linux-netfilter                          \:可以支持透明代理

--enable-auth-modules 此编译选项启用认证模块,可以对访问代理用户进行授权

--enable-follow-x-forwarded-for     \

--enable-storeio=aufs,ufs            \(支持的存储模块)

--with-maxfd=65536                    \参数是增大squid文件描述符到65536

--with-pthreads                      \

--enable-dlmalloc                    \

--enable-poll                        \ 应启用Poll()函数而不是select()函数,通常而言poll(轮询)select要好,但configure(脚本程序)已知Poll在某些平台下失效, 若你认为你比configure编译配置脚本程序要聪明的话,可以用这个选项启用Poll。总之就是用这个可以提升性能就是啦。

--enable-underscore               \ :允许解析的URL中出现下划先,因为默认squid会认为带下划线的URL地址是非法的,并拒绝访问该地址。

--enable-stacktraces                 \

--enable-removal-policies=heap,lru    \

--enable-delay-pools    \此选项使能一个延时池,这样能对某些特定的请求限制额定带宽。

 

make

makeinstall

 

注意:如你安装是squid2.6 make 时会有报错,

提示错误:squid undefined reference to `n_coss_dirs'

  解决方法:

  wget http://www.squid-cache.org/Versions/v2/2.6/changesets/11036.patch

  cd squid-2.6.STABLE4

  patch -p1 < ../11036.patch

  ./configure正常了。......

我这里是安装squid-3.1.4版本,因以上错注明一下。

 

3:安装后配置

我的配置文件如下,如不用我的配置文件,请一定要把

cache_effective_user nobody

cache_effective_group nobody

加到你自己的 /usr/local/squid/etc/squid.conf 里,要不然以下编译时会因权限问题,会出错

由于经历问题,只翻译了部分,不过已经足够用。加了限制速度内容,这样可以更好的应用于网站及cdn节点,控制带宽。

 

[root@www htdocs]# vi /usr/local/squid1/etc/squid.conf

 

http_port 192.168.18.122:3128 vhost vport

cache_peer 192.168.18.122 parent 80 0 no-query originserver weight=1 name=a4

cache_peer_domain a4  sjehzy.net

#

# Recommended minimum configuration:

#

acl manager proto cache_object

acl localhost src 127.0.0.1/32

acl localhost src ::1/128

acl to_localhost dst 127.0.0.0/8 0.0.0.0/32

acl to_localhost dst ::1/128

 

# Example rule allowing access from your local networks.

# Adapt to list your (internal) IP networks from where browsing

# should be allowed

acl localnet src 10.0.0.0/8     # RFC1918 possible internal network

acl localnet src 172.16.0.0/12  # RFC1918 possible internal network

acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

acl localnet src fc00::/7   # RFC 4193 local private network range

acl localnet src fe80::/10  # RFC 4291 link-local (directly plugged) machines

acl localnet src sjehzy.net

 

acl SSL_ports port 443

acl Safe_ports port 80          # http

acl Safe_ports port 21          # ftp

acl Safe_ports port 443         # https

acl Safe_ports port 70          # gopher

acl Safe_ports port 210         # wais

acl Safe_ports port 1025-65535  # unregistered ports

acl Safe_ports port 280         # http-mgmt

acl Safe_ports port 488         # gss-http

acl Safe_ports port 591         # filemaker

acl Safe_ports port 777         # multiling http

acl CONNECT method CONNECT

 

#

# Recommended minimum Access Permission configuration:

#

# Only allow cachemgr access from localhost

http_access allow manager localhost

http_access deny manager

 

# Deny requests to certain unsafe ports

http_access deny !Safe_ports

 

# Deny CONNECT to other than secure SSL ports

http_access deny CONNECT !SSL_ports

 

# We strongly recommend the following be uncommented to protect innocent

# web applications running on the proxy server who think the only

# one who can access services on "localhost" is a local user

#http_access deny to_localhost

 

#

# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

#

 

# Example rule allowing access from your local networks.

# Adapt localnet in the ACL section to list your (internal) IP networks

# from where browsing should be allowed

http_access allow localnet

http_access allow localhost

 

# And finally deny all other access to this proxy

http_access deny all

 

# Squid normally listens to port 3128

#http_port 3128

 

# We recommend you to use at least the following line.

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?

 

###

cache_mem 99 MB

max_open_disk_fds 0

maximum_object_size 20 MB

maximum_object_size_in_memory 20 MB

 

# Uncomment and adjust the following to add a disk cache directory.

cache_dir ufs /usr/local/squid1/log/cache 100 16 256

cache_swap_low 80

cache_swap_high 97

strip_query_terms off

request_header_max_size 10 kb

request_body_max_size 1 MB

memory_pools on

memory_pools_limit 150 MB

emulate_httpd_log o

 

# Leave coredumps in the first cache dir

coredump_dir /usr/local/squid1/log/cache

cache_store_log /usr/local/squid1/log/logs/store.log

###

emulate_httpd_log on

#logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh

cache_access_log /usr/local/squid1/log/logs/access.log

##

#error_directory /usr/local/squid/share/errors/Simplify_Chinese

 

# Add any of your own refresh_pattern entries above these.

refresh_pattern ^ftp:           1440    20%     10080

refresh_pattern ^gopher:        1440    0%      1440

refresh_pattern -i (/cgi-bin/|\?) 0     0%      0

refresh_pattern .               0       20%     4320

 

###############################

#refresh_pattern ^ftp: 60 20% 10080

#refresh_pattern ^gopher: 60 0% 1440

 

#refresh_pattern ^gopher: 60 0% 1440

#refresh_pattern . 0 20% 1440

refresh_pattern -i \.css$       360     50%     2880     reload-into-ims

refresh_pattern -i \.js$        1440    50%     2880     reload-into-ims

refresh_pattern -i \.html$      720     50%     1440     reload-into-ims

refresh_pattern -i \.jpg$       1440    90%     2880     ignore-reload

refresh_pattern -i \.gif$       1440    90%     2880     ignore-reload

refresh_pattern -i \.swf$       1440    90%     2880     ignore-reload

refresh_pattern -i \.jpg$       1440    50%     2880     ignore-reload

refresh_pattern -i \.png$       1440    50%     2880     ignore-reload

refresh_pattern -i \.bmp$       1440    50%     2880     ignore-reload

refresh_pattern -i \.doc$       1440    50%     2880      ignore-reload

refresh_pattern -i \.ppt$       1440    50%     2880      ignore-reload

refresh_pattern -i \.xls$       1440    50%     2880      ignore-reload

refresh_pattern -i \.pdf$       1440    50%     2880      ignore-reload

refresh_pattern -i \.rar$       1440    50%     2880      ignore-reload

refresh_pattern -i \.zip$       1440    50%     2880      ignore-reload

refresh_pattern -i \.txt$       1440    50%     2880      ignore-reload

###############################

cache_effective_user nobody

cache_effective_group nobody

cache_mgr hyr23k@163.com

###

dns_timeout 2 seconds

forward_timeout 30 seconds

connect_timeout 30 seconds

peer_connect_timeout 30 seconds

read_timeout 30 seconds

request_timeout 6 seconds

persistent_request_timeout 16 seconds

#

visible_hostname sjehzy.net

logfile_rotate 0

 

 

截止此处均是我的squid.conf文件内容。

4:安装完成后相关创建文件与权限

#mkdir /usr/local/squid1/log/logs/store.log

# chown nobody:nobody /usr/local/squid1/log //用户nobody用户和组来运行squid

# mkdir /usr/local/squid1/log/cache //建立squid缓存目录

# chown nobody:nobody /usr/local/squid1/log/cache //同样,给权限

# cd /usr/local/squid/sbin

# ./squid -z //建立缓存目录

# ls /var/spool/squid //查看是否建立成功

#//usr/local/squid1/sbin/squid –s   //启动squid

 

5:开机运行squid

# vi /etc/rc.local

将以下内容添加最下边

ulimit -Hs 65536

ulimit -n 65536

/usr/local/squid/sbin/squid

存盘,退出,完结。

 

6:iptables 端口映射

iptables -t nat -A PREROUTING -s 192.168.1.225/32 -p tcp --dport 80 -j REDIRECT –to-ports 3128

:

Vi /etc/sysconfig/iptables添加

-A PREROUTING -s ! 192.168.18.122 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

 

以下对以上信息解释:

http_port 80 vhost vport=3128

http_port <host>:<port> [transparent] [vhost] [vport[=<port>]] [defaultsite=<host>] ...

配置 Squid 绑定的 HTTP 端口和 IP 地址,默认配置是 http_port 3180.

host 可以是 IP 地址或者主机名,如果指定主机名,Squid 尝试获取主机名对应的 IP 地址。如果没有指定 host, Squid 将绑定所有地址的端口;

配置选项: transparent    - 支持透明代理,不能与 vhost / vport 同时设置

vhost          - 内容加速器主机

vport          - 内容加速器端口,通常与 http_port 相同,可以使用 vport= 设置其他端口defaultsite=   - 内容加速器的默认网址

 

acl apache rep_header Server ^Apache

#

broken_vary_encoding allow apache

cache_mem 2048 MB

#使用内存大小

maximum_object_size 409600 KB

#超过此文件大小的对象将不缓存

minimum_object_size 0 KB

#小于此大小文件将不被缓存

maximum_object_size_in_memory 512 KB

#内存中能缓存的最大文件大小

cache_dir ufs /var/spool/squid 20480 16 256

#缓存目录设置

cache_swap_low 80

#当交换分区利用率到这个百分比,那么开始替换

cache_swap_high 97

#当交换分区利用率到这个百分比,开始大量替换

strip_query_terms off

request_header_max_size 10 kb

request_body_max_size 0 kb

#设置HTTP请求的包头和数据大小

memory_pools on

如果将该项设为on,则squid将保留所有已经分配(但是未使用)的内存池以便在将来使用。

默认为on .

memory_pools on

 

memory_pools_limit 150 MB

#用来存放请求URL的内存大小

 

编译squid时加上--enable-follow-x-forwarded-for

然后在squid.conf中输入一行:

follow_x_forwarded_for allow all

后端的Apache取日志(httpd.conf):

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %h %T" combined

取到的就是用户真实IP

 

本文出自 “Linux Notes” 博客,请务必保留此出处http://sjehzy.blog.51cto.com/1742683/413487