编译安装squid3.1--亲测

编译安装Squid2.6
1，设置“文件描述符”，并设置用户同时打开文件数量
# vi /usr/include/bits/typesizes.h
# vi /usr/include/linux/posix_types.h
把里边的 #define __FD_SETSIZE 1024 改成 65536
2，设置当前环境
# ulimit -Hs 65536
# ulimit -n 65536
H参数是硬性限制，s是堆栈上限，n是文件描述符上限。
3，优化cpu
以下参数可以在 http://gentoo-wiki.com/Safe_Cflags 查到自己的cpu参数
# export CHOST="i686-pc-linux-gnu"
# export CFLAGS="-march=pentium4 -O2 -pipe -fomit-frame-pointer"
# export CXXFLAGS="${CFLAGS}"

1:下载
Wget http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.4.tar.gz Tar zxvf squid-3.1.4.tar.gz
Cd squid-3.1.4
2:编译squid
./configure --prefix=/usr/local/squid --localstatedir=/var/log/squid1 --enable-gnuregex --enable-icmp --enable-kill-parent-hack --enable-snmp --disable-ident-lookups --enable-cahce-digests --enable-arp-acl --enable-default-err-languages="Simplify_Chinese" --enable-linux-netfilter --enable-auth-modules --enable-follow-x-forwarded-for --enable-storeio=aufs,ufs --with-maxfd=65536 --with-pthreads --enable-dlmalloc --enable-poll --enable-underscore --enable-stacktraces --enable-removal-policies=heap,lru --enable-delay-pools

参数详解:
--prefix=/usr/local/squid1 \安装路径(注意因我的机器装有两种版本，所以命名不一样)
--localstatedir=/var/log/squid \日志文件的安装路径
--sysconfdir=/etc \ 配置文件的安装路径
--enable-gnuregex \ :由于Squid大量使用字符串处理做各种判断，加入此项能更好的处理。
--enable-icmp \加入icmp支持
--enable-kill-parent-hack \:关掉suqid的时候，要不要连同父进程一起关掉，这个当然要啦
--enable-snmp \:此选项可以让MRTG使用SNMP协议对服务器的流量状态进行监测，因此必须选择此项，使Squid支持SNMP接口。
--disable-ident-lookups \:防止系统使用RFC931规定的身份识别方法。
--enable-cahce-digests \:加快请求时，检索缓存内容的速度。
--enable-arp-acl \:可以在规则设置中直接通过客户端的MAC地址进行管理，防止客户使用IP欺骗
--enable-default-err-languages="Simplify_Chinese" \ :指定出错是显示的错误页面为简体中文
--enable-linux-netfilter \:可以支持透明代理
--enable-auth-modules 此编译选项启用认证模块，可以对访问代理用户进行授权
--enable-follow-x-forwarded-for \
--enable-storeio=aufs,ufs \(支持的存储模块)
--with-maxfd=65536 \参数是增大squid文件描述符到65536
--with-pthreads \
--enable-dlmalloc \
--enable-poll \ 应启用Poll()函数而不是select()函数，通常而言poll(轮询)比select要好，但configure(脚本程序)已知Poll在某些平台下失效, 若你认为你比configure编译配置脚本程序要聪明的话，可以用这个选项启用Poll。总之就是用这个可以提升性能就是啦。
--enable-underscore \ :允许解析的URL中出现下划先，因为默认squid会认为带下划线的URL地址是非法的，并拒绝访问该地址。
--enable-stacktraces \
--enable-removal-policies=heap,lru \
--enable-delay-pools \此选项使能一个延时池，这样能对某些特定的请求限制额定带宽。

make
makeinstall

注意：如你安装是squid2.6 在make 时会有报错，
提示错误：squid undefined reference to `n_coss_dirs'
　　解决方法：
　　wget http://www.squid-cache.org/Versions/v2/2.6/changesets/11036.patch 　　cd squid-2.6.STABLE4
　　patch -p1 < ../11036.patch
　　./configure正常了。......
我这里是安装squid-3.1.4版本，因以上错注明一下。

3:安装后配置
我的配置文件如下，如不用我的配置文件，请一定要把
cache_effective_user nobody
cache_effective_group nobody
加到你自己的 /usr/local/squid/etc/squid.conf 里，要不然以下编译时会因权限问题，会出错
由于经历问题，只翻译了部分，不过已经足够用。加了限制速度内容，这样可以更好的应用于网站及cdn节点，控制带宽。

[root@www htdocs]# vi /usr/local/squid1/etc/squid.conf

http_port 192.168.18.122:3128 vhost vport
cache_peer 192.168.18.122 parent 80 0 no-query originserver weight=1 name=a4
cache_peer_domain a4 sjehzy.net
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl localhost src ::1/128
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
acl to_localhost dst ::1/128

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl localnet src sjehzy.net

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
#http_port 3128

# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?

###
cache_mem 99 MB
max_open_disk_fds 0
maximum_object_size 20 MB
maximum_object_size_in_memory 20 MB

# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /usr/local/squid1/log/cache 100 16 256
cache_swap_low 80
cache_swap_high 97
strip_query_terms off
request_header_max_size 10 kb
request_body_max_size 1 MB
memory_pools on
memory_pools_limit 150 MB
emulate_httpd_log o

# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid1/log/cache
cache_store_log /usr/local/squid1/log/logs/store.log
###
emulate_httpd_log on
#logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
cache_access_log /usr/local/squid1/log/logs/access.log
##
#error_directory /usr/local/squid/share/errors/Simplify_Chinese

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

###############################
#refresh_pattern ^ftp: 60 20% 10080
#refresh_pattern ^gopher: 60 0% 1440

#refresh_pattern ^gopher: 60 0% 1440
#refresh_pattern . 0 20% 1440
refresh_pattern -i \.css$ 360 50% 2880 reload-into-ims
refresh_pattern -i \.js$ 1440 50% 2880 reload-into-ims
refresh_pattern -i \.html$ 720 50% 1440 reload-into-ims
refresh_pattern -i \.jpg$ 1440 90% 2880 ignore-reload
refresh_pattern -i \.gif$ 1440 90% 2880 ignore-reload
refresh_pattern -i \.swf$ 1440 90% 2880 ignore-reload
refresh_pattern -i \.jpg$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.png$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.bmp$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.doc$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.ppt$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.xls$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.pdf$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.rar$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.zip$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.txt$ 1440 50% 2880 ignore-reload
###############################
cache_effective_user nobody
cache_effective_group nobody
cache_mgr hyr23k@163.com
###
dns_timeout 2 seconds
forward_timeout 30 seconds
connect_timeout 30 seconds
peer_connect_timeout 30 seconds
read_timeout 30 seconds
request_timeout 6 seconds
persistent_request_timeout 16 seconds
#
visible_hostname sjehzy.net
logfile_rotate 0

截止此处均是我的squid.conf文件内容。
4:安装完成后相关创建文件与权限
#mkdir /usr/local/squid1/log/logs/store.log
# chown nobody:nobody /usr/local/squid1/log //用户nobody用户和组来运行squid
# mkdir /usr/local/squid1/log/cache //建立squid缓存目录
# chown nobody:nobody /usr/local/squid1/log/cache //同样，给权限
# cd /usr/local/squid/sbin
# ./squid -z //建立缓存目录
# ls /var/spool/squid //查看是否建立成功
#//usr/local/squid1/sbin/squid –s //启动squid

5:开机运行squid
# vi /etc/rc.local
将以下内容添加最下边
ulimit -Hs 65536
ulimit -n 65536
/usr/local/squid/sbin/squid
存盘，退出，完结。

6:iptables 端口映射
iptables -t nat -A PREROUTING -s 192.168.1.225/32 -p tcp --dport 80 -j REDIRECT –to-ports 3128
或:
Vi /etc/sysconfig/iptables添加
-A PREROUTING -s ! 192.168.18.122 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

以下对以上信息解释：
http_port 80 vhost vport=3128
http_port <host>:<port> [transparent] [vhost] [vport[=<port>]] [defaultsite=<host>] ...
配置 Squid 绑定的 HTTP 端口和 IP 地址，默认配置是 http_port 3180.
host 可以是 IP 地址或者主机名，如果指定主机名，Squid 尝试获取主机名对应的 IP 地址。如果没有指定 host, Squid 将绑定所有地址的端口；
配置选项： transparent - 支持透明代理，不能与 vhost / vport 同时设置
vhost - 内容加速器主机
vport - 内容加速器端口，通常与 http_port 相同，可以使用 vport= 设置其他端口defaultsite= - 内容加速器的默认网址

acl apache rep_header Server ^Apache
#
broken_vary_encoding allow apache
cache_mem 2048 MB
#使用内存大小
maximum_object_size 409600 KB
#超过此文件大小的对象将不缓存
minimum_object_size 0 KB
#小于此大小文件将不被缓存
maximum_object_size_in_memory 512 KB
#内存中能缓存的最大文件大小
cache_dir ufs /var/spool/squid 20480 16 256
#缓存目录设置
cache_swap_low 80
#当交换分区利用率到这个百分比，那么开始替换
cache_swap_high 97
#当交换分区利用率到这个百分比，开始大量替换
strip_query_terms off
request_header_max_size 10 kb
request_body_max_size 0 kb
#设置HTTP请求的包头和数据大小
memory_pools on
如果将该项设为on，则squid将保留所有已经分配（但是未使用）的内存池以便在将来使用。
默认为on .
memory_pools on

memory_pools_limit 150 MB
#用来存放请求URL的内存大小

编译squid时加上--enable-follow-x-forwarded-for
然后在squid.conf中输入一行：
follow_x_forwarded_for allow all
后端的Apache取日志（httpd.conf）：
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %h %T" combined
取到的就是用户真实IP

本文出自 “Linux Notes” 博客，请务必保留此出处/article/7256487.html