Installing Squid proxy server running on Windows

我在WINDOWS2012上安装SQUID 2.8 UPDATE8.

按以下方法，不加认证，几乎不用更改就生效了。

（DOS窗口的操作都是以管理员身份操作的）

http://certcollection.org/forum/topic/98920-installing-squid-proxy-server-running-on-windows/

There are various software that implement a proxy server, some commercial and some free stuff. In this guide we will see how to implement a proxy server in a Windows environment is fully integrated into Active Directory at no cost.

The product concerned is Squid

http://www.squid-cache.org/

, originally developed for the Linux porting is also available on the Windows platform.

Integration with Active Directory, you can if we install on a machine both Linux and Windows, on Linux configuration for authentication in AD is slightly more complex than in the Windows environment.

Squid can be installed on any machine of our network not necessarily with two network adapters, in which case must do also from gateway.

First we must download Squid from

http://squid.acmeconsulting.it/index.html

site, follow the signs for Squid 2.7 for Windows-> Squid Download Page-> mirror mirror 1/ 2-> and here and get the latest version Stable, at the moment is the 2.7. STABLE8.

Once the download unpack the .zip file in the path c:\squid. Copy these three files in the path c:\squid\etc:

（以下必作）

* squid.conf.default==> squid.conf
* mime.conf.default==> mime file
* cachemgr.conf.default==> cachemgr. conf

Open the squid.conf and making some changes required for the first time:

* Section OPTIONS FOR AUTHENTICATION
o Remove the comment on these three rows and we complete the first so that you have:

（以下没作）

auth_param ntlm program c:/squid/libexec/mswin_ntlm_auth .exe
auth_param ntlm children 5
auth_param ntlm keep_alive on

These parameters indicate to squid to use authentication NTLM, to use the program and mswin_ntlm_auth. xe to authenticate and use 5 concurrent processes for authentication.
* ACCESS CONTROLS Section
o Default Squid grants access from local networks that have private ip addresses of 3 standard classes, if our network does not fall into these we must add it to these 3 lines:

（以下没改）
acl localnet src 10.0.0.0/8# RFC1918 possible internal network
acl localnet src 172.16.0.0/12# RFC1918 possible internal network
acl localnet src 192.168.0.0/16# RFC1918 possible internal network

o In the basic configuration Squid grants access only to the following ports:

（以下没改）

acl SSL_ports port 443
acl Safe_ports port 80# http
acl Safe_ports port 21# ftp
acl Safe_ports port 443# https
acl Safe_ports port 70# gopher
acl Safe_ports port 210# wais
acl Safe_ports port 1025-65535# unregistered ports
acl Safe_ports port 280# http-mgmt
acl Safe_ports port 488# gss-http
acl Safe_ports port 591# filemaker
acl Safe_ports port 777# multiling http

Also here if we have other needs we must add the ports you want to be reached.
o Immediately after the last we must insert an ACL to verify authentication in Active Directory:

acl Authenticatedusing proxy_auth ACL REQUIRED

and set an access rule that denies all unauthenticated sessions:

http_access deny!Authenticated

be inserted immediately after the line:

# INSERT YOUR OWN RULE (S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

* Section DISK CACHE OPTIONS
o In this section we have to set the configuration parameters of the disk cache, to do this, remove the comment line:

（这步我作了，参数未改，并且手工在VAR下新建了CACHE目录）

cache_dir ufs c:/squid/var/cache 10016256

and edit the parameters according to our needs.
Taking into account that the three parameters have this meaning:
100 = maximum size in MB of disk cache
16 = number of subdirectories (1st level)
256 = number of subdirectory of 2nd level
Initially we can leave the default these 3 parameters.

* LOGFILE OPTIONS Section

o In this section we define the location and the type of access log file that is generated by Squid.
The path is defined by the following directive:

access_log c:/squid/var/logs/squid access.log

While the type is defined by the line:

logformat squid%0% ts.3tu%6tr% a%Ss/>%< st 03Hs%% rm% ru% a%Sh/%<% mt

in this case we define a log format called squid and use it in the command access_log.

* ADMINISTRATIVE PARAMETERS Section

o In case of failure or to access an unauthorized site Squid
displays a page with details including an e-mal address of the system
administrator. In this regard we can change this address by using the
following directive:

cache_mgr <indirizzo_email>

* ERROR PAGE OPTIONS Section

o The last parameter to change the language in which you want to display the error pages, to achieve this, we use this directive:

error_directory c:/squid/share/errors/English

where instead of English we insert the name of the directory that reflects the language that we use inside the folder c:/squid/share/and rrors, in the case of English we:

error_directory c:/squid/share/errors/Italian

At this point, the basic configuration Squid is finished and we can send him running for the first time. Open a dos directory, find the white flashing c:\squid\sbin and launch the command:

（这步必作）

squid-z

in order to create the cache directory. If we have not made mistakes in the configuration file you should see something like:

C:\squid\sbin>squid -z 2010/04/2411:33:24|CreatingSwapDirectories

We suggest that the creation of the directory is successful, otherwise we will see something like:

C:\squid\sbin>squid -z 2010/04/2411:41:28| parseConfigFile: squid.conf:4257 unrecognized:'error_directoryxxx'2010/04/2411:41:28|CreatingSwapDirectories

in which case we have committed some syntax error. (In this case was wanted!!).

NOTE: If we install squid in the default directory c:\squid we should never specify the location of the configuration file, if instead we use a different path is necessaroio change all references in the squid.conf file and use the parameter -f configfile every time I launch the command squid.exe.

Now we can install Squid as a service and start to test it. To do this, launch the command:

（这步必作）

C:\squid\sbin>squid -i
Registry stored HKLM\SOFTWARE\GNU\Squid\2.6\Squid\ConfigFile value c:/squid/etc/squid.conf
SquidCache version 2.7.STABLE8 for i686-pc-winnt installed successfully asSquidWindowsSystemService.
To run, start it from the ServicesApplet of ControlPanel.Don't forget to edit squid.conf before starting it.

If all is successful you will create the service Squid. If we want to call it differently, we need to add the parameter -n servicename. Once you have created the service we need to start it with the command:

（这步必作）

net start Squid

and we will get output like:

TheSquid service is starting.TheSquid service was started successfully.

We verify that Squid is actually listening via the command:

C:\squid\sbin > netstat-na | findstr:31280.0.0.00.0.0.0:3128 TCP:0 LISTENING

As you can see clearly squid is listening on the default port 3128.

Open Internet Explorer on a client and to configure the proxy settings using the menu Tools > Internet Options-> Connections-> LAN Settings and set the proxy server as shown in Figure:

replacing the address and port of the server with those of our configuration.

Let's go back to the browser and try to reach a site any, if everything works you should see the page without any problem.

To verify the actual use of the proxy, we can use one of several test online type

http://www.lagado.com/proxy-test

or check the file access.log in the folder C:\squid\var\logs.

If you see a window like this:

We ask for your login credentials means that the proxy is working but there is some problem with NTLM authentication. In this case we change the LAN Manager authentication level in value:

Send LM and NTLM –useNTLMv2 session security if negotiated

For simplicity we can change the Default Domain Policy so you want to configure all machines in the domain. The setting is located in the key:

ComputerConfiguration->Policies->WindowsSettings->SecuritySettings->LocalPolicies->SecurityOptions->Network security: LAN Manager authentication level

Once change expect the policy is applied or forziamola with the command GPUDATE/force, then try again and if everything went well this time the request for username and password should appear.

With the procedures specified so far according to Squid configuration has finished, access is granted to all for any site and a log is generated for each login.

In next part we will see some parameters for optimization of Squid and how to configure the proxy settings in the browser automatically