{"id":3329,"date":"2018-07-18T09:50:55","date_gmt":"2018-07-18T13:50:55","guid":{"rendered":"https:\/\/antipaucity.com\/?p=3329"},"modified":"2018-07-18T09:50:55","modified_gmt":"2018-07-18T13:50:55","slug":"a-fairly-comprehensive-squid-configuration-for-proxying-all-the-http-things","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=3329","title":{"rendered":"a fairly comprehensive squid configuration for proxying all the http things"},"content":{"rendered":"

After combing through the docs<\/a> and several<\/a> how<\/a>–tos<\/a> on<\/a> deploying<\/a> the {{Squid proxy}} server – none of which really did everything I wanted, of course – I’ve finally gotten to the format below.<\/p>\n

Installing Squid is easy-peasy – it’s in the standard package repos for the major platforms ({{CentOS}}\/{{Fedora}}\/{{RHEL}}, {{Ubuntu}}\/{{Debian}}, etc) – so just run yum install squid<\/code> or apt install squid<\/code> on your platform of choice (my exact install command on Ubuntu 18.04 was apt -y install squid net-tools apache2-utils<\/code>).<\/p>\n

What I<\/em> wanted was an “open” (password-protected) proxy server with disk-based caching enabled that would cover all of the ports I could reasonably expect to run into.<\/p>\n

Why “open”? Because I want to be able to turn it on and off on various mobile devices which may (or may not) have stable-ish public IPs.<\/p>\n

Here is the config as I have it deployed, minus sensitive\/site-specific items (usernames, passwords, port, etc), of course:<\/p>\n

\n

A working \/etc\/squid\/squid.conf<\/code><\/h3>\n
acl SSL_ports port 443\nacl SSL_ports port 8443\nacl Safe_ports port 80\t\t# http\nacl Safe_ports port 21\t\t# ftp\nacl Safe_ports port 443\t\t# https\nacl Safe_ports port 1025-65535\t# unregistered ports\nacl Safe_ports port 280\t\t# http-mgmt\nacl Safe_ports port 488\t\t# gss-http\nacl Safe_ports port 777\t\t# multiling http\nacl Safe_ports port 8080\nacl CONNECT method CONNECT\n\nauth_param basic program \/usr\/lib\/squid\/basic_ncsa_auth \/etc\/squid\/.htpasswd\nauth_param basic children 15\n# after \"realm\", put some descriptive, clever, or otherwise-identifying string that will appear when you login\nauth_param basic realm Insert Incredibly Witty Title Here\nauth_param basic credentialsttl 5 hours\nacl password proxy_auth REQUIRED\nhttp_access allow password\n\n# Deny requests to certain unsafe ports\nhttp_access deny !Safe_ports\n\n# Deny CONNECT to other than secure SSL ports\nhttp_access deny CONNECT !SSL_ports\n\n# Only allow cachemgr access from localhost\nhttp_access allow localhost manager\nhttp_access deny manager\n\n#http_access allow localnet\nhttp_access allow localhost\n\n# And finally deny all other access to this proxy\n# commented-out to allow \"open\" use (ie password authenticated)\n#http_access deny all\n\n# Squid normally listens to port 3128\n# change this line if you want it to listen on something other port\nhttp_port 3128\n\n# Uncomment and adjust the following to add a disk cache directory.\n#cache_dir ufs \/var\/spool\/squid 100 16 256\n# format is      \ncache_dir ufs \/etc\/squid\/squid-cache 768 16 256\n\n# Leave coredumps in the first cache dir\ncoredump_dir \/var\/spool\/squid\n\n# Add any of your own refresh_pattern entries above these.\n#\nrefresh_pattern ^ftp:\t\t1440\t20%\t10080\nrefresh_pattern ^gopher:\t1440\t0%\t1440\nrefresh_pattern -i (\/cgi-bin\/|\\?) 0\t0%\t0\nrefresh_pattern (Release|Packages(.gz)*)$      0       20%     2880\nrefresh_pattern .\t\t0\t20%\t4320\n\nvia off\nforwarded_for off\n\nrequest_header_access Allow allow all \nrequest_header_access Authorization allow all \nrequest_header_access WWW-Authenticate allow all \nrequest_header_access Proxy-Authorization allow all \nrequest_header_access Proxy-Authenticate allow all \nrequest_header_access Cache-Control allow all \nrequest_header_access Content-Encoding allow all \nrequest_header_access Content-Length allow all \nrequest_header_access Content-Type allow all \nrequest_header_access Date allow all \nrequest_header_access Expires allow all \nrequest_header_access Host allow all \nrequest_header_access If-Modified-Since allow all \nrequest_header_access Last-Modified allow all \nrequest_header_access Location allow all \nrequest_header_access Pragma allow all \nrequest_header_access Accept allow all \nrequest_header_access Accept-Charset allow all \nrequest_header_access Accept-Encoding allow all \nrequest_header_access Accept-Language allow all \nrequest_header_access Content-Language allow all \nrequest_header_access Mime-Version allow all \nrequest_header_access Retry-After allow all \nrequest_header_access Title allow all \nrequest_header_access Connection allow all \nrequest_header_access Proxy-Connection allow all \nrequest_header_access User-Agent allow all \nrequest_header_access Cookie allow all \nrequest_header_access All deny all\n<\/pre>\n
\n
Finalize your Squid server system settings<\/h3>\n
Things you need to do once you do the above (prepend sudo<\/code> to each command below if you’re not logged-in as root<\/code>:<\/p>\n
    \n
  1. Enable Squid to start at boot: systemctl enable squid<\/code><\/li>\n
  2. Create the cache directories: squid -z<\/code><\/li>\n
  3. Create a DNS entry for your proxy host (if you want it usable outside your home network, and don’t want to reference it by IP address only)<\/li>\n
  4. Create the authentication file (\/etc\/squid\/.htpasswd<\/code> in this example): touch \/etc\/squid\/.htpasswd<\/code><\/li>\n
  5. Create a username and password: htpasswd -c \/etc\/squid\/.htpasswd <\/code> (don’t forget this username\/password combination!)<\/li>\n
  6. Start Squid: systemctl start squid<\/code><\/li>\n<\/ol>\n
    Configure your browser to use your new proxy<\/h3>\n
    Here’s where you need to go and what you need to change in Firefox:<\/p>\n
      \n
    1. Navigate to about:preferences<\/code><\/li>\n
    2. Click on Settings…<\/em> under Network Proxy<\/strong>
      \n\"\"<\/li>\n
    3. Enter your<\/em> proxy host details:
      \n\"\"<\/li>\n<\/ol>\n
      To verify your proxy settings are correct, visit IPv4.cf<\/a> with both the proxy off<\/em>, and then again with it on<\/em>.<\/p>\n
      If your reported IP address changes between visits (with the second check being your Squid server IP) – congratulations! You have successfully deployed a Squid proxy caching server.<\/p>\n","protected":false},"excerpt":{"rendered":"
      After combing through the docs and several how–tos on deploying the {{Squid proxy}} server – none of which really did everything I wanted, of course – I’ve finally gotten to the format below. Installing Squid is easy-peasy – it’s in the standard package repos for the major platforms ({{CentOS}}\/{{Fedora}}\/{{RHEL}}, {{Ubuntu}}\/{{Debian}}, etc) – so just run …
      Continue reading a fairly comprehensive squid configuration for proxying all the http things<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[41],"tags":[159,249,390,395,450,601,710],"keyring_services":[],"class_list":["post-3329","post","type-post","status-publish","format-standard","hentry","category-technical","tag-cache","tag-dns","tag-how-to","tag-https","tag-linux","tag-proxy","tag-squid"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3329"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3329\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3329"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=3329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}