搭建squid（代理服务器）

原创已于 2024-08-29 14:34:04 修改 · 1.4k 阅读

本内容遵循CC 4.0 BY-SA版权协议

于 2023-03-31 13:46:39 首次发布

该文介绍了如何创建Squid密码文件并将其复制到Docker容器中，然后展示了docker-compose.yml配置，包括Squid服务的重启策略、端口映射、配置文件挂载。在squid.conf中设置了访问控制列表(ACL)和安全端口，以及基本认证。最后，使用docker-composeup-d启动服务。

创建密码

#创建密码文件
htpasswd squid_passwd 账号 密码
#复制密码文件至docker里面
docker cp ./squid_passwd docker编号:/etc/squid/

docker-compose.yml

version: '3.1'
services:
  squid:
    restart: always
    image: ubuntu/squid
    container_name: squid
    ports:
      - 3128:3128
    volumes:
      - ./squid.conf:/etc/squid/squid.conf
      - ./debian.conf:/etc/squid/conf.d/debian.conf
      - ./squid_passwd:/etc/squid/squid_passwd

squid.conf


acl localnet src 0.0.0.1-0.255.255.255	# RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8		# RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10		# RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16 	# RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12		# RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16		# RFC 1918 local private network (LAN)
acl localnet src fc00::/7       	# RFC 4193 local private network range
acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT


http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
#如果限制了向日款就无法连接
#http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager


#http_access allow localnet
http_access allow localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
include /etc/squid/conf.d/debian.conf

# And finally deny all other access to this proxy
http_access deny all



# Squid normally listens to port 3128
http_port 3128



# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid


#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
# example pattern for deb packages
#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
refresh_pattern .		0	20%	4320

debian.conf

#定义squid密码文件与ncsa_auth文件位置
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/squid_passwd
#对定义的ncsa_users文件内的用户开启认证访问
acl ncsa_users proxy_auth REQUIRED
#允许ncsa_users文件内用户进行代理
http_access allow ncsa_users
#顺序匹配，最后添加拒绝所有未允许的规则。不添加会发现，未匹配到的规则会被放行
http_access deny all

运行