Squid

Introduction
Squid is a free caching proxy server that runs on Linux and many other operating systems. Squid can be deployed in two scenarios, forward or reverse proxy.
Squid as a forward proxy helps to save network resources by directly supplying common data access by clients, providing authentication and authorization, logging of internet usage, enforcing organization internet policy enforcement and managing of organization network resource.
Squid as a reverse proxy helps to manage and optimize resources of outgoing resources from a web server farm, by caching and serving frequently used static contents, act as a middle man for slower remote clients so as to quickly free up resources for faster clients (SpoonFeeding), perform requesting filtering to enhance web security or act as an IPv4-IPv6 gateway.

Feature
Squid is a robust service as it provides organization with many features. In this section we shall cover the more popular features used by organization to secure or optimize their network.

Transparent Proxy
The most basic reason to use Squid is its ability to act as a transparent proxy. This is when the organization wants the users and clients within the network to use the proxy without their knowing and without having the need to configure their browser to use the proxy.

Squid make this possible by acting as either a gateway router, or having the gateway redirecting traffic to a Linux server that is hosting

Access Control Lists (ACL)
Squid is able to control access of the clients within the organization by filtering source/destination IP address, time of access, URLs, port number or transfer protocol. Below is a list of how Squid can be configured for ACL:

1.Restricting access to local network users.
2.Blocking specific computers
3.Restriction of certain web sites during office hours
4.Blocking pornography or phishing websites

Proxy authentication
Squid allows to be configured so that only authorized users are allowed to access the network or internet within the organization, by using one of the three techniques listed below:
1.HTTP Basic authentication
2.HTTP Digest
3.NTLM

To use proxy authentication, Squid also provide API, auth_param to query a number of standard databases to verify the credentials.
Proxy authentication is not covered in this document.

Install Squid
Sendmail requires 3 packages to work; sendmail, sendmail-cf and m4.

There are 3 ways to install Squid:
1.Installing through Yum
2.Install RPM packages
3.Build from source

Yum (Yellowdog Updater Modified)
Install through Yum is simple. Just execute the following command to install.

~]# Yum Install squid

RPM Package Manager
Installing through RPM Package manager requires a bit more work. Normally we will install from the CD/DVD-ROM provided. If in any case a CD/DVD-ROM is not available, we might have to download the rpm file from online source.

a.Navigate to the source, which most like be the CD/DVD-ROM. The source CD/DVD-ROM have to be inserted first

~]# cd / media/RHEL_5.3\ x86_64\ DVD/Server

b.Install the rpm

~]# rpm –Uvh squid*

Install from source
a.Download the source

~]# wget ftp://squid.cbn.net.id/pub/squid/squid-3.1.1.tar.gz

b.Unzip the source

~]# tar –zxv squid-3.1.1.tar.gz

c.Compile the source

~]# cd squid-3.1.1
~]# ./configure
~]# make
~]# make install

Squid Configuration

Enter the following command to edit squid configuration file
~]#nano /etc/squid/squid.conf

Modify or add the following squid directives:
Httpd_accel_host virtual
Httpd_accel_port 80
Httpd_accel_with_proxy on
Httpd_accel_uses_host_header on
Acl lan src 192.168.1.1 192.168.100.1/24
Http_access allow localhost
http_access allow lan

Add the following lines at the bottom of the squid configuration files. Save and exit text editor.
•To allow access from local networks

~]#acl internalNetwork src 192.168.1.0/24
~]# http_access allow internalNetwork

•Deny user from accessing website
~]#acl blocksites www .google.com
~]#http_access deny blocksites

•Deny user who browses to a URL with the word ‘hack’ in it.
~]#acl blockword url_regex – i hack
~]#http_access deny blockword

•Filtering content
Start squid proxy server
~]# chkconfig squid on
~]#/etc/init.d/squid restart

Confirm that port is open

~]#netstat –tuna grep XXXX

Ensure that iptable allows access to squid server by editing the iptables configuration files. Save and Exit

~]#nano /etc/sysconfig/iptables -A RH-Firewall-1-INPUT –m state –state NEW,ESTABLISHED,RELATED –m tcp –p tcp – dport XXXX –j ACCEPT

Restart iptables
~]#/etc/init.d/iptables restart

Squid Testing
Read the squid proxy access log to confirm that the acl set is working according to what you required

~]#nano –f /var/log/squid/access.log

See access log file /var/log/squid/access.log:

~]# tail -f /var/log/squid/access.log