编译安装squid3.1亲测

编译安装Squid2.6

1，设置“文件描述符”，并设置用户同时打开文件数量

# vi /usr/include/bits/typesizes.h

# vi /usr/include/linux/posix_types.h

把里边的 #define __FD_SETSIZE 1024 改成 65536

2，设置当前环境

# ulimit -Hs 65536

# ulimit -n 65536

H参数是硬性限制，s是堆栈上限，n是文件描述符上限。

3，优化cpu

以下参数可以在 http://gentoo-wiki.com/Safe_Cflags 查到自己的cpu参数

# export CHOST="i686-pc-linux-gnu"

# export CFLAGS="-march=pentium4 -O2 -pipe -fomit-frame-pointer"

# export CXXFLAGS="${CFLAGS}"

1:下载

Wget http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.4.tar.gz

Tar zxvf squid-3.1.4.tar.gz

Cd squid-3.1.4

2:编译squid

./configure --prefix=/usr/local/squid --localstatedir=/var/log/squid1 --enable-gnuregex --enable-icmp --enable-kill-parent-hack --enable-snmp --disable-ident-lookups --enable-cahce-digests --enable-arp-acl --enable-default-err-languages="Simplify_Chinese" --enable-linux-netfilter --enable-auth-modules --enable-follow-x-forwarded-for --enable-storeio=aufs,ufs --with-maxfd=65536 --with-pthreads --enable-dlmalloc --enable-poll --enable-underscore --enable-stacktraces --enable-removal-policies=heap,lru --enable-delay-pools

参数详解:

--prefix=/usr/local/squid1 \安装路径(注意因我的机器装有两种版本，所以命名不一样)

--localstatedir=/var/log/squid \日志文件的安装路径

--sysconfdir=/etc \ 配置文件的安装路径

--enable-gnuregex \ :由于Squid大量使用字符串处理做各种判断，加入此项能更好的处理。

--enable-icmp \加入icmp支持

--enable-kill-parent-hack \:关掉suqid的时候，要不要连同父进程一起关掉，这个当然要啦

--enable-snmp \:此选项可以让MRTG使用SNMP协议对服务器的流量状态进行监测，因此必须选择此项，使Squid支持SNMP接口。

--disable-ident-lookups \:防止系统使用RFC931规定的身份识别方法。

--enable-cahce-digests \:加快请求时，检索缓存内容的速度。

--enable-arp-acl \:可以在规则设置中直接通过客户端的MAC地址进行管理，防止客户使用IP欺骗

--enable-default-err-languages="Simplify_Chinese" \ :指定出错是显示的错误页面为简体中文

--enable-linux-netfilter \:可以支持透明代理

--enable-auth-modules 此编译选项启用认证模块，可以对访问代理用户进行授权

--enable-follow-x-forwarded-for \

--enable-storeio=aufs,ufs \(支持的存储模块)

--with-maxfd=65536 \参数是增大squid文件描述符到65536

--with-pthreads \

--enable-dlmalloc \

--enable-poll \ 应启用Poll()函数而不是select()函数，通常而言poll(轮询)比select要好，但configure(脚本程序)已知Poll在某些平台下失效, 若你认为你比configure编译配置脚本程序要聪明的话，可以用这个选项启用Poll。总之就是用这个可以提升性能就是啦。

--enable-underscore \ :允许解析的URL中出现下划先，因为默认squid会认为带下划线的URL地址是非法的，并拒绝访问该地址。

--enable-stacktraces \

--enable-removal-policies=heap,lru \

--enable-delay-pools \此选项使能一个延时池，这样能对某些特定的请求限制额定带宽。

make

makeinstall

注意：如你安装是squid2.6 在make 时会有报错，

提示错误：squid undefined reference to `n_coss_dirs'

　　解决方法：

　　wget http://www.squid-cache.org/Versions/v2/2.6/changesets/11036.patch

　　cd squid-2.6.STABLE4

　　patch -p1 < ../11036.patch

　　./configure正常了。......

我这里是安装squid-3.1.4版本，因以上错注明一下。

3:安装后配置

我的配置文件如下，如不用我的配置文件，请一定要把

cache_effective_user nobody

cache_effective_group nobody

加到你自己的 /usr/local/squid/etc/squid.conf 里，要不然以下编译时会因权限问题，会出错

由于经历问题，只翻译了部分，不过已经足够用。加了限制速度内容，这样可以更好的应用于网站及cdn节点，控制带宽。

[root@www htdocs]# vi /usr/local/squid1/etc/squid.conf

http_port 192.168.18.122:3128 vhost vport

cache_peer 192.168.18.122 parent 80 0 no-query originserver weight=1 name=a4

cache_peer_domain a4 sjehzy.net

#

# Recommended minimum configuration:

#

acl manager proto cache_object

acl localhost src 127.0.0.1/32

acl localhost src ::1/128

acl to_localhost dst 127.0.0.0/8 0.0.0.0/32

acl to_localhost dst ::1/128

# Example rule allowing access from your local networks.

# Adapt to list your (internal) IP networks from where browsing

# should be allowed

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network

acl localnet src 172.16.0.0/12 # RFC1918 possible internal network

acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

acl localnet src fc00::/7 # RFC 4193 local private network range

acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

acl localnet src sjehzy.net

acl SSL_ports port 443

acl Safe_ports port 80 # http

acl Safe_ports port 21 # ftp

acl Safe_ports port 443 # https

acl Safe_ports port 70 # gopher

acl Safe_ports port 210 # wais

acl Safe_ports port 1025-65535 # unregistered ports

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 488 # gss-http

acl Safe_ports port 591 # filemaker

acl Safe_ports port 777 # multiling http

acl CONNECT method CONNECT

#

# Recommended minimum Access Permission configuration:

#

# Only allow cachemgr access from localhost

http_access allow manager localhost

http_access deny manager

# Deny requests to certain unsafe ports

http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports

http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent

# web applications running on the proxy server who think the only

# one who can access services on "localhost" is a local user

#http_access deny to_localhost

#

# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

#

# Example rule allowing access from your local networks.

# Adapt localnet in the ACL section to list your (internal) IP networks

# from where browsing should be allowed

http_access allow localnet

http_access allow localhost

# And finally deny all other access to this proxy

http_access deny all

# Squid normally listens to port 3128

#http_port 3128

# We recommend you to use at least the following line.

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?

###

cache_mem 99 MB

max_open_disk_fds 0

maximum_object_size 20 MB

maximum_object_size_in_memory 20 MB

# Uncomment and adjust the following to add a disk cache directory.

cache_dir ufs /usr/local/squid1/log/cache 100 16 256

cache_swap_low 80

cache_swap_high 97

strip_query_terms off

request_header_max_size 10 kb

request_body_max_size 1 MB

memory_pools on

memory_pools_limit 150 MB

emulate_httpd_log o

# Leave coredumps in the first cache dir

coredump_dir /usr/local/squid1/log/cache

cache_store_log /usr/local/squid1/log/logs/store.log

###

emulate_httpd_log on

#logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh

cache_access_log /usr/local/squid1/log/logs/access.log

##

#error_directory /usr/local/squid/share/errors/Simplify_Chinese

# Add any of your own refresh_pattern entries above these.

refresh_pattern ^ftp: 1440 20% 10080

refresh_pattern ^gopher: 1440 0% 1440

refresh_pattern -i (/cgi-bin/|\?) 0 0% 0

refresh_pattern . 0 20% 4320

###############################

#refresh_pattern ^ftp: 60 20% 10080

#refresh_pattern ^gopher: 60 0% 1440

#refresh_pattern ^gopher: 60 0% 1440

#refresh_pattern . 0 20% 1440

refresh_pattern -i \.css$ 360 50% 2880 reload-into-ims

refresh_pattern -i \.js$ 1440 50% 2880 reload-into-ims

refresh_pattern -i \.html$ 720 50% 1440 reload-into-ims

refresh_pattern -i \.jpg$ 1440 90% 2880 ignore-reload

refresh_pattern -i \.gif$ 1440 90% 2880 ignore-reload

refresh_pattern -i \.swf$ 1440 90% 2880 ignore-reload

refresh_pattern -i \.jpg$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.png$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.bmp$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.doc$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.ppt$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.xls$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.pdf$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.rar$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.zip$ 1440 50% 2880 ignore-reload

refresh_pattern -i \.txt$ 1440 50% 2880 ignore-reload

###############################

cache_effective_user nobody

cache_effective_group nobody

cache_mgr hyr23k@163.com

###

dns_timeout 2 seconds

forward_timeout 30 seconds

connect_timeout 30 seconds

peer_connect_timeout 30 seconds

read_timeout 30 seconds

request_timeout 6 seconds

persistent_request_timeout 16 seconds

#

visible_hostname sjehzy.net

logfile_rotate 0

截止此处均是我的squid.conf文件内容。

4:安装完成后相关创建文件与权限

#mkdir /usr/local/squid1/log/logs/store.log

# chown nobody:nobody /usr/local/squid1/log //用户nobody用户和组来运行squid

# mkdir /usr/local/squid1/log/cache //建立squid缓存目录

# chown nobody:nobody /usr/local/squid1/log/cache //同样，给权限

# cd /usr/local/squid/sbin

# ./squid -z //建立缓存目录

# ls /var/spool/squid //查看是否建立成功

#//usr/local/squid1/sbin/squid –s //启动squid

5:开机运行squid

# vi /etc/rc.local

将以下内容添加最下边

ulimit -Hs 65536

ulimit -n 65536

/usr/local/squid/sbin/squid

存盘，退出，完结。

6:iptables 端口映射

iptables -t nat -A PREROUTING -s 192.168.1.225/32 -p tcp --dport 80 -j REDIRECT –to-ports 3128

或:

Vi /etc/sysconfig/iptables添加

-A PREROUTING -s ! 192.168.18.122 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

以下对以上信息解释：

http_port 80 vhost vport=3128

http_port <host>:<port> [transparent] [vhost] [vport[=<port>]] [defaultsite=<host>] ...

配置 Squid 绑定的 HTTP 端口和 IP 地址，默认配置是 http_port 3180.

host 可以是 IP 地址或者主机名，如果指定主机名，Squid 尝试获取主机名对应的 IP 地址。如果没有指定 host, Squid 将绑定所有地址的端口；

配置选项： transparent - 支持透明代理，不能与 vhost / vport 同时设置

vhost - 内容加速器主机

vport - 内容加速器端口，通常与 http_port 相同，可以使用 vport= 设置其他端口defaultsite= - 内容加速器的默认网址

acl apache rep_header Server ^Apache

#

broken_vary_encoding allow apache

cache_mem 2048 MB

#使用内存大小

maximum_object_size 409600 KB

#超过此文件大小的对象将不缓存

minimum_object_size 0 KB

#小于此大小文件将不被缓存

maximum_object_size_in_memory 512 KB

#内存中能缓存的最大文件大小

cache_dir ufs /var/spool/squid 20480 16 256

#缓存目录设置

cache_swap_low 80

#当交换分区利用率到这个百分比，那么开始替换

cache_swap_high 97

#当交换分区利用率到这个百分比，开始大量替换

strip_query_terms off

request_header_max_size 10 kb

request_body_max_size 0 kb

#设置HTTP请求的包头和数据大小

memory_pools on

如果将该项设为on，则squid将保留所有已经分配（但是未使用）的内存池以便在将来使用。

默认为on .

memory_pools on

memory_pools_limit 150 MB

#用来存放请求URL的内存大小

编译squid时加上--enable-follow-x-forwarded-for

然后在squid.conf中输入一行：

follow_x_forwarded_for allow all

后端的Apache取日志（httpd.conf）：

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %h %T" combined

取到的就是用户真实IP