- CentOS5主機安裝Squid 3.1
上http://rpm.pbone.net搜尋下載squid3-3.1.8-1.el5.pp.i386.rpm
[root@centos5]# rpm –Uvh squid3-3.1.8-1.el5.pp.i386.rpm
修改 /etc/squid/squid.conf (只列出重點設定)
#上層伺服器
cache_peer proxy.hinet.net parent 80 0 no-query no-digest no-netdb-exchange
#將連到youtube.com要求轉發給上層伺服器
cache_peer_domain proxy.hinet.net .youtube.com
#預設存取設定
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
# ACL for Youtube
acl youtube dstdomain .youtube.com
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# 讓Youtube 使用上層, 其餘由squid本身直接存取
never_direct allow youtube
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
# ssl代理
ssl_bump deny localhost
ssl_bump allow all
http_access deny all
# 透通代理http
http_port 3128 intercept
# 透通代理https.基本上不建議在透通模式下啟用.必須置換憑證以解密ssl流量, 因此需要正式憑證, 若使用測試憑證client端會跳出此網站不安全的訊息
https_port 3129 intercept ssl-bump cert=/etc/pki/tls/certs/testcert.pem
hierarchy_stoplist cgi-bin ?
# 將儲存區上限改為1gb.
cache_dir ufs /var/cache/squid 1000 16 256
coredump_dir /var/cache/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
#ICAP設定
icap_enable on
icap_preview_enable on
icap_preview_size 128
icap_send_client_ip on
icap_service service_avi_req reqmod_precache 0 icap://localhost:1344/srv_clamav
icap_service service_avi respmod_precache 1 icap://localhost:1344/srv_clamav
adaptation_access service_avi_req allow all
adaptation_access service_avi allow all
#將錯誤顯示頁面設為中文
error_default_language zh-tw
設定開機即啟用服務
[root@centos5]# chkconfig –add –level 2345 squid
- 設定iptables
加入規則
[root@centos5]# iptables -A PREROUTING -i eth0 -p tcp -m tcp -m multiport tcp -d 10.0.0.2 –dport 80,443 -j ACCEPT
[root@centos5]# iptables -A PREROUTING -i eth0 -p tcp -m tcp ! -d localhost –dport 80 -j REDIRECT –to-port 3128
[root@centos5]# iptables -A PREROUTING -i eth0 -p tcp -m tcp ! -d localhost –dport 443 -j REDIRECT –to-port 3129
Squid伺服器本身有提供Web服務, 因此第一行需放行目的為本機IP的TCP 80,443封包, 第二行將連往網際網路TCP 80的封包重新導向Squid服務的TCP 3128. 第三行則將連往網際網路TCP 443的封包重新導向Squid服務的TCP 3129.
啟動並儲存規則
[root@centos5]# service iptables start
[root@centos5]# iptables-save > /etc/sysconfig/iptables
[root@centos5]# chkconfig –add –level 2345 iptables
- 設定NetScreen
PBR流程
3-1. 建立兩個acl存取名單. 第一組為來源IP是區域網路封包目標為網際網路網頁存取.第二組則為Squid伺服器本身的網際網路存取, 避免本身連向網路封包變成迴圈. CLI (指令模式)
set access-list extended 1 src-ip 10.0.0.0/24 dst-port 80-80 protocol tcp entry 1
set access-list extended 1 src-ip 10.0.0.0/24 dst-port 443-443 protocol tcp entry 2
set access-list extended 2 src-ip 10.0.0.2/32 dst-port 80-80 protocol tcp entry 1
set access-list extended 2 src-ip 10.0.0.2/32 dst-port 443-443 protocol tcp entry 2
3-2. 第一組acl加入Http_Traffic群組(match-group), 第二組acl則加入Direct_Http_Traffic群組(match-group). CLI (指令模式)
set match-group name Direct_Http_Traffic
set match-group Direct_Http_Traffic ext-acl 2 match-entry 1
set match-group name Http_Traffic
set match-group Http_Traffic ext-acl 1 match-entry 1
3-3. Tproxy的執行動作設定為當符合Http_Traffic群組的封包到達時直接送往Squid伺服器(10.0.0.2). Direct_Http則將符合Direct_Http_Traffic群組送往untrust介面(eth3). CLI (指令模式)
set action-group name Tproxy
set action-group Tproxy next-hop 10.0.0.2 action-entry 1
set action-group name Direct_Http
set action-group Direct_Http next-interface ethernet3 action-entry 1
3-4. 建立政策(policy). 第一個先讓Squid本機連往網際網路, 若為其他客戶端則為順序2, 轉到Squid主機..
set pbr policy name trust_policy
set pbr policy trust_policy match-group Direct_Http_Traffic action-group Direct_Http 1
set pbr policy trust_policy match-group Http_Traffic action-group Tproxy 2
set pbr trust_policy
exit
3-5. 將政策連結到trust介面(eth1).CLI (指令模式)
set interface ethernet1 pbr trust_policy
- 安裝Clamav
#搭配MailScanner 因此安裝 Clamd
[root@centos5]# yum install clamav clamav-db clamd
- 安裝c-icap
上http://rpm.pbone.net搜尋下載c-icap , c-icap-modules的source rpm回來編譯
[root@centos5]# rpmbuild –rebuild c-icap-0.1.1-1.el5.pp.src.rpm
編譯完成後會有多個檔案主要安裝下面幾個
c-icap-0.1.1-1.el5.pp.i386.rpm # c-icap主程式
c-icap-libs-0.1.1-1.el5.pp.i386.rpm # library
c-icap-progs-0.1.1-1.el5.pp.i386.rpm # client程式
c-icap-devel-0.1.1-1.el5.pp.i386.rpm # 編譯c-icap-modules用
下載的c-icap-modules並無開啟clamv, 需自行修改並編譯
[root@centos5]# rpmbuild -i c-icap-modules-0.1.1-1.el5.pp.src.rpm
[root@centos5]# cd /usr/src/redhat/SPECS
更改c-icap-modules.spec檔案, 註釋掉」–without-clamav」
CFLAGS=”${RPM_OPT_FLAGS} -fno-strict-aliasing” \
–enable-shared \
–with-bdb
# –without-clamav # Still not in RedHat/CentOS
重編
[root@centos5]# rpmbuild -bb c-icap-modules-0.1.1-1.el5.pp.src.rpm
[root@centos5]# cd ../RPMS/i386
[root@centos5]# rpm –Uvh c-icap-modules-0.1.1-1.el5.rpm
修改c-icap server設定 /etc/c-icap/c-icap.conf
PidFile /var/run/c-icap/c-icap.pid
CommandsSocket /var/run/c-icap/c-icap.ctl
Timeout 300
MaxKeepAliveRequests 100
KeepAliveTimeout 600
StartServers 3
MaxServers 10
MinSpareThreads 10
MaxSpareThreads 20
ThreadsPerChild 10
MaxRequestsPerChild 0
Port 1344
ServerAdmin 你的管理員郵件
ServerName 你的主機名稱
TmpDir /var/tmp
MaxMemObject 131072
DebugLevel 1
ModulesDir /usr/lib/c_icap
ServicesDir /usr/lib/c_icap
TemplateDir /usr/share/c_icap/templates/
TemplateDefaultLanguage en
LoadMagicFile /etc/c-icap/c-icap.magic
RemoteProxyUsers off
RemoteProxyUserHeader X-Authenticated-User
RemoteProxyUserHeaderEncoded on
#本機存取位址
acl localhost src 127.0.0.1/255.255.255.255
#所有位置
acl all src 0.0.0.0/0.0.0.0
#允許本機存取
icap_access allow localhost
#拒絕所有存取
icap_access deny all
#Log檔位置
ServerLog /var/log/c-icap/server.log
AccessLog /var/log/c-icap/access.log
#以下三行設定病毒紀錄檔格式及位置
acl VIRUS icap_resp_header{X-Infection-Found} /Type=.*/
LogFormat viruslog “%tl, %>a %im %iu %is %{X-Infection-Found}<ih:”
AccessLog /var/log/c-icap/viruses.log viruslog VIRUS
Service echo srv_echo.so
#開啟clamav模組掃瞄功能
Include srv_clamav.conf
修改c-icap-modules設定, 基本上維持預設值即可
Service antivirus_module srv_clamav.so
ServiceAlias avscan srv_clamav?allow204=on&sizelimit=off&mode=simple
srv_clamav.ScanFileTypes TEXT DATA EXECUTABLE ARCHIVE GIF JPEG MSOFFICE
srv_clamav.SendPercentData 5
srv_clamav.StartSendPercentDataAfter 2M
srv_clamav.MaxObjectSize 5M
srv_clamav.ClamAvTmpDir /var/tmp
srv_clamav.ClamAvMaxFilesInArchive 0
srv_clamav.ClamAvMaxFileSizeInArchive 100M
srv_clamav.ClamAvMaxRecLevel 5
此rpm所提供的init script以c-icap身份啟動, 經測試無法正常啟動.改以root啟動卻無問題, 因此修改/etc/sysconfig/c-icap
#改掉下面這行, 將使用者改為root
#RUN_AS=”c-icap”
RUN_AS=”root”
也可以到官網http://c-icap.sourceforge.net 下載最新0.1.2版自行安裝, 但原始package並未包含init script/syconfig/logrotate檔.
設定開機啟動
[root@centos5]# chkconfig –add –level 2345 c-icap
- 啟動相關服務
[root@centos5]# service c-icap start
[root@centos5]# service squid start
- 測試掃毒功能
[root@centos5]# c-icap-client -f /path_to_clamav/test/clam.exe -s “srv_clamav?allow204=on&force=on&sizelimit=off&mode=simple”
ICAP server:localhost, ip:127.0.0.1, port:1344
<html>
<head>
<!–C-ICAP/0.1.2 srvClamAV module –>
</head>
<body>
<H1>VIRUS FOUND</H1> You try to upload/download a file that contain the virus<br>
ClamAV-Test-File
<p>This message generated by C-ICAP/0.1.2 srvClamAV/antivirus module
<!– And this is a silly HTML comment just to make this error bigger than 512 bytes
is allowed to be displayed in IE. Yes, IE has a “feature” which does not allow
error messages smaller than 512 bytes to be displayed, because they are not considered
“friendly” enough.
(Hmm…I think this stupid comment is better than embedding viruses or porn images in this error message like a bad guy suggested me!)–> </body>
顯示掃到毒(clamav原始package內附的樣本)
- 結論：大致上需要的功能皆已完成, Squid部份可以進行校調以增加cache命中率.
