Squid 是功能最豐富的開源代理緩存服務器，支援 HTTP/HTTPS/FTP 代理、透明代理、反向代理、ICP/HTCP 緩存協作。本文聚焦正向代理部署與分級訪問控制。
# RHEL/CentOS/Fedora
dnf install squid -y
# Debian/Ubuntu
apt update && apt install squid -y
# 開機自啟
systemctl enable --now squid# 依賴
dnf install gcc openssl-devel libxml2-devel libcap-devel pam-devel -y
# 下載編譯
wget https://www.squid-cache.org/Versions/v5/squid-5.9.tar.xz
tar xf squid-5.9.tar.xz
cd squid-5.9
./configure --prefix=/usr/local/squid \
--enable-ssl-crtd \
--enable-epoll \
--with-openssl \
--enable-auth-negotiate=kerberos \
--enable-auth-ntlm
make -j$(nproc)
make install# 監聽端口
http_port 3128
# 緩存目錄（ufs/aufs/rock/storeid）
cache_dir ufs /var/spool/squid 10240 16 256
# 緩存內存
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
# 日誌
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
# 基礎 ACL
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16
acl SSL_ports port 443
acl Safe_ports port 80 21 443 70 210 1025-65535
# 訪問控制
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow localnet
http_access deny all# /etc/squid/squid.conf
acl vip_users arp 00:11:22:33:44:55
acl vip_users arp 66:77:88:99:AA:BB
# 或從文件讀取
acl vip_users arp "/etc/squid/vip_macs.txt"# 建立密碼文件
htpasswd -c /etc/squid/passwd user1
htpasswd /etc/squid/passwd user2
# 配置 Basic 認證
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic realm "Corporate Proxy"
auth_param basic children 5 startup=1 idle=2
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl authenticated proxy_auth REQUIRED# 工作時間：週一至週五 09:00-18:00
acl work_hours time MTWHF 09:00-18:00
# 禁止的文件類型
acl blocked_ext urlpath_regex -i \.exe$ \.msi$ \.dmg$ \.apk$ \.iso$ \.torrent$
acl blocked_mime rep_mime_type -i ^application/x-msdownload$ ^application/octet-stream$# 1. 高級用戶：無限制
http_access allow vip_users
# 2. 普通用戶：工作時間 + 認證 + 非禁止類型
http_access allow authenticated work_hours !blocked_ext !blocked_mime
# 3. 拒絕其他
http_access deny all# 生成 CA
openssl req -new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509 \
-keyout /etc/squid/ca.key -out /etc/squid/ca.crt \
-subj "/C=CN/O=MyOrg/CN=Squid CA"
# 初始化 ssl_crtd
/usr/lib64/squid/security_file_certgen -c -s /var/lib/squid/ssl_db -M 4MB
chown -R squid:squid /var/lib/squid/ssl_db# /etc/squid/squid.conf
http_port 3128 ssl-bump cert=/etc/squid/ca.crt key=/etc/squid/ca.key generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
# SSL-Bump 步驟
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
# 允許信任站點不解密（銀行、醫療等）
acl no_ssl_bump dstdomain .bank.com .gov.cn
ssl_bump peek step1 all
ssl_bump peek step2 no_ssl_bump
ssl_bump splice step3 no_ssl_bump
ssl_bump bump all將 ca.crt 分發到客戶端信任存儲（Windows 組策略、macOS Keychain、Linux /etc/pki/ca-trust/source/anchors/ + update-ca-trust）。
# 內存緩存
cache_mem 512 MB
maximum_object_size_in_memory 128 KB
# 磁盤緩存（根據磁盤大小調整）
cache_dir ufs /var/spool/squid 20480 16 256
# 最大/最小緩存對象
maximum_object_size 512 MB
minimum_object_size 0 KB
# 替換策略
cache_replacement_policy heap LFUDA
memory_replacement_policy heap GDSF
# 刷新模式（覆蓋源站 Cache-Control）
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320# firewalld
firewall-cmd --permanent --add-port=3128/tcp
firewall-cmd --reload
# 內核參數優化 /etc/sysctl.d/99-squid.conf
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1
fs.file-max = 1000000
# Squid 進程文件描述符限制
# /etc/systemd/system/squid.service.d/limits.conf
[Service]
LimitNOFILE=65535
LimitNPROC=65535# 即時訪問日誌
tail -f /var/log/squid/access.log
# 統計熱門域名
awk '{print $7}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head -20
# 統計用戶流量
awk '{print $3, $5}' /var/log/squid/access.log | sort | uniq -c | sort -rn
# 慢請求分析
awk '$2 > 5000 {print}' /var/log/squid/access.log| 現象 | 排查步驟 |
|---|---|
| 客戶端無法連接 | 1. systemctl status squid 2. netstat -tlnp | grep 3128 3. 防火牆 4. SELinux audit.log |
| HTTPS 網站打不開 | 1. 未配置 SSL-Bump 2. 客戶端未信任 CA 3. 目標站點 HSTS/HPKP |
| 緩存不生效 | 1. cache_dir 權限 2. refresh_pattern 3. 源站 no-cache |
| CPU 100% | 1. 正則 ACL 過多/複雜 2. ssl_bump 過載 3. 緩存目錄過大 |
| 內存持續增長 | 1. cache_mem 過大 2. memory_replacement_policy 3. 內存洩漏（升級版本） |
Squid 部署核心在於：ACL 精準匹配順序、認證方式選型（Basic/NTLM/Kerberos）、HTTPS 攔截策略（全解密/選擇性/不解密）、緩存參數按流量調優。生產環境建議：啟用 SSL-Bump 但白名單敏感站點、配置分級訪問、監控關鍵指標（命中率、延遲、錯誤率）、定期輪轉日誌。