海运的博客

Stunnel真是个好东西，可以使用SSL加密任意两点间的TCP连接，本文记录使用Stunnel加密Squid代理服务器来代替SSH数据转发。
服务器端配置Squid正向代理：

#https://www.haiyun.me
http_port 127.0.0.1:8080
icp_port 0
visible_hostname proxy.www.haiyun.me
cache_mgr  admin@www.haiyun.me
cache_effective_user squid
cache_effective_group  squid 
via off     
forwarded_for off
acl localnet src 127.0.0.0/24
http_access allow localnet

生成OpenSSL证书：

openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem
chmod 400 stunnel.pem

服务器端Stunnel安装配置：

yum install stunnel

compression=zlib
syslog=no
debug=7
output=/var/log/stunnel.log
setuid=nobody
setgid=nobody
pid=/var/run/stunnel.pid
cert=/etc/stunnel/stunnel.pem
key=/etc/stunnel/stunnel.pem
client=no
[squid]
accept=8000
connect=127.0.0.1:8080

Openwrt下安装配置Stunnel客户端：

opkg update
opkg install stunnel

compression=zlib
syslog=no
debug=7
output=/var/log/stunnel.log
pid=/var/run/stunnel.pid
client=yes
[squid]
accept=8080
connect=www.haiyun.me:8000

客户端服务器端启动Stunnel：

stunnel

此时客户端和Squid代理服务器之间的数据是使用SSL加密的，其它HTTP代理服务器也同样适用此方法，如Kingate代理服务器。

配置文件ACL后添加：

header_access X-Cache deny all
header_access X-Squid-Error deny all
header_access Via deny all
header_access Server deny all
header_access X-Cache deny all
header_access X-Cache-Lookup deny all

其它Header也可隐藏：

Accept         HTTP_ACCEPT
Accept-Charset         HTTP_ACCEPT-CHARSET
Accept-Encoding         HTTP_ACCEPT-ENCODING
Accept-Language         HTTP_ACCEPT-LANGUAGE
Accept-Ranges         HTTP_ACCEPT-RANGES
Age         HTTP_AGE
Allow         HTTP_ALLOW
Authorization         HTTP_AUTHORIZATION
Cache-Control         HTTP_CACHE-CONTROL
Connection         HTTP_CONNECTION
Content-Base         HTTP_CONTENT-BASE
Content-Disposition         HTTP_CONTENT-DISPOSITION
Content-Encoding         HTTP_CONTENT-ENCODING
Content-Language         HTTP_CONTENT-LANGUAGE
Content-Length         HTTP_CONTENT-LENGTH
Content-Location         HTTP_CONTENT-LOCATION
Content-MD5         HTTP_CONTENT-MD5
Content-Range         HTTP_CONTENT-RANGE
Content-Type         HTTP_CONTENT-TYPE
Cookie         HTTP_COOKIE
Date         HTTP_DATE
ETag         HTTP_ETAG
Expires         HTTP_EXPIRES
From         HTTP_FROM
Host         HTTP_HOST
If-Match         HTTP_IF-MATCH
If-Modified-Since         HTTP_IF-MODIFIED-SINCE
If-None-Match         HTTP_IF-NONE-MATCH
If-Range         HTTP_IF-RANGE
Last-Modified         HTTP_LAST-MODIFIED
Link         HTTP_LINK
Location         HTTP_LOCATION
Max-Forwards         HTTP_MAX-FORWARDS
Mime-Version         HTTP_MIME-VERSION
Pragma         HTTP_PRAGMA
Proxy-Authenticate         HTTP_PROXY-AUTHENTICATE
Proxy-Authentication-Info         HTTP_PROXY-AUTHENTICATION-INFO
Proxy-Authorization         HTTP_PROXY-AUTHORIZATION
Proxy-Connection         HTTP_PROXY-CONNECTION
Public         HTTP_PUBLIC
Range         HTTP_RANGE
Referer         HTTP_REFERER
Request-Range         HTTP_REQUEST-RANGE
Retry-After         HTTP_RETRY-AFTER
Server         HTTP_SERVER
Set-Cookie         HTTP_SET-COOKIE
Title         HTTP_TITLE
Transfer-Encoding         HTTP_TRANSFER-ENCODING
Upgrade         HTTP_UPGRADE
User-Agent         HTTP_USER-AGENT
Vary         HTTP_VARY
Via         HTTP_VIA
Warning         HTTP_WARNING
WWW-Authenticate         HTTP_WWW-AUTHENTICATE
Authentication-Info         HTTP_AUTHENTICATION-INFO
X-Cache         HTTP_X-CACHE
X-Cache-Lookup         HTTP_X-CACHE-LOOKUP
X-Forwarded-For         HTTP_X-FORWARDED-FOR
X-Request-URI         HTTP_X-REQUEST-URI
X-Squid-Error         HTTP_X-SQUID-ERROR
Negotiate         HTTP_NEGOTIATE
X-Accelerator-Vary         HTTP_X-ACCELERATOR-VARY
Other:         HTTP_OTHER:

Squid3.0版本使用参数：

reply_header_access Server deny all
reply_header_access X-Cache deny all
reply_header_access Warning deny all
reply_header_access Expires deny all
reply_header_access Cache-Control deny all
reply_header_access age deny all

参考：http://bbs.linuxtone.org/thread-131-1-1.html

在Openwrt下使用USB外挂存储磁盘IO会成为瓶颈，如果带宽足够纯粹做为透明代理可以关闭磁盘缓存功能。
1.修改缓存策略为null

cache_dir null /tmp

2.或者定义禁止缓存GET请求：

acl NCACHE method GET
no_cache deny NCACHE

3.缓存到/dev/shm目录，相当于ramdisk，openwrt无此设备。

cache_dir ufs /mnt/cache 256 16 256

架设Squid代理服务器为防止别人扫描到后滥用，可配置Squid基于用户认证方式代理上网。
1.创建密钥认证文件：

htpasswd -c /etc/squid/passwd user

2.使用ncsa_auth认证，编辑squid配置文件添加：

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/passwd
acl auth_user proxy_auth REQUIRED
http_access allow ncsa_users
http_access deny all

重新加载配置文件生效：

squid -k reconfig

版本：Squid Cache: Version 3.1.10

http_port 80 vhost vport
icp_port 0
visible_hostname proxy.www.haiyun.me
cache_mgr  support@www.haiyun.me
cache_effective_user squid
cache_effective_group  squid 
cache_access_log /cache/access.log
cache_log /cache/cache.log
cache_dir ufs /cache/ 2048 16 256
cache_mem 64 MB
maximum_object_size 4096 KB
minimum_object_size 0 KB
maximum_object_size_in_memory 256 KB
forwarded_for on 

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

hierarchy_stoplist cgi-bin ?
hierarchy_stoplist -i ^https:\\ ? 
acl QUERY urlpath_regex -i cgi-bin \? \.php \.xml \.jsp \.js \.do
acl denyssl urlpath_regex -i ^https:\\ 
acl dy_cache urlpath_regex asp\?
acl dy_cache urlpath_regex aspx\?
acl dy_cache urlpath_regex php\?
acl dy_cache urlpath_regex jsp\?
no_cache deny QUERY
no_cache deny denyssl
no_cache deny dy_cache

cache_peer cp.www.haiyun.me parent 80 0 no-query originserver name=cp
cache_peer_domain cp cp.www.haiyun.me
cache_peer_access cp allow all
cache_peer www.haiyun.me parent 80 0 no-query originserver name=www
cache_peer_domain www www.haiyun.me
cache_peer_access www allow all
#always_direct allow all
http_access allow all 

refresh_pattern -i \.css$ 1440 50% 129600 reload-into-ims 
refresh_pattern -i \.xml$ 1440 50% 129600 reload-into-ims
refresh_pattern -i \.htm$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.html$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.shtml$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.png$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.jpg$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.jpeg$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.gif$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.bmp$ 1440 90% 129600 reload-into-ims
refresh_pattern -i \.js$ 1440 90% 129600 reload-into-ims
 
refresh_pattern -i \.mp3$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.wmv$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.rm$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.swf$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.mpeg$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.wma$ 1440 50% 2880 ignore-reload
 
refresh_pattern -i \.exe$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.rar$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.zip$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.gz$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.bz2$ 1440 50% 2880 ignore-reload
refresh_pattern -i \.7z$ 1440 50% 2880 ignore-reload

#隐藏head信息,2.x版本使用header_access
reply_header_access Via deny all
reply_header_access Cache-Control deny all
reply_header_access Server deny all
reply_header_access X-Cache deny all
reply_header_access X-Cache-Lookup deny all
reply_header_access X-Squid-Error deny all
reply_header_access X-Forwarded-For deny all
request_header_access Via deny all
request_header_access Age deny all
request_header_access X-Squid-Error deny all
request_header_access Pragma deny all
#request_header_access X-Forwarded-For deny all