OPTIMIZAR SQUID + DELAYS_POOLS + SQUISH

Transcripción

1 OPTIMIZAR SQUID + DELAYS_POOLS + SQUISH Existen muchas maneras de usar el squid para mejorar el rendimiento y gestion de la cache, pero existen muchos interrogantes en cuanto a mejorar la navegacion en sitios como youtube, yahoo, etc... Pues aqui esta una configuracion de squid que permite cachear al max todo lo que se navega, limitar tanto el ancho de banda y el tiempo. http_port 3128 # OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM hierarchy_stoplist cgi-bin? acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY # OPTIONS WHICH AFFECT THE CACHE SIZE cache_mem bytes cache_swap_low 98 cache_swap_high 99 maximum_object_size bytes maximum_object_size_in_memory bytes ipcache_size 4096 ipcache_low 98 ipcache_high 99 fqdncache_size 2096 cache_replacement_policy heap LFUDA memory_replacement_policy heap GDSF # LOGFILE PATHNAMES AND CACHE DIRECTORIES cache_dir ufs /var/spool/squid access_log /var/log/squid/access.log squid cache_log none cache_store_log none # OPTIONS FOR TUNING THE CACHE request_header_max_size KB request_body_max_size 0 KB refresh_pattern -i ^ftp: % override-expire overridelastmod reload-into-ims ignore-no-cache ignore-private ignore-auth 1/9

2 refresh_pattern -i ^http: % override-expire overridelastmod reload-into-ims ignore-no-cache ignore-private ignore-auth refresh_pattern -i ^gopher: % override-expire overridelastmod reload-into-ims ignore-no-cache ignore-private ignore-auth refresh_pattern -i % override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private ignore-auth quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 100 read_ahead_gap bytes negative_ttl 0 seconds positive_dns_ttl seconds negative_dns_ttl 1 seconds range_offset_limit 0 bytes # TIMEOUTS forward_timeout 240 seconds connect_timeout 60 seconds peer_connect_timeout 30 seconds read_timeout 900 seconds request_timeout 120 seconds persistent_request_timeout 60 seconds client_lifetime 7200 seconds half_closed_clients off pconn_timeout 60 seconds shutdown_lifetime 20 seconds # SQUIDGUARD redirect_program /usr/bin/squidguard -c /etc/squid/squidguard.conf redirect_children 1 # AUTH REQUIRED auth_param basic program /usr/lib/squid/ldap_auth -b "cn=users,dc=midominio,dc=cu" acl auth proxy_auth REQUIRED # SQUISH (QUOTA) acl SQUISHLOC url_regex \.mydomain\.cu acl SQUISHED1 proxy_auth -i "/etc/squid/squished" deny_info SQUISHED1 http_access allow SQUISHLOC # ACCESS CONTROLS 2/9

3 acl all src / acl manager proto cache_object acl localhost src / acl SSL_ports port acl Safe_ports port acl purge method PURGE acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny!safe_ports http_access deny CONNECT!SSL_ports # ACCESS CONTROLS MY SERVER acl server-ip src acl director src acl redlocal src acl jornada time SMTWHFA 08:00-16:40 acl denysite url_regex -i 'c:/squid/etc/denysite' acl allowsite url_regex -i 'c:/squid/etc/allowsite' http_access allow server-ip http_access allow director jornada http_access deny denysite!allowsite http_access allow redlocal jornada auth http_access deny all always_direct allow all never_direct deny all # NO CACHE acl urlnocache url_regex -i mydomain.cu htm mht hta htc zips bases update upgrade upload virus no_cache deny urlnocache # INFO ADMIN SERVER cache_mgr admin@mydomain.cu visible_hostname proxy.mydomain.cu # SECURITY header_access From deny all 3/9

4 header_access User-Agent deny all header_access Via deny all header_access X-Forwarded-For deny all header_access Accept-Language deny all header_replace User-Agent Mozilla/5.0 (X11; U; Linux i686; es-es; rv: ) header_replace Via header_replace X-Forwarded-For header_replace Accept-Language es,en http_reply_access allow all icp_access allow all miss_access allow all reply_header_max_size bytes reply_body_max_size 0 allow all # MISCELLANEOUS logfile_rotate 0 memory_pools on forwarded_for off log_icp_queries off icp_hit_stale on dns_testnames localhost icon_directory /usr/share/squid/icons error_directory /usr/share/squid/errors/spanish nonhierarchical_direct off prefer_direct off pipeline_prefetch on store_dir_select_algorithm round-robin vary_ignore_expire on emulate_httpd_log off offline_mode off ie_refresh on # DELAY POOLS delay_pools 3 delay_class 1 3 delay_class 2 3 delay_class 3 3 delay_parameters 1-1/-1-1/-1-1/-1 delay_parameters / / /9000 delay_parameters / / /4125 delay_access 1 allow server-ip delay_access 2 allow director delay_access 3 allow redlocal delay_access 4 deny all 4/9

5 # Para los que desean empesar a usar squid desde windows una modificacion del ejemplo anterior... cache_dir ufs d:/squid/var/cache coredump_dir d:/squid/var/cache access_log c:/squid/var/logs/access.log squid acl denysite url_regex -i 'c:/squid/etc/denysite' acl allowsite url_regex -i 'c:/squid/etc/allowsite' icon_directory c:/squid/share/icons error_directory c:/squid/share/errors/spanish # Aqui les muestro diferentes maneras de restringir # Red para las restrinciones acl redlan src # Restringe el acceso libre (solicita autentificacion) auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/passwd # - Debian - LDAP auth_param basic program /usr/lib/squid/ldap_auth -b "ou=users,dc=mydomain,dc=cu" # - Centos - LDAP auth_param basic program /usr/lib/squid/squid_ldap_auth -b "ou=users,dc=mydomain,dc=cu" acl auth proxy_auth REQUIRED http_access allow redlan auth # Restringe el acceso a sitios o contenidos acl denysites url_regex -i '/etc/squid/denysites' acl allowsites url_regex -i '/etc/squid/allowsites' http_access allow redlan allowsites!denysites # Restringe el acceso de descargas acl denyfiles urlpath_regex -i \.avi$ \.mp4$ \.mp3$ \.mpg$ \.mpeg$ \.mov$ \.ram$ \.vob$ http_access allow redlan!denyfiles # Restringe la cantidad de conexiones (Limita -> IDA, DAP, downthemall, etc) acl file urlpath_regex -i \.avi$ \.mp4$ \.mp3$ \.mpg$ \.mpeg$ \.mov$ \.ram$ \.vob$ acl maxcon maxconn 6 http_access deny file maxcon http_access allow redlan # Restringe el acceso por horario acl jornada time SMTWHFA 08:00-16:40 http_access allow redlan jornada # Restringe el acceso por dominios 5/9

6 acl dominio dstdomain.cu http_access allow redlan dominio # Restringe el acceso de MAC address acl denymac arp 00:00:00:00:00:00 http_access allow redlan!denymac # Restringe el ancho de banda a utilizar ( P2P), by Ecualug, falcom delay_pools 2 delay_class 1 2 delay_class 2 2 delay_parameters 1-1/-1-1/-1 delay_parameters / /4096 delay_access 1 allow server delay_access 2 allow redlan # TABLA DE EQUIVALENCIAS #2048 B ==> 16 kb ==> 2KB #4096 B ==> 32 kb ==> 4KB #8192 B ==> 64 kb ==> 8KB #16384 B ==> 128kb ==> 16KB #32768 B ==> 256Kb ==> 32KB #65536 B ==> 512Kb ==> 64KB # B ==> 1 Mb ==> 128KB # B ==> 1.5 Mb ==> 192KB # B ==> 2 Mb ==> 256KB # Other Example, by Ecualug ( RazaMetaL) Supongamos que tenemos contratados 512kbps con un proveedor de Internet y queremos que de ese ancho de banda 384kbps (48Kb/s) sean destinados para los video fanaticos de youtube, así aseguro ancho de banda para que los demás mortales no se quejen de la lentitud. delay_pools 1 delay_class 1 1 delay_parameters /65000 acl formatos_video urlpath_regex -i "/etc/squid/formatos_video" acl sitios_video url_regex -i "/etc/squid/sitios_video" delay_access 1 allow sitios_video delay_access 1 allow formatos_video # Optimizacion de Squid, by Ecualug ( eldany76) #optimizar y arreglar consultas a sitios como hotmail,yahoo,etc. hierarchy_stoplist cgi-bin \? acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY #Mejorar la forma de reemplazar objetos antiguos cache_swap_low 90 cache_swap_high /9

7 #Aprovechar espacio en el disco maximum_object_size 8192 KB minimum_object_size 3 KB #No llenar la memoria con archivos grandes maximum_object_size_in_memory 96 KB #Cachear mayor cantidad de datos IP ipcache_size fqdncache_size #No gastar procesador ni memoria en registros log cache_access_log none cache_log none cache_store_log none #Eliminar conexiones sin cerrar half_closed_clients off #Ocultar ip interno del cliente o usuario forwarded_for off #Disponemos de 512b de RAM cache_mem 480 MB cache_dir aufs /var/squid #Cambiar algoritmos de actualizacion para ahorrar ancho de banda refresh_pattern ^http: % refresh_pattern ^ftp: % refresh_pattern ^gopher: % refresh_pattern % #Conviene no tocar lo dado por Squid acl all src / acl manager proto cache_object acl localhost src / acl to_localhost dst /8 acl SSL_ports port acl Safe_ports port 80 #http acl Safe_ports port 21 #ftp acl Safe_ports port #https, snees acl Safe_ports port 70 #Gopher acl Safe_ports port 210 #wais acl Safe_ports port #unregistered ports acl Safe_ports port 280 #http-mgmt acl Safe_ports port 488 #gss-http acl Safe_ports port 591 #filemarker acl Safe_ports port 777 #multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny!safe_ports 7/9

8 http_access deny CONNECT!SSL_ports #Dejamos usar el cache solo en nuestra red acl usuarios src / http_access allow usuarios http_access deny all http_reply_access allow all icp_access allow all SQUID con SQUISH By JovenClub [Sarbelio Moa], Rimed [wilfredo vcl, Ariel cfg] # Libreria necesaria aptitude install libtemplate-perl # Descargar el paquete y descomprimirlo wget -P /usr/local tar.gz? cd /usr/local tar -vzxf /usr/local/squish tar.gz rm /usr/local/squish tar.gz mv /usr/local/squish /usr/local/squish chown -R root.root /usr/local/squish # Creamos el fichero squished (vacio) touch /etc/squid/squished # Copie el fichero squish.conf cp /usr/local/squish/squish.conf /etc/squid/squish.conf # Agrege estas lineas al squid.conf nano /etc/squid/squid.conf # SQUISH (QUOTA) acl SQUISHLOC url_regex \.mydomain\.cu acl SQUISHED1 proxy_auth -i "/etc/squid/squished" deny_info SQUISHED1 http_access allow SQUISHLOC - - # Establecer las cuotas cat > /etc/squid/squish.conf << "EOF" usuario1 150Mb/month usuario2 100Mb/month usuario3 50Mb/month EOF 8/9

9 # Crear un virtualhost llamado "proxy" y el host activo en el DNS cat > /etc/apache2/sites-enabled/proxy << "EOF" <VirtualHost *:80> ServerName proxy.mydomain.cu DocumentRoot /usr/local/squish <Directory "/usr/local/squish/"> Options +ExecCGI AddHandler cgi-script.cgi DirectoryIndex squish.cgi AllowOverride None Order allow,deny Allow from all </Directory> ServerSignature On LogLevel warn ErrorLog /var/log/apache2/error.log CustomLog /var/log/apache2/proxy_access.log combined </VirtualHost> EOF # Automatizacion crontab -e */5 * * * * /usr/local/squish/squish.cron.sh NOTA: La DB se almacena en ( /var/lib/squish ) Salud2s... Comunidad Virtual de Filosofía Cuba 9/9