Table of Contents
In this article, I will take you through the Steps to Install and configure Squid Proxy Server on RHEL/CentOS 7/8. You might face a situation where you have some server in private network which is not allowed to access anything on public network and suddenly you have some requirements like you need to update the Server immediately using yum tool. This can be easily done by using proxy server.
Also if you want to restrict or block some URLs you can do it through proxy server. Squid is an open source proxy software for the web supporting http, https, ftp and more. It is used by hundreds of Internet Providers and Organizations across the globe due to its high performance. More on Squid Proxy Official Documentation.
Install and Configure Squid Proxy Server
Also Read: 11 Best Python OS Modules Examples on Linux
Step 1: Prerequisites
a) You need to have a running RHEL/CentOS 7/8
System.
b) You should have yum
tool installed in your Server. You can check Top 22 YUM command examples in RedHat/CentOS 7 to know more about yum
command.
c) You need to have root
or sudo
access to run privileged commands. Please Check How to Add User to Sudoers to know more about providing sudo
access to the User.
d) You should have httpd-tools
package installed in your Server. If it is not installed then you can use yum install httpd-tools -y
command to install this package.
Step 2: Update Your Server
Before going through the steps to install and configure squid proxy server on RHEL/CentOS 7/8
, it is always recommended to first update your server by using yum update -y
command as shown below.
[root@localhost ~]# yum update -y Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.piconets.webwerks.in * epel: download.nus.edu.sg * extras: mirrors.piconets.webwerks.in * updates: mirrors.piconets.webwerks.in Resolving Dependencies --> Running transaction check ---> Package ansible.noarch 0:2.9.10-1.el7 will be updated ---> Package ansible.noarch 0:2.9.14-1.el7 will be an update ---> Package ca-certificates.noarch 0:2019.2.32-76.el7_7 will be updated ---> Package ca-certificates.noarch 0:2020.2.41-70.0.el7_8 will be an update ---> Package curl.x86_64 0:7.29.0-57.el7 will be updated ---> Package curl.x86_64 0:7.29.0-57.el7_8.1 will be an update ---> Package dbus.x86_64 1:1.10.24-13.el7_6 will be updated ---> Package dbus.x86_64 1:1.10.24-14.el7_8 will be an update ---> Package dbus-libs.x86_64 1:1.10.24-13.el7_6 will be updated ---> Package dbus-libs.x86_64 1:1.10.24-14.el7_8 will be an update ---> Package grub2.x86_64 1:2.02-0.81.el7.centos will be updated ---> Package grub2.x86_64 1:2.02-0.86.el7.centos will be an update ---> Package grub2-common.noarch 1:2.02-0.81.el7.centos will be updated ---> Package grub2-common.noarch 1:2.02-0.86.el7.centos will be an update ---> Package grub2-pc.x86_64 1:2.02-0.81.el7.centos will be updated ---> Package grub2-pc.x86_64 1:2.02-0.86.el7.centos will be an update ---> Package grub2-pc-modules.noarch 1:2.02-0.81.el7.centos will be updated ---> Package grub2-pc-modules.noarch 1:2.02-0.86.el7.centos will be an update ---> Package grub2-tools.x86_64 1:2.02-0.81.el7.centos will be updated ---> Package grub2-tools.x86_64 1:2.02-0.86.el7.centos will be an update ---> Package grub2-tools-extra.x86_64 1:2.02-0.81.el7.centos will be updated
Step 3: Install Squid Proxy Server
After successful updation you can now install squid package by using yum install squid -y
command as shown below. This command will check the package dependencies and will install squid packages along with its dependencies.
[root@localhost ~]# yum install squid -y Resolving Dependencies --> Running transaction check ---> Package squid.x86_64 7:3.5.20-15.el7_8.1 will be installed --> Processing Dependency: squid-migration-script for package: 7:squid-3.5.20-15.el7_8.1.x86_64 --> Processing Dependency: perl(Digest::MD5) for package: 7:squid-3.5.20-15.el7_8.1.x86_64 --> Processing Dependency: libecap.so.3()(64bit) for package: 7:squid-3.5.20-15.el7_8.1.x86_64 --> Running transaction check ---> Package libecap.x86_64 0:1.0.0-1.el7 will be installed ---> Package perl-Digest-MD5.x86_64 0:2.52-3.el7 will be installed --> Processing Dependency: perl(Digest::base) >= 1.00 for package: perl-Digest-MD5-2.52-3.el7.x86_64 ---> Package squid-migration-script.x86_64 7:3.5.20-15.el7_8.1 will be installed --> Running transaction check ---> Package perl-Digest.noarch 0:1.17-245.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ======================================================================================================================================================================== Package Arch Version Repository Size ======================================================================================================================================================================== Installing: squid x86_64 7:3.5.20-15.el7_8.1 updates 3.1 M Installing for dependencies: libecap x86_64 1.0.0-1.el7 base 21 k perl-Digest noarch 1.17-245.el7 base 23 k perl-Digest-MD5 x86_64 2.52-3.el7 base 30 k squid-migration-script x86_64 7:3.5.20-15.el7_8.1 updates 50 k Transaction Summary ======================================================================================================================================================================== Install 1 Package (+4 Dependent packages) Total download size: 3.3 M Installed size: 11 M Downloading packages: (1/5): perl-Digest-1.17-245.el7.noarch.rpm | 23 kB 00:00:00 (2/5): libecap-1.0.0-1.el7.x86_64.rpm | 21 kB 00:00:00 (3/5): perl-Digest-MD5-2.52-3.el7.x86_64.rpm | 30 kB 00:00:00 (4/5): squid-migration-script-3.5.20-15.el7_8.1.x86_64.rpm | 50 kB 00:00:00 (5/5): squid-3.5.20-15.el7_8.1.x86_64.rpm | 3.1 MB 00:00:00 ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Total 2.2 MB/s | 3.3 MB 00:00:01 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : 7:squid-migration-script-3.5.20-15.el7_8.1.x86_64 1/5 Installing : libecap-1.0.0-1.el7.x86_64 2/5 Installing : perl-Digest-1.17-245.el7.noarch 3/5 Installing : perl-Digest-MD5-2.52-3.el7.x86_64 4/5 Installing : 7:squid-3.5.20-15.el7_8.1.x86_64 5/5 Verifying : perl-Digest-1.17-245.el7.noarch 1/5 Verifying : perl-Digest-MD5-2.52-3.el7.x86_64 2/5 Verifying : libecap-1.0.0-1.el7.x86_64 3/5 Verifying : 7:squid-3.5.20-15.el7_8.1.x86_64 4/5 Verifying : 7:squid-migration-script-3.5.20-15.el7_8.1.x86_64 5/5 Installed: squid.x86_64 7:3.5.20-15.el7_8.1 Dependency Installed: libecap.x86_64 0:1.0.0-1.el7 perl-Digest.noarch 0:1.17-245.el7 perl-Digest-MD5.x86_64 0:2.52-3.el7 squid-migration-script.x86_64 7:3.5.20-15.el7_8.1 Complete!
Step 4: Check Squid version
If you want to check the squid version then you need to use squid -v
command as shown below. As you can see from below output current squid version is 3.5.20
.
[root@localhost ~]# squid -v Squid Cache: Version 3.5.20 Service Name: squid configure options: '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-eui' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,SMB_LM,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos' '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group,kerberos_ldap_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl-crtd' '--enable-storeio=aufs,diskd,rock,ufs' '--enable-wccpv2' '--enable-esi' '--enable-ecap' '--with-aio' '--with-default-user=squid' '--with-dl' '--with-openssl' '--with-pthreads' '--disable-arch-native' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fpie' 'LDFLAGS=-Wl,-z,relro -pie -Wl,-z,relro -Wl,-z,now' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fpie' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
Step 5: Start and Enable Squid Proxy Service
Once squid installation is successful you need to start the service by using systemctl start squid
command as shown below.
[root@localhost ~]# systemctl start squid
In the next step, you need to enable the service by using systemctl enable squid
command. This will enable the service to start at the boot time.
[root@localhost ~]# systemctl enable squid Created symlink from /etc/systemd/system/multi-user.target.wants/squid.service to /usr/lib/systemd/system/squid.service.
Then you can check the service running status by using systemctl status squid
command. As you can see below, service is currently active and running fine. If you see any error in the status then you can use systemctl status squid -l
command to check more about the error.
[root@localhost ~]# systemctl status squid ● squid.service - Squid caching proxy Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled) Active: active (running) since Sun 2020-10-25 07:30:26 EDT; 12s ago Main PID: 11680 (squid) CGroup: /system.slice/squid.service ├─11680 /usr/sbin/squid -f /etc/squid/squid.conf ├─11682 (squid-1) -f /etc/squid/squid.conf └─11683 (logfile-daemon) /var/log/squid/access.log Oct 25 07:30:26 localhost systemd[1]: Starting Squid caching proxy... Oct 25 07:30:26 localhost systemd[1]: Started Squid caching proxy. Oct 25 07:30:26 localhost squid[11680]: Squid Parent: will start 1 kids Oct 25 07:30:26 localhost squid[11680]: Squid Parent: (squid-1) process 11682 started
Step 6: Configure Squid Proxy Server
If you want to access this proxy server from a specific source then you need to add that source network in squid.conf
file as shown below. Here we are adding 192.168.12.0/24
source network to allow the squid proxy server access.
[root@localhost ~]# vi /etc/squid/squid.conf # # Recommended minimum configuration: # # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 192.168.12.0/24 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT
After adding the source network in the above configuration file, you need to restart the squid proxy service using systemctl restart squid
command to update the changes.
[root@localhost ~]# systemctl restart squid
Step 7: Test Squid Proxy Server
To test the squid proxy setup you can use curl
tool to access google.com
through proxy by using curl -x http://192.168.0.103:3128 -I http://google.com
command as shown below.
[root@localhost ~]# curl -x http://192.168.0.103:3128 -I http://google.com HTTP/1.1 301 Moved Permanently Location: http://www.google.com/ Content-Type: text/html; charset=UTF-8 Date: Mon, 26 Oct 2020 15:34:16 GMT Expires: Wed, 25 Nov 2020 15:34:16 GMT Cache-Control: public, max-age=2592000 Server: gws Content-Length: 219 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/3.5.20) Connection: keep-alive
Step 8: Enable Proxy User and Authentication
To enable proxy user, first you need to create a passwd
file under /etc/squid
path using touch /etc/squid/passwd
command as shown below.
[root@localhost ~]# touch /etc/squid/passwd
Then you need to change the ownership of /etc/squid/passwd
file using chown squid:squid /etc/squid/passwd
command.
[root@localhost ~]# chown squid:squid /etc/squid/passwd
In the next step you need to use the htpasswd
tool to add the password for user testuser
in /etc/squid/passwd
file using htpasswd /etc/squid/passwd testuser
command as shown below.
[root@localhost ~]# htpasswd /etc/squid/passwd testuser New password: Re-type new password: Adding password for user testuser
Now if you open and check the contents of /etc/squid/passwd
file then you will see something like this.
[root@localhost ~]# cat /etc/squid/passwd testuser:$apr1$nMZaAPOl$IUqna2h0hgJVvPFDU3qXh0
Here is the example configuration that you need to use in squid.conf
file. Open the file with vi
editor using vi /etc/squid/squid.conf
and then add the below configuration. More on Squid Proxy Tutorial.
[root@localhost ~]# vi /etc/squid/squid.conf auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwords auth_param basic realm Squid proxy-caching web server auth_param basic credentialsttl 24 hours auth_param basic casesensitive off acl authenticated proxy_auth REQUIRED http_access allow authenticated http_access deny all dns_v4_first on forwarded_for delete via off http_port 9000
- auth_param basic credentialsttl 24 hours: after 24 hours, user/pass will be asked again.
- auth_param basic casesensitive off: case sensitive for user is off.
- dns_v4_first on: use only IPv4 to speed up the proxy.
- forwarded_for delete: remove the forwarded_for http header which would expose your source to the destination
- via off: remove more headers to avoid exposing the source.
- http_port 9000: we are using port 9000 for proxy. You can choose any free port.
Save the file by pressing Esc
and then :wq!
After providing above configuration, you need to restart the service by using systemctl restart squid
command. It is important to note here that if there will be any error in squid configuration file then service will fail to restart.
[root@localhost ~]# systemctl restart squid
Then check the status by using systemctl status squid
command.
[root@localhost ~]# systemctl status squid ● squid.service - Squid caching proxy Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled) Active: active (running) since Sun 2020-10-25 15:52:32 EDT; 7s ago Process: 14382 ExecStop=/usr/sbin/squid -k shutdown -f $SQUID_CONF (code=exited, status=0/SUCCESS) Process: 16187 ExecStart=/usr/sbin/squid $SQUID_OPTS -f $SQUID_CONF (code=exited, status=0/SUCCESS) Process: 16182 ExecStartPre=/usr/libexec/squid/cache_swap.sh (code=exited, status=0/SUCCESS) Main PID: 16189 (squid) CGroup: /system.slice/squid.service ├─16189 /usr/sbin/squid -f /etc/squid/squid.conf ├─16191 (squid-1) -f /etc/squid/squid.conf └─16192 (logfile-daemon) /var/log/squid/access.log Oct 25 15:52:32 localhost systemd[1]: Starting Squid caching proxy... Oct 25 15:52:32 localhost systemd[1]: Started Squid caching proxy. Oct 25 15:52:32 localhost squid[16189]: Squid Parent: will start 1 kids Oct 25 15:52:32 localhost squid[16189]: Squid Parent: (squid-1) process 16191 started
As you can see from above output, service restarted successfully and running fine. You can also verify the squid proxy running status by checking the state of Port 9000
using netstat
tool as shown below.
[root@localhost ~]# netstat -an | grep -i 9000 tcp6 0 0 :::9000 :::* LISTEN
Step 9: Block Websites or URLs
If you want to block any websites or urls from proxy server then you need to first add all those urls in a file. Here we are creating a block_url
file under /etc/squid
path and adding all the urls which needs to be blocked.
[root@localhost ~]# cat /etc/squid/block_urls yahoo.com google.com youtube.com
Then you need to edit the squid configuration file and add below ACL in it.
[root@localhost ~]# vi /etc/squid/squid.conf acl block_urls dstdomain "/etc/squid/block_urls" http_access deny block_urls
Now restart squid service using systemctl restart squid
command to reflect the changes.
[root@localhost ~]# systemctl restart squid
Step 10: Remove Squid Packages
If you want to remove squid packages then you can remove it by using yum remove squid -y
command as shown below.
[root@localhost ~]# yum remove squid -y Loaded plugins: fastestmirror Resolving Dependencies --> Running transaction check ---> Package squid.x86_64 7:3.5.20-15.el7_8.1 will be erased --> Finished Dependency Resolution Dependencies Resolved ======================================================================================================================================================================== Package Arch Version Repository Size ======================================================================================================================================================================== Removing: squid x86_64 7:3.5.20-15.el7_8.1 @updates 10 M Transaction Summary ======================================================================================================================================================================== Remove 1 Package Installed size: 10 M Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Erasing : 7:squid-3.5.20-15.el7_8.1.x86_64 1/1 warning: /etc/squid/squid.conf saved as /etc/squid/squid.conf.rpmsave Verifying : 7:squid-3.5.20-15.el7_8.1.x86_64 1/1 Removed: squid.x86_64 7:3.5.20-15.el7_8.1 Complete!
Recommended Posts:-
Understanding Kafka Console Producer and Consumer in 10 Easy Steps
Popular firewalld examples to open a port on RedHat/CentOS 7
8 Most Popular mkdir command in Linux with Examples
26 Useful Firewall CMD Examples on RedHat/CentOS 7
12 Most Popular rm command in Linux with Examples
9 useful w command in Linux with Examples
Popular Apache Kafka Architecture Explained Using 4 Basic Components