安裝說明：如果你的系統已經安裝了SQUID，要先卸載了然後按照本文中的步驟重新安裝SQUID。另外如果以前用的是IPTABLES+SQUID做的透明代理，仍然要在浏覽器中進行代理服務器設置，否則SQUID不能使用mysql認證，關於MYSQL_AUTH的版本是這樣的，0.5版的我實驗了很久總不能成功，所以我用了0.6beta版的MYSQL_AUTH。
一、安裝SQUID和MYSQL-SERVER
1.建立用戶和組
[root@home root]# groupadd squid
[root@home root]# adduser -g squid -d /dev/null -s
/sbin/nologin squid
2. 安裝
[root@home root]# rpm –ivh mysql-server-3.23.58-1.9.i386.rpm
[root@home root]# rpm -ivh squid-2.5.STABLE3-3.3E.i386.rpm
設置MYSQL的ROOT管理密碼：
[root@home root]# mysqladmin –u root passWord ******
設置MSYQL和SQUID開機啟動：
[root@home root]# chkconfig mysqld on
[root@home root]# chkconfig squid on
3.配置SQUID.CONF
--------------------------------------------------------
http_port 3128
cache_mgr
[email protected]
error_Directory /usr/share/squid/errors/Simplify_Chinese
dns_nameservers 202.99.160.68 202.99.168.8
visible_hostname nero.3322.org
httpd_accel_uses_host_header on
httpd_accel_host virtual
httpd_accel_with_proxy on
cache_mem 20 MB
maximum_object_size 4096 KB
minimum_object_size 0 KB
maximum_object_size_in_memory 30 KB
minimum_object_size_in_memory 0 KB
cache_dir ufs /tmp 100 16 256
cache_swap_low 85
cache_swap_high 90
httpd_accel_port 80
#http_Access deny all
--------------------------------------------------------
4.啟動SQUID和MYSQL
[root@home root]# service mysqld start
[root@home root]# service squid start
二、 譯安裝MYSQL_AUTH-0.6
[root@home root]# tar xzpf mysql_auth-0.6beta.tar.gz
[root@home root]# cd mysql_auth-0.6beta
修改Makefile中的內容如下：
[root@home mysql_auth-0.6beta]# vi Makefile
CFLAGS = -I/usr/include/mysql -L/usr/lib/mysql
$(INSTALL) -o squid -g squid -m 755 mysql_auth /usr/bin/mysql_auth
$(INSTALL) -o squid -g squid -m 600 $(CONF) /etc/mysql_auth.conf
$(INSTALL) -o squid -g squid -m 600 $(CONF) /etc/mysql_auth.conf.default
修改src/define.h中的內容如下：
[root@home mysql_auth-0.6beta]# vi +5 src/define.h
#define CONFIG_FILE "/etc/mysql_auth.conf"
#define DEF_MYSQLD_SOCKET "/var/lib/mysql/mysql.sock"
修改src/mysql_auth.conf中的內容如下：
[root@home mysql_auth-0.6beta]# vi src/mysql_auth.conf
mysqld_socket /var/lib/mysql/mysql.sock
[root@home mysql_auth-0.6beta]# make
[root@home mysql_auth-0.6beta]# make install
創建用戶數據庫：
[root@home mysql_auth-0.6beta]# cd scripts
[root@home scripts]# mysql -u root –p****** < create_script
三、 測試MYSQL_AUTH
1.添加一個測試用戶
[root@home mysql_auth-0.6beta]# mypasswd test 123456
Password record ADDED sUCcesfully.
2.驗證剛才建立的用戶
[root@home mysql_auth-0.6beta]# mysql_auth test
test 123456
0K
3.刪除一個已經建立的用戶用這個命令
[root@home mysql_auth-0.6beta]# mypasswd –d username
Password record DELETED succesfully.
四、在SQUID.CONF中增加MYSQL_AUTH認證
[root@home mysql_auth-0.6beta]# vi /etc/squid/squid.conf
添加下面的代碼到SQUID.CONF中“TAG: acl”一節的後面
auth_param basic program /usr/bin/mysql_auth
auth_param basic realm Squid caching server
auth_param basic children 5
auth_param basic credentialsttl 2 hours
acl password proxy_auth REQUIRED
http_access allow password
authenticate_ip_ttl 2 hours
http_access deny all
五、客戶端設置
在你浏覽器的代理服務器設置中填寫SQUID服務器的IP和端口：
192.168.0.1:3218
在你下載軟件的代理服務器設置中填寫SQUID服務器的IP和端口：
192.168.0.1:3218
六、一個簡單的IPTABLES腳本
eth0:to lan
eth1:to adsl-modem
-------------------------------------------------------------------
#!/bin/bash
eXPort PATH=/sbin:/usr/sbin:/bin:/usr/bin
echo 1 >/proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -Z
## Allow forwarding through the internal interface
iptables -A FORWARD -i eth0 -j ACCEPT
iptables -A FORWARD -o eth0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
## Do masquerading through ppp0
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
## SQUID
iptables -t nat -A PREROUTING -i eth0 -p tcp -s 0/0 --dport 80 -j REDIRECT --to-ports 3128
## HTTP
iptables -A INPUT -i ppp0 -p tcp -s 0/0 --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp -s 0/0 --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp -d 0/0 --dport 443 -j ACCEPT
## DNS
iptables -A INPUT -i ppp0 -p udp -s 0/0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i ppp0 -p udp -d 0/0 --dport 53 -j ACCEPT
## Anything else not allowed
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i ppp0 -j DROP
iptables -A INPUT -i ppp0 -p tcp -s 0/0 --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp -d 0/0 --dport 443 -j ACCEPT
## DNS
iptables -A INPUT -i ppp0 -p udp -s 0/0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i ppp0 -p udp -d 0/0 --dport 53 -j ACCEPT
## Anything else not allowed
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i ppp0 -j DROP
