Differences

This shows you the differences between two versions of the page.

--- public:squid_update_proxy [2020/03/11 16:57] – [Serverside] jehaverlack
+++ public:squid_update_proxy [2024/01/25 03:31] (current) – external edit 127.0.0.1
@@ Line 1: / Line 1: @@
 ====== Linux Update Proxy Server ======
-A light weight squid proxy can be used to cached RPM and Deb packages for both Redhat and Debian based Linux systems.
+A light weight Squid Proxy can be used to cached RPM and Deb packages for both RedHat (CentOS) and Debian based Linux systems.  The squid proxy server can be configured to require a login by proxy clients.  Both YUM and APT-GET can be configured to use the proxy server for downloading package updates.  Once one client has download a specific package it will be cached on the Squid Proxy server such that other hosts requesting the same package will not need to use Internet bandwidth to do so.  One caveat is that all YUM and APT clients need to use the same mirror for updates, otherwise if the same package is coming from different mirrors it will get downloaded from the Internet multiple times.
+See: https://stackoverflow.com/questions/3297196/how-to-set-up-a-squid-proxy-with-basic-username-and-password-authentication
 ===== Serverside =====
-#
+Add the following to the Squid Config:
-# Recommended minimum configuration:
-#
-# Example rule allowing access from your local networks.
-# Adapt to list your (internal) IP networks from where browsing
-# should be allowed
-acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
-acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
-acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
-acl localnet src fc00::/7       # RFC 4193 local private network range
-acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
-acl SSL_ports port 443
+**/etc/squid/squid.conf**
-acl Safe_ports port 80          # http
+<code>
-acl Safe_ports port 21          # ftp
+...
-acl Safe_ports port 443         # https
-acl Safe_ports port 70          # gopher
-acl Safe_ports port 210         # wais
-acl Safe_ports port 1025-65535  # unregistered ports
-acl Safe_ports port 280         # http-mgmt
-acl Safe_ports port 488         # gss-http
-acl Safe_ports port 591         # filemaker
-acl Safe_ports port 777         # multiling http
-acl CONNECT method CONNECT
 # Auth
@@ Line 44: / Line 25: @@
 http_access deny !Safe_ports
-# Deny CONNECT to other than secure SSL ports
+...
-http_access deny CONNECT !SSL_ports
-# Only allow cachemgr access from localhost
+# Uncomment and adjust the following to add a disk cache directory.
-http_access allow localhost manager
+#cache_dir ufs /var/spool/squid 100 16 256
-http_access deny manager
+cache_dir ufs /squid-cache 45000 16 256
-# We strongly recommend the following be uncommented to protect innocent
+</code>
-# web applications running on the proxy server who think the only
-# one who can access services on "localhost" is a local user
-#http_access deny to_localhost
-#
+Use htpasswd to create the password file with the **update-user**:
-# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
+<code>
-#
+sudo htpasswd -c /etc/squid3/passwd update-user
+</code>
-# Example rule allowing access from your local networks.
+==== Firewall ====
-# Adapt localnet in the ACL section to list your (internal) IP networks
+Be sure to open up firewall services for squid on port 3128.
-# from where browsing should be allowed
-http_access allow localnet
-http_access allow localhost
-# And finally deny all other access to this proxy
+e.g. on CentOS 7,8
-http_access deny all
+<code>
+firewall-cmd --zone=public --add-service=squid --permanent
+</code>
-# Squid normally listens to port 3128
-http_port 3128
-# Uncomment and adjust the following to add a disk cache directory.
-#cache_dir ufs /var/spool/squid 100 16 256
-cache_dir ufs /squid-cache 45000 16 256
-# Leave coredumps in the first cache dir
+===== Clientside =====
-coredump_dir /var/spool/squid
-#
+==== RedHat / CentOS ====
-# Add any of your own refresh_pattern entries above these.
+On YUM clients append the following lines to
-#
-refresh_pattern ^ftp:           1440    20%     10080
-refresh_pattern ^gopher:        1440    0%      1440
-refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
-refresh_pattern .               0       20%     4320
+**/etc/yum.conf**
+<code>
+proxy=http://SQUID_SERVER_IP:3128
+proxy_username=update-user
+proxy_password=********
+</code>
+==== Debian / Ubuntu / Raspbian ====
+On apt-get Clients create the file:
+/etc/apt/apt.conf.d/apt.conf
+<code>
+Acquire::http::Proxy "http://update-user:********@SQUID_SERVER_IP:3128/";
+</code>
+Then run apt-get update or apt-get install a package
-===== Clientside =====