标签：
| #!/bin/bash # Squid server script # chkconfig: 2345 86 17 # description: Squid prxoy server squid_prefix=‘/usr/local/squid‘ squid_pid=‘/var/run/squid.pid‘ start() { if [ -e $squid_pid ]; then echo "squid already start, nothing " else $squid_prefix/sbin/squid -k parse >> /dev/null 2>&1 #check config_file if [ $? -ne 0 ]; then echo "squid config_file is Error " else echo "Squid is starting..." $squid_prefix/sbin/squid -s fi fi } stop() { if [ ! -e $squid_pid ]; then echo "squid already start stop, nothing " else echo "Squid is stoping..." $squid_prefix/sbin/squid -k shutdown fi } status() { if [ -e $squid_pid ]; then echo "squid (pid `cat $squid_pid`) is running..." else echo "Squid is stop" fi } case $1 in start) start ;; stop) stop ;; restart) stop sleep 40 #shutdown_lifetime is 30(default) start ;; status) status ;; reload) echo "Squid is reloading" $squid_prefix/sbin/squid -k reconfigure ;; *) echo "Usage: $0 {start|stop|restart|status|reload}" ;; esac |
| 0 3 * * * /usr/local/squid/sbin/squid -k rotate #每天3点切割一次 |
| #1、规则会依次执行，先执行的先优先生效 #2、先局部后整体，一般先局部拒绝再允许，最后定义一条拒绝策略（匹配完执行） # 访问控制规则，更多见 http://wiki.squid-cache.org/SquidFaq/SquidAcl acl 163mail dstdomain .163.com # URL words #acl Cooking1 url_regex -i cooking acl Bad_Url url_regex -i "/usr/local/squid/etc/Bad_Url.lst" # Local network acl Mynetwork src 192.168.1.0/24 #acl Arp1 arp 01:02:03:04:05:06 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machine # No Cache Site acl No_cache dstdomain .2345.com # Cache delete acl Purge method PURGE # Specific User acl Admin src 192.168.1.11 acl Manage src 192.168.1.15-192.168.1.25 # Bad Client IP acl Bad_client src "/usr/local/squid/etc/Bad_client.lst" # Max Conn acl Max_conn maxconn 10 # Work time acl Work_time time MTWHF 09:00-12:00 acl Work_time time MTWHF 13:00-17:00 cache deny No_cache always_direct allow 163mail http_access allow Admin Purge http_access deny Purge http_access allow Admin http_access allow Manage http_access deny Bad_client http_access deny Bad_Url http_access deny Max_conn Mynetwork http_access allow MyNetwork Work_time http_access deny Mynetwork #http_access allow Mynetwork http_access allow localnet http_access allow localhost http_access deny all http_port 3128 dns_nameservers 114.114.114.114 8.8.8.8 # DNS服务器，优先级比 ‘/etc/resolv.conf’ 更高 #MyNetwork acl MyNetwork src 192.168.1.0/24 192.168.18.0/24 # Local_host network http_access allow MyNetwork cache_dir ufs /var/cache/squid 100 16 256 # #100M、16个子目录、256个子子目录，可有多个. maximum_object_size 4 MB #4MB, cache的最大文件数 cache_mem 32 MB #对象内存缓存，一般设置成服务器内存的一半或更多 half_closed_clients off #关闭半连接 cache_swap_high 95 #95,达到%100时删除内容到swap_low值 cache_swap_low 80 #90， #maximum_object_size_in_memory 512 KB #512KB，内存cache的最大文件大小 cache_effective_user squid #运行用户 cache_effective_group squid # log access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log pid_filename /var/run/squid.pid visible_hostname Proxy.Srv01 #显示名 cache_mgr chenxuwq@163.com #管理员mail #数据过期算法，percent为百分比，低于该值则数据不过期 #refresh_pattern [-i] regexp min percent max [option] # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 |
| http_port 3128 intercept |
| # Controls IP packet forwarding net.ipv4.ip_forward = 1 # Controls source route verification net.ipv4.conf.default.rp_filter = 0 # Do not accept source routing net.ipv4.conf.default.accept_source_route = 0 |
| options { listen-on port 53 { 192.168.18.10; 192.168.1.10; }; # listen-on port 53 { any; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { 192.168.18.0/24; 192.168.1.0/24; }; # allow-query { any; }; recursion yes; dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto; rrset-order { order cyclic; }; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; vim /etc/named.rfc1912.zones #DNS区域定义 zone "test.org" IN { type master; file "test.org.zone"; allow-update { none; }; }; zone "1.168.192.in-adr.arpatest" IN { type master; file "1.168.192.org.zone"; allow-update { none; }; }; |
| $TTL 3H @ IN SOA ns.test.org. root.test.org. ( 1 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS ns.test.org. ns IN A 192.168.18.10 www IN A 192.168.18.10 |
| $TTL 3H @ IN SOA ns.test.org. root.test.org. ( 1 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS ns.test.org. 10 IN PTR http://www.test.org. |
| http_port 80 accel vhost #accel设置squid为加速模式，vhost实现实现反向代理 http_port 3128 #方便squidclient管理缓存 # 设置后台源服务器 #cache_peer hostname type[parent] [sibling] [multicast] http-port icp-port [0] [option] #no-query 不使用ICP查询源服务器 round-robin 轮询 weigh=N 权重 cache_peer 192.168.1.11 parent 80 0 no-query originserver round-robin name=webServer1 cache_peer 192.168.1.15 parent 80 0 no-query originserver round-robin name=webServer2 visible_hostname Proxy.Srv01 #显示名 |
标签：
原文地址：http://my.oschina.net/chenxu/blog/467114
