笔记：Squid服务器配置全纪录

里就不骂某某人了，但是如果一旦but一个配置文本都贴不全的话。。。 :qie:

记录一次大陆某厂区代理服务器部署过程，只贴命令：

部署：

1. rpm -qa |grep krb5
   
2. rpm -qa |grep squid
   
3. rpm -qa |grep samb
   
4. dmidecode |more
   
5. df -h
   
6. free
   
7. mount
   
8. cd /etc
   
9. ls -l |grep krb5
   
10. mv krb5.conf krb5.conf.bk
    
11. vi krb5.conf
    
12. ls -l |grep krb5
    
13. vi ./sysconfig/network
    
14. vi hosts
    
15. kinit [e-mail]
    
16. more krb5.conf
    
17. cd samba/
    
18. ls -l
    
19. cp -P smb.conf smb.conf.bk
    
20. vi smb.conf
    
21. service smb status
    
22. service smb start
    
23. service winbind status
    
24. service winbind start
    
25. kinit [e-mail]
    
26. date
    
27. service ntpd stop
    
28. ntpdate 10.11.200.3
    
29. service ntpd start
    
30. chkconfig ntpd on
    
31. kinit [e-mail]
    
32. vi smb.conf
    
33. service smb restart
    
34. net rpc join -S nbdc03.domain.com -U stein.yang
    
35. wbinfo -t
    
36. ntlm_auth --username=stein.yang
    
37. cd /etc
    
38. vi nsswitch.conf
    
39. shutdown -r now
    
40. cd /etc/squid/
    
41. ls
    
42. mkdir group_list
    
43. cd group_list/
    
44. ls -la
    
45. touch VIPUsers
    
46. vi VIPUsers
    
47. vi WWWUsers
    
48. ls -lt
    
49. vi WWWshareusers
    
50. ls -l
    
51. vi Keyword
    
52. ls -lt
    
53. vi key
    
54. ls -l
    
55. vi Keyword
    
56. ls -lt
    
57. pwd
    
58. ls -l
    
59. vi Customer_web
    
60. ls -lt
    
61. ps -ef
    
62. w
    
63. more ../squid.conf
    
64. ls -l
    
65. vi Deny_web_domain
    
66. ls -l
    
67. vi Deny_web_ip
    
68. pwd
    
69. ls -lt
    
70. vi VIPUsers
    
71. exit
    
72. w
    
73. ifconfig -a
    
74. vncserver
    
75. ifconfig
    
76. wbinfo -t
    
77. cd /etc/
    
78. vi krb5.conf
    
79. service winbind status
    
80. service winbind start
    
81. service smb status
    
82. service smb start
    
83. chkconfig winbind on
    
84. chkconfig smb on
    
85. wbinfo -t
    
86. ntlm_auth --username=stein.yang
    
87. cd squid/
    
88. ls -lt
    
89. service squid status
    
90. :>squid.conf
    
91. ls -l
    
92. vi squid.conf
    
93. w
    
94. service iptables status
    
95. sestatus
    
96. shutdown -r now
    
97. date
    
98. ntpdate 10.11.200.3
    
99. service ntpd status
    
100. service ntpd stop
     
101. ntpdate 10.11.200.3
     
102. date
     
103. service ntpd start
     
104. w
     
105. ps -ef |grep vnc
     
106. vncserver
     
107. cd /etc/sysconfig
     
108. vi network
     
109. cd ..
     
110. vi hosts
     
111. hostname nbproxy01
     
112. more /etc/passwd
     
113. cd /var/log
     
114. ls -l
     
115. cd squid/
     
116. ls -lt
     
117. cd /var/spool
     
118. ls -lt
     
119. cd squid/
     
120. ls -lt
     
121. more /etc/squid/squid.conf
     
122. squid -z
     
123. cd /etc/squid/group_list/
     
124. ls -lt
     
125. cd ..
     
126. vi squid.conf
     
127. cd /
     
128. ls -l
     
129. chown squid.squid cache0{1..5}
     
130. ls -l
     
131. squid -z
     
132. cd /etc/squid/
     
133. vi squid.conf
     
134. squid -z
     
135. service squid status
     
136. squid -k parse
     
137. service squid start
     
138. pwd
     
139. cd group_list/
     
140. ls -l
     
141. vi VIPUsers
     
142. ls -l
     
143. more VIPUsers
     
144. more WWWUsers
     
145. more WWWshareusers
     
146. service squid status
     
147. service squid restart
     
148. chkconfig squid on
     
149. w
     
150. reboot
     
151. service squid status
     
152. cd /var/log/
     
153. ls
     
154. tail -500 messages |more
     
155. chkconfig --list
     
156. service smb status
     
157. service squid status
     
158. history
     
159. vi squid.conf
     
160. service squid reload
     
161. netstat -an |more
     
162. service squid restart

复制代码

/etc/krb5.conf:

1. [logging]
   
2. default = FILE:/var/log/krb5libs.log
   
3. kdc = FILE:/var/log/krb5kdc.log
   
4. admin_server = FILE:/var/log/kadmind.log
   
5. 
   
6. [libdefaults]
   
7. default_realm = STEINDOMAIN.COM
   
8. 
   
9. dns_lookup_realm = false
   
10. dns_lookup_kdc = false
    
11. [realms]
    
12. 
    
13. # EXAMPLE.COM = {
    
14. # kdc = kerberos.example.com:88
    
15. # admin_server = kerberos.example.com:749
    
16. # default_domain = example.com
    
17. # }
    
18. 
    
19. 
    
20. STEINDOMAIN.COM = {
    
21. kdc = 10.11.200.3
    
22. default_domain = STEINDOMAIN.COM
    
23. }
    
24. 
    
25. [domain_realm]
    
26. 
    
27. # .example.com = EXAMPLE.COM
    
28. # example.com = EXAMPLE.COM
    
29. 
    
30. STEINDOMAIN.COM = STEINDOMAIN.COM
    
31. .STEINDOMAIN.COM = STEINDOMAIN.COM
    
32. 
    
33. 
    
34. [kdc]
    
35. profile = /var/kerberos/krb5kdc/kdc.conf
    
36. 
    
37. [appdefaults]
    
38. pam = {
    
39. debug = false
    
40. ticket_lifetime = 36000
    
41. renew_lifetime = 36000
    
42. forwardable = true
    
43. krb4_convert = false
    
44. }

复制代码

/etc/samba/smb.conf:

1. # This is the main Samba configuration file. You should read the
   
2. # smb.conf(5) manual page in order to understand the options listed
   
3. # here. Samba has a huge number of configurable options (perhaps too
   
4. # many!) most of which are not shown in this example
   
5. #
   
6. # For a step to step guide on installing, configuring and using samba,
   
7. # read the Samba-HOWTO-Collection. This may be obtained from:
   
8. #
   
9. #
   
10. # Many working examples of smb.conf files can be found in the
    
11. # Samba-Guide which is generated daily and can be downloaded from:
    
12. #
    
13. #
    
14. # Any line which starts with a ; (semi-colon) or a # (hash)
    
15. # is a comment and is ignored. In this example we will use a #
    
16. # for commentry and a ; for parts of the config file that you
    
17. # may wish to enable
    
18. #
    
19. # NOTE: Whenever you modify this file you should run the command "testparm"
    
20. # to check that you have not made any basic syntactic errors.
    
21. #
    
22. #---------------
    
23. # SELINUX NOTES:
    
24. #
    
25. # If you want to use the useradd/groupadd family of binaries please run:
    
26. # setsebool -P samba_domain_controller on
    
27. #
    
28. # If you want to share home directories via samba please run:
    
29. # setsebool -P samba_enable_home_dirs on
    
30. #
    
31. # If you create a new directory you want to share you should mark it as
    
32. # "samba-share_t" so that selinux will let you write into it.
    
33. # Make sure not to do that on system directories as they may already have
    
34. # been marked with othe SELinux labels.
    
35. #
    
36. # Use ls -ldZ /path to see which context a directory has
    
37. #
    
38. # Set labels only on directories you created!
    
39. # To set a label use the following: chcon -t samba_share_t /path
    
40. #
    
41. # If you need to share a system created directory you can use one of the
    
42. # following (read-only/read-write):
    
43. # setsebool -P samba_export_all_ro on
    
44. # or
    
45. # setsebool -P samba_export_all_rw on
    
46. #
    
47. # If you want to run scripts (preexec/root prexec/print command/...) please
    
48. # put them into the /var/lib/samba/scripts directory so that smbd will be
    
49. # allowed to run them.
    
50. # Make sure you COPY them and not MOVE them so that the right SELinux context
    
51. # is applied, to check all is ok use restorecon -R -v /var/lib/samba/scripts
    
52. #
    
53. #--------------
    
54. #
    
55. #======================= Global Settings =====================================
    
56. 
    
57. [global]
    
58. 
    
59. # ----------------------- Network Related Options -------------------------
    
60. #
    
61. # workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
    
62. #
    
63. # server string is the equivalent of the NT Description field
    
64. #
    
65. # netbios name can be used to specify a server name not tied to the hostname
    
66. #
    
67. # Interfaces lets you configure Samba to use multiple interfaces
    
68. # If you have multiple network interfaces then you can list the ones
    
69. # you want to listen on (never omit localhost)
    
70. #
    
71. # Hosts Allow/Hosts Deny lets you restrict who can connect, and you can
    
72. # specifiy it as a per share option as well
    
73. #
    
74. workgroup = STEINDOMAIN
    
75. server string = Samba Server Version %v
    
76. netbios name = NBPROXY01
    
77. 
    
78. ; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24
    
79. ; hosts allow = 127. 192.168.12. 192.168.13.
    
80. 
    
81. # --------------------------- Logging Options -----------------------------
    
82. #
    
83. # Log File let you specify where to put logs and how to split them up.
    
84. #
    
85. # Max Log Size let you specify the max size log files should reach
    
86. 
    
87. # logs split per machine
    
88. ; log file = /var/log/samba/%m.log
    
89. # max 50KB per log file, then rotate
    
90. ; max log size = 50
    
91. 
    
92. # ----------------------- Standalone Server Options ------------------------
    
93. #
    
94. # Security can be set to user, share(deprecated) or server(deprecated)
    
95. #
    
96. # Backend to store user information in. New installations should
    
97. # use either tdbsam or ldapsam. smbpasswd is available for backwards
    
98. # compatibility. tdbsam requires no further configuration.
    
99. 
    
100. # security = user
     
101. # passdb backend = tdbsam
     
102. 
     
103. 
     
104. # ----------------------- Domain Members Options ------------------------
     
105. #
     
106. # Security must be set to domain or ads
     
107. #
     
108. # Use the realm option only with security = ads
     
109. # Specifies the Active Directory realm the host is part of
     
110. #
     
111. # Backend to store user information in. New installations should
     
112. # use either tdbsam or ldapsam. smbpasswd is available for backwards
     
113. # compatibility. tdbsam requires no further configuration.
     
114. #
     
115. # Use password server option only with security = server or if you can't
     
116. # use the DNS to locate Domain Controllers
     
117. # The argument list may include:
     
118. # password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
     
119. # or to auto-locate the domain controller/s
     
120. # password server = *
     
121. 
     
122. 
     
123. security = ads
     
124. ; passdb backend = tdbsam
     
125. 
     
126. realm = STEINDOMAIN.COM
     
127. password server = 10.11.200.3
     
128. encrypt passwords = yes
     
129. idmap uid = 16777216-33554431
     
130. idmap gid = 16777216-33554431
     
131. 
     
132. # ----------------------- Domain Controller Options ------------------------
     
133. #
     
134. # Security must be set to user for domain controllers
     
135. #
     
136. # Backend to store user information in. New installations should
     
137. # use either tdbsam or ldapsam. smbpasswd is available for backwards
     
138. # compatibility. tdbsam requires no further configuration.
     
139. #
     
140. # Domain Master specifies Samba to be the Domain Master Browser. This
     
141. # allows Samba to collate browse lists between subnets. Don't use this
     
142. # if you already have a Windows NT domain controller doing this job
     
143. #
     
144. # Domain Logons let Samba be a domain logon server for Windows workstations.
     
145. #
     
146. # Logon Scrpit let yuou specify a script to be run at login time on the client
     
147. # You need to provide it in a share called NETLOGON
     
148. #
     
149. # Logon Path let you specify where user profiles are stored (UNC path)
     
150. #
     
151. # Various scripts can be used on a domain controller or stand-alone
     
152. # machine to add or delete corresponding unix accounts
     
153. #
     
154. ; security = user
     
155. ; passdb backend = tdbsam
     
156. 
     
157. ; domain master = yes
     
158. ; domain logons = yes
     
159. 
     
160. # the login script name depends on the machine name
     
161. ; logon script = %m.bat
     
162. # the login script name depends on the unix user used
     
163. ; logon script = %u.bat
     
164. ; logon path = \\%L\Profiles\%u
     
165. # disables profiles support by specifing an empty path
     
166. ; logon path =
     
167. 
     
168. ; add user script = /usr/sbin/useradd "%u" -n -g users
     
169. ; add group script = /usr/sbin/groupadd "%g"
     
170. ; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u"
     
171. ; delete user script = /usr/sbin/userdel "%u"
     
172. ; delete user from group script = /usr/sbin/userdel "%u" "%g"
     
173. ; delete group script = /usr/sbin/groupdel "%g"
     
174. 
     
175. 
     
176. # ----------------------- Browser Control Options ----------------------------
     
177. #
     
178. # set local master to no if you don't want Samba to become a master
     
179. # browser on your network. Otherwise the normal election rules apply
     
180. #
     
181. # OS Level determines the precedence of this server in master browser
     
182. # elections. The default value should be reasonable
     
183. #
     
184. # Preferred Master causes Samba to force a local browser election on startup
     
185. # and gives it a slightly higher chance of winning the election
     
186. ; local master = no
     
187. ; os level = 33
     
188. os level = 20
     
189. ; preferred master = yes
     
190. 
     
191. #----------------------------- Name Resolution -------------------------------
     
192. # Windows Internet Name Serving Support Section:
     
193. # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
     
194. #
     
195. # - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server
     
196. #
     
197. # - WINS Server: Tells the NMBD components of Samba to be a WINS Client
     
198. #
     
199. # - WINS Proxy: Tells Samba to answer name resolution queries on
     
200. # behalf of a non WINS capable client, for this to work there must be
     
201. # at least one WINS Server on the network. The default is NO.
     
202. #
     
203. # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
     
204. # via DNS nslookups.
     
205. 
     
206. ; wins support = yes
     
207. ; wins server = w.x.y.z
     
208. wins server = 10.11.200.1
     
209. ; wins proxy = yes
     
210. 
     
211. ; dns proxy = yes
     
212. dns proxy = no
     
213. 
     
214. # --------------------------- Printing Options -----------------------------
     
215. #
     
216. # Load Printers let you load automatically the list of printers rather
     
217. # than setting them up individually
     
218. #
     
219. # Cups Options let you pass the cups libs custom options, setting it to raw
     
220. # for example will let you use drivers on your Windows clients
     
221. #
     
222. # Printcap Name let you specify an alternative printcap file
     
223. #
     
224. # You can choose a non default printing system using the Printing option
     
225. 
     
226. load printers = yes
     
227. cups options = raw
     
228. 
     
229. ; printcap name = /etc/printcap
     
230. #obtain list of printers automatically on SystemV
     
231. ; printcap name = lpstat
     
232. ; printing = cups
     
233. 
     
234. # --------------------------- Filesystem Options ---------------------------
     
235. #
     
236. # The following options can be uncommented if the filesystem supports
     
237. # Extended Attributes and they are enabled (usually by the mount option
     
238. # user_xattr). Thess options will let the admin store the DOS attributes
     
239. # in an EA and make samba not mess with the permission bits.
     
240. #
     
241. # Note: these options can also be set just per share, setting them in global
     
242. # makes them the default for all shares
     
243. 
     
244. ; map archive = no
     
245. ; map hidden = no
     
246. ; map read only = no
     
247. ; map system = no
     
248. ; store dos attributes = yes
     
249. 
     
250. 
     
251. #============================ Share Definitions ==============================
     
252. 
     
253. [homes]
     
254. comment = Home Directories
     
255. browseable = no
     
256. writable = yes
     
257. ; valid users = %S
     
258. ; valid users = MYDOMAIN\%S
     
259. 
     
260. [printers]
     
261. comment = All Printers
     
262. path = /var/spool/samba
     
263. browseable = no
     
264. guest ok = no
     
265. writable = no
     
266. printable = yes
     
267. 
     
268. # Un-comment the following and create the netlogon directory for Domain Logons
     
269. ; [netlogon]
     
270. ; comment = Network Logon Service
     
271. ; path = /var/lib/samba/netlogon
     
272. ; guest ok = yes
     
273. ; writable = no
     
274. ; share modes = no
     
275. 
     
276. 
     
277. # Un-comment the following to provide a specific roving profile share
     
278. # the default is to use the user's home directory
     
279. ; [Profiles]
     
280. ; path = /var/lib/samba/profiles
     
281. ; browseable = no
     
282. ; guest ok = yes
     
283. 
     
284. 
     
285. # A publicly accessible directory, but read only, except for people in
     
286. # the "staff" group
     
287. ; [public]
     
288. ; comment = Public Stuff
     
289. ; path = /home/samba
     
290. ; public = yes
     
291. ; writable = yes
     
292. ; printable = no
     
293. ; write list = +staff

复制代码

/etc/nsswitch.conf:

1. #
   
2. # /etc/nsswitch.conf
   
3. #
   
4. # An example Name Service Switch config file. This file should be
   
5. # sorted with the most-used services at the beginning.
   
6. #
   
7. # The entry '[NOTFOUND=return]' means that the search for an
   
8. # entry should stop if the search in the previous entry turned
   
9. # up nothing. Note that if the search failed due to some other reason
   
10. # (like no NIS server responding) then the search continues with the
    
11. # next entry.
    
12. #
    
13. # Legal entries are:
    
14. #
    
15. # nisplus or nis+ Use NIS+ (NIS version 3)
    
16. # nis or yp Use NIS (NIS version 2), also called YP
    
17. # dns Use DNS (Domain Name Service)
    
18. # files Use the local files
    
19. # db Use the local database (.db) files
    
20. # compat Use NIS on compat mode
    
21. # hesiod Use Hesiod for user lookups
    
22. # [NOTFOUND=return] Stop searching if not found so far
    
23. #
    
24. 
    
25. # To use db, put the "db" in front of "files" for entries you want to be
    
26. # looked up first in the databases
    
27. #
    
28. # Example:
    
29. #passwd: db files nisplus nis
    
30. #shadow: db files nisplus nis
    
31. #group: db files nisplus nis
    
32. 
    
33. passwd: files winbind
    
34. shadow: files winbind
    
35. group: files winbind
    
36. 
    
37. #hosts: db files nisplus nis dns
    
38. hosts: files dns
    
39. 
    
40. # Example - obey only what nisplus tells us...
    
41. #services: nisplus [NOTFOUND=return] files
    
42. #networks: nisplus [NOTFOUND=return] files
    
43. #protocols: nisplus [NOTFOUND=return] files
    
44. #rpc: nisplus [NOTFOUND=return] files
    
45. #ethers: nisplus [NOTFOUND=return] files
    
46. #netmasks: nisplus [NOTFOUND=return] files
    
47. 
    
48. bootparams: nisplus [NOTFOUND=return] files
    
49. 
    
50. ethers: files
    
51. netmasks: files
    
52. networks: files
    
53. protocols: files
    
54. rpc: files
    
55. services: files
    
56. 
    
57. netgroup: nisplus
    
58. 
    
59. publickey: nisplus
    
60. 
    
61. automount: files nisplus
    
62. aliases: files nisplus

复制代码

/etc/squid/squid.conf:

1. #############################
   
2. #Squid Config
   
3. #Create by :Stein Yang
   
4. #Modify :
   
5. #
   
6. #############################
   
7. auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
   
8. auth_param ntlm children 5
   
9. 
   
10. auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
    
11. auth_param basic children 5
    
12. auth_param basic realm Squid proxy-caching web server
    
13. auth_param basic credentialsttl 5 hours
    
14. 
    
15. external_acl_type NT_global_group ttl=300 %LOGIN /usr/lib/squid/wbinfo_group.pl
    
16. 
    
17. ##Source define:
    
18. acl all src 10.11.200.0-10.11.204.0/24 10.11.3.0/24 10.11.0.0/24
    
19. 
    
20. ##System default:
    
21. acl manager proto cache_object
    
22. acl localhost src 127.0.0.1/255.255.255.255 10.11.0.33
    
23. acl to_localhost dst 127.0.0.0/8
    
24. acl SSL_ports port 443
    
25. acl Safe_ports port 80 # http
    
26. acl Safe_ports port 21 # ftp
    
27. acl Safe_ports port 443 # https
    
28. acl Safe_ports port 70 # gopher
    
29. acl Safe_ports port 210 # wais
    
30. acl Safe_ports port 1025-65535 # unregistered ports
    
31. acl Safe_ports port 280 # http-mgmt
    
32. acl Safe_ports port 488 # gss-http
    
33. acl Safe_ports port 591 # filemaker
    
34. acl Safe_ports port 777 # multiling http
    
35. acl CONNECT method CONNECT
    
36. 
    
37. ##Protocal define:
    
38. acl allowprotos proto ftp http https # allow ftp http https only
    
39. 
    
40. ##AD Group Define:
    
41. acl WWWUsers external NT_global_group "/etc/squid/group_list/WWWUsers"
    
42. acl WWWshareusers external NT_global_group "/etc/squid/group_list/WWWshareusers"
    
43. 
    
44. ##Keyword & media & zip :
    
45. acl keyword url_regex -i "/etc/squid/group_list/Keyword"
    
46. 
    
47. ##Deny web & ip:
    
48. acl deny_web_domain dstdomain "/etc/squid/group_list/Deny_web_domain"
    
49. acl deny_web_ip dst "/etc/squid/group_list/Deny_web_ip"
    
50. 
    
51. ##Worktime Define:
    
52. acl Worktimes time 08:00-17:00
    
53. acl Timeshare time 15:00-17:00
    
54. 
    
55. ##Customer & Vendor website :
    
56. acl Customer_web dstdomain "/etc/squid/group_list/Customer_web"
    
57. 
    
58. ##MSN Define:
    
59. acl MSN_url url_regex -i gateway.dll
    
60. acl MSN_type req_mime_type ^application/x-msn-messenger$
    
61. acl MSN_method method POST
    
62. acl MSNPorts port 443 569 1863
    
63. acl MSN_domain dstdomain .msn.com .live.com .live.cn .hotmail.com .hotmail.cn
    
64. 
    
65. ##Stream Mime Type
    
66. acl StreamMimeTypeMS rep_mime_type ^.*mms.*
    
67. acl StreamMimeTypeMS rep_mime_type ^.*ms-hdr.*
    
68. acl StreamMimeTypeMS rep_mime_type ^.*x-fcs.*
    
69. acl StreamMimeTypeMS rep_mime_type ^.*x-ms-asf.*
    
70. acl StreamUrl urlpath_regex dvrplayer mediastream mms://
    
71. acl StreamUrl urlpath_regex \.asf$ \.afx$ \.flv$ \.swf$
    
72. acl StreamMimeTypeFlash rep_mime_type -i video/flv
    
73. acl StreamMimeTypeFlash rep_mime_type -i ^application/x-shockwave-flash$
    
74. acl StreamMimeTypeX req_mime_type -i ^application/octet-stream$
    
75. acl StreamMimeTypeX req_mime_type -i application/octet-stream
    
76. acl StreamMimeTypeX req_mime_type -i ^application/x-mplayer2$
    
77. acl StreamMimeTypeX req_mime_type -i application/x-mplayer2
    
78. acl StreamMimeTypeX req_mime_type -i ^application/x-oleobject$
    
79. acl StreamMimeTypeX req_mime_type -i application/x-oleobject
    
80. acl StreamMimeTypeX req_mime_type -i application/x-pncmd
    
81. acl StreamMimeTypeX req_mime_type -i ^video/x-ms-asf$
    
82. 
    
83. ##Connect Limit:
    
84. acl Overlimit maxconn 10
    
85. 
    
86. ##System default:
    
87. http_access allow manager localhost
    
88. http_access deny manager
    
89. http_access allow localhost
    
90. http_access deny CONNECT !SSL_ports
    
91. #http_access deny !Safe_ports
    
92. 
    
93. ##Access Define:
    
94. http_access deny Overlimit
    
95. http_access allow Customer_web
    
96. http_access deny StreamUrl
    
97. http_reply_access deny StreamUrl
    
98. http_access deny StreamMimeTypeMS
    
99. http_reply_access deny StreamMimeTypeMS
    
100. http_access deny StreamMimeTypeFlash
     
101. http_reply_access deny StreamMimeTypeFlash
     
102. http_access deny StreamMimeTypeX
     
103. http_reply_access deny StreamMimeTypeX
     
104. http_access deny deny_web_domain
     
105. http_access deny deny_web_ip
     
106. http_access deny keyword
     
107. http_access allow WWWUsers Worktimes
     
108. http_access allow WWWshareusers Timeshare
     
109. http_access deny all
     
110. 
     
111. delay_pools 1
     
112. delay_class 1 1
     
113. delay_access 1 allow all
     
114. delay_access 1 deny all
     
115. delay_parameters 1 800000/100000
     
116. 
     
117. icp_access allow all
     
118. 
     
119. http_port 8080
     
120. 
     
121. hierarchy_stoplist cgi-bin ?
     
122. 
     
123. cache_mem 512 MB
     
124. 
     
125. cache_dir ufs /cache01 9000 16 256
     
126. cache_dir ufs /cache02 9000 16 256
     
127. cache_dir ufs /cache03 9000 16 256
     
128. cache_dir ufs /cache04 9000 16 256
     
129. cache_dir ufs /cache05 9000 16 256
     
130. 
     
131. cache_swap_high 85
     
132. cache_swap_low 50
     
133. 
     
134. logformat squid1 %tl,%6tr,%>a,%Ss/%03Hs,%st,%rm,%ru,%un,%Sh/%
135. access_log /var/log/squid/access.log squid1
     
136. logfile_rotate 7
     
137. 
     
138. acl QUERY urlpath_regex cgi-bin \?
     
139. cache deny QUERY
     
140. 
     
141. refresh_pattern ^ftp: 1440 20% 10080
     
142. refresh_pattern ^gopher: 1440 0% 1440
     
143. refresh_pattern . 0 20% 4320
     
144. 
     
145. acl apache rep_header Server ^Apache
     
146. broken_vary_encoding allow apache
     
147. 
     
148. visible_hostname NBPROXY01
     
149. 
     
150. ipcache_size 32768
     
151. 
     
152. fqdncache_size 32768
     
153. 
     
154. forwarded_for off
     
155. 
     
156. coredump_dir /var/spool/squid

复制代码