Installing and Configuring Squidby Jennifer Vesperman
What can Squid do for your site?
Put Squid between the users and the Internet to cache your web pages. Users surf faster, HTTP traffic uses less bandwidth, and you can save on bandwidth fees -- or use the saved bandwidth for other traffic.
There is also an RPM package for Red Hat Linux, and packages for FreeBSD and NetBSD. Instructions on installing the packages are available from the package sites. All three package sets come with Squid source code and additional instructions on installing from the source.
./configure script has several options. A recommended set is
./configure --enable-heap-replacement --enable-cache-digests --enable-dlmalloc.
The Squid configuration file is in the
$SQUID-HOME/etc/squid.conf directory. The file has extensive comments about each option. This article is a quick reference to which options you are most likely to want to change. Your local network may require configurations not mentioned in this article.
When you have Squid configured, run
squid -z to create the cache directory structure. Then you can start Squid.
htcp_port. 3128 is a good default, 8080 is a reasonable alternative for HTTP. Port 80, or any port normally used by some other service, should be avoided if at all possible.
cache_memat 8 Mbytes at first, unless you have between 0.5 Gbytes and 1 Gbyte of RAM free routinely. If so, set
cache-memto 128 Mbytes. Adjust
cache_memonce local cache patterns are known.
- Increase the
maximum_object_sizeto 40 Mbytes. If larger files are routinely downloaded, increase it to 250 Mbytes or even 700 Mbytes.
cache_dirto an area that has a large amount of space. Technically it belongs under
/var, but you might not want it backed up. Don't set it to use more than 70 percent of the space, Squid uses this directory to store journal files as well.
cache_dir ufs /var/cache/squid 80000 16 256is common.
- Turn the
cache_logon. The former tells you who is doing what, and the latter tells you when things aren't quite right.
cache_swap_logis the location for the journal files mentioned in
cache_dir. The default location is in the same directory as
pid_filenamemust be set.
/var/log/squid/squid.pidis a good location. Squid uses this to shut down, rotate log files, or reread its configuration.
refresh_patternaffects how objects are evaluated for freshness. A reasonable default is
refresh_pattern . 0 20% 10080.
cache_mgris for people that use the cache to report problems. Be sure to use an email address that you will actually read.
cache_effective groupshould be set to a "proxy" user and group. Many distributions ship with this user and group pre-installed.
chownthe log and cache directories to this user before you start Squid. This user must be able to read the configuration file and the directory that it's in.
chown -R proxy.proxy /var/log/squid /var/cache/squid
visible_hostnameto the fully qualified domain name. For example,
dns_testnames. If it can't resolve names like "netscape.com", "internic.net", and "nlanr.net", your system needs fixing.
memory_poolsoff unless there's a lot of free memory on the box.
log_icp_querieson. ICP queries come from other proxies -- if you don't have sibling or parent proxies and you're getting them, you'll want to see these in the
Basic configuration ACLs
Access-control lists manage the access to your network. This basic example limits access to the proxy to the network
18.104.22.168/24. It matches successfully if a request comes from any of the addresses between
acl our_network src 22.214.171.124/24 http_access allow our_network http_access deny all
ACLs are checked from top to bottom. Clients with IPs in
our_network are permitted, anyone else falls through to the "deny all" and gets a failure message. The format for the class definition is
acl listname src network/netmask.
ACLs have an implicit last line that reverses the rule of the previous line. This protects against forgetting to add the
http_access deny all, but explicitly adding that line makes the ACL more readable and helps ensure that it's not missed when the ACL is changed.
If an object isn't in the cache and marked as fresh, Squid checks with the origin server to see if it is still current and requests a new copy if it isn't. This behavior serves local users well, but is undesirable if the requesting client is a neighboring proxy server. The following ACL lines allow the local network to be passed objects which aren't in the current cache, but deny this service to anyone outside the local network.
miss_access allow our_network miss_access deny all
Caches communicate with ICP messages to find out whether they have fresh content that satisfies a request. The
icp_access ACL lines are used to control the caches Squid can communicate with.
Configuration for speed
To maximize speed, minimize the number of simultaneous requests Squid has to handle. The more requests Squid has to process in parallel, the longer each request takes. Every bit of latency you can reduce speed of the server.
- Use a multiprocessor machine with asynchronous I/O enabled.
- Run a version of Squid with internal DNS, or increase the number of DNS servers.
Aim to have 20 or 30 DNS servers. DNS lookups can be slow -- some continental backbones can take a minute and more to resolve a DNS request.
Pages: 1, 2