Hack The Sec-Leading Resource Of Linux Tutorial: proxy

Installing HAProxy For Load Blancing And Protecting Apache From DDos

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="color: #990000; font-family: verdana, geneva, sans-serif; font-size: large;"><span style="line-height: 26px;"><b><u>HAProxy For Load Blancing And Protecting Apache</u></b></span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Over the years it has become the de-facto standard opensource load balancer, is now shipped with most mainstream Linux distributions, and is often deployed by default in cloud platforms. </span></span><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgPa7Usd4c8YIVUD4JNC30RhJVlkhu9vYhOMa1pF6q2-pKyCbDfhAB_kSKelVuBM10VGpjA3DR0A3F7scFBYZUjAwEe-I1s3UE9n_3Ia-V7fFmwaF2ttWFsjAKi3lCEdkY0TPWvAFBx6L7/s1600/HAProxy-hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgPa7Usd4c8YIVUD4JNC30RhJVlkhu9vYhOMa1pF6q2-pKyCbDfhAB_kSKelVuBM10VGpjA3DR0A3F7scFBYZUjAwEe-I1s3UE9n_3Ia-V7fFmwaF2ttWFsjAKi3lCEdkY0TPWvAFBx6L7/s1600/HAProxy-hackthesec.co.in.jpg" /></a></div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Its mode of operation makes its integration into existing architectures very easy and riskless, while still offering the possibility not to expose fragile web servers to the net, such as below :</span></span><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="http://www.haproxy.org/img/haproxy-pmode.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://www.haproxy.org/img/haproxy-pmode.png" /></a></div>
<span style="background-color: white; color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"><br /></span>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">version 1.5 : the most featureful version, supports SSL, IPv6, keep-alive, DDoS protection, etc...</span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">version 1.4 : the most stable version for people who don't need SSL. Still provides client-side keep-alive</span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="background-color: white; font-size: 15px; line-height: 26px;"></span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">version 1.3 : the old stable version for companies who cannot upgrade for internal policy reasons. <a href="http://www.haproxy.org/#desc" target="_blank">More Info Here</a></span></span><br />
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>INSTALLATION</u></b></span></span><br />
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; line-height: 19.2px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">wget http://haproxy.1wt.eu/download/1.5/src/devel/haproxy-1.5-dev7.tar.gz
tar xvfz haproxy-1.5-dev7.tar.gz
$ cd haproxy-1.5-dev7</pre>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Now we have to compile the installation file, we are taking example of centos.</span></span><br />
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; line-height: 19.2px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">make install</pre>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Now make a new directory and copy haproxy configuration file there</span></span><br />
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; line-height: 19.2px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">mkdir /etc/haproxy
cd /etc/haproxy
vi haproxy.cfg</pre>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">change the ip address below and copy it to haproxy.cfg</span></span><br />
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;"><span style="color: white; font-family: monospace, serif;"><span style="font-size: 14px; line-height: 19.2px;">global
daemon
maxconn 20000        # count about 1 GB per 20000 connections
pidfile /var/run/haproxy.pid
stats socket /var/run/haproxy.stat mode 600

defaults
mode http
maxconn 19500        # Should be slightly smaller than global.maxconn.
timeout client 60s   # Client and server timeout must match the longest
timeout server 60s   # time we may wait for a response from the server.
timeout queue  60s   # Don't queue requests too long if saturated.
timeout connect 4s   # There's no reason to change this one.
timeout http-request 5s    # A complete request may never take that long.
# Uncomment the following one to protect against nkiller2. But warning!
# some slow clients might sometimes receive truncated data if last
# segment is lost and never retransmitted :
# option nolinger
option http-server-close
option abortonclose
balance roundrobin
option forwardfor    # set the client's IP in X-Forwarded-For.
option tcp-smart-accept
option tcp-smart-connect
retries 2

frontend public
bind 192.168.1.1:80
bind 192.168.1.2:80
bind 192.168.1.3:80
bind 192.168.1.4:80

# table used to store behaviour of source IPs
stick-table type ip size 200k expire 5m store gpc0,conn_rate(10s)

# IPs that have gpc0 > 0 are blocked until the go away for at least 5 minutes
acl source_is_abuser src_get_gpc0 gt 0
tcp-request connection reject if source_is_abuser

# connection rate abuses get blocked
acl conn_rate_abuse  sc1_conn_rate gt 30
acl mark_as_abuser   sc1_inc_gpc0  gt 0
tcp-request connection track-sc1 src
tcp-request connection reject if conn_rate_abuse mark_as_abuser

default_backend apache

backend apache
# set the maxconn parameter below to match Apache's MaxClients minus
# one or two connections so that you can still directly connect to it.
stats uri /haproxy?stats
server srv 0.0.0.0:8181 maxconn 254

# Enable the stats page on a dedicated port (8811). Monitoring request errors
# on the frontend will tell us how many potential attacks were blocked.
listen stats
# Uncomment "disabled" below to disable the stats page :
# disabled
bind       :8811
stats uri /</span></span><span style="font-family: Times New Roman;"><span style="white-space: normal;">
</span></span></pre>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">In the above file replace 192.168.1.1 to 192.168.1.4 with your server ip address.</span></span></div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Change your Apache port to 8181 as in configuration file we are using that server srv 0.0.0.0:8181 maxconn 254.</span></span><br />
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;"><b>In WHM goto Tweak Settings and find Apache non-SSL IP/port and change it to 8181.</b></span></span><br />
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><b><u>Restart apache</u></b></span></span><br />
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;"><span style="color: white; font-family: monospace, serif;"><span style="font-size: 14px; line-height: 19.2px;">/etc/init.d/apache2 restart</span></span></pre>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><b><u>Start haproxy</u></b></span></span><br />
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;"><span style="color: white; font-family: monospace, serif;"><span style="font-size: 14px; line-height: 19.2px;">haproxy -f /etc/haproxy/haproxy.cfg</span></span></pre>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Now we have to check if its working. Go to your stats page to see</span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b>serverip:8811</b></span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="background-color: white; font-size: 15px; line-height: 26px;"></span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Replace serverip with your server ip used in configuration file and you will see full result generated by haproxy</span></span><br />
<div style="text-align: center;">
<span style="background-color: white; color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></div>
<div style="text-align: center;">
<br /></div>
</div>

Installing HAProxy For Load Blancing And Protecting Apache From DDos

HAProxy For Load Blancing And Protecting Apache HAProxy is a free, very fast and reliable solution offering high availability, load balanc...

How to Block Facebook, Twitter and YouTube HTTPS Traffic In Squid Transparent Proxy Mode

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="color: red; font-family: verdana, geneva, sans-serif; font-size: large;"><span style="line-height: 26px;"><b><u>Block Facebook, Twitter and YouTube’s HTTPS Traffic In Squid Transparent Proxy Mode</u></b></span></span><br />
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">After setting up <a href="http://www.hackthesec.co.in/2016/05/how-to-configure-squid-3x-as.html" target="_blank">Squid As Transparent Proxy Mode</a>, most of the system admins try to block famous social media websites such as Facebook, Twitter and YouTube in their network.So in this guide we will learn how to Block HTTPS Traffic while Squid is running as Transparent Proxy.</span></span><br />
<a href="http://www.hackthesec.co.in/2016/05/how-to-configure-squid-3x-as.html" itemprop="url" style="background-color: white; display: block; font-family: 'Open Sans', serif, sans-serif; font-size: 18.6px; font-weight: 600; text-decoration: none;"></a><br />
<ul style="text-align: left;">
<li><a href="http://www.hackthesec.co.in/2016/05/how-to-configure-squid-3x-as.html" itemprop="url" style="display: inline !important; font-size: 18.6px; text-decoration: none;"><span style="color: red;">How to Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7</span></a></li>
</ul>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu5EEcgs1XrKXPdiyB1Q9PXqvHPrQfndedFITprHVBeAFc0Ob0eu6tPF6Q9cnbSsn_9PcqWs-TgRQ5VdO5HmWfRMMgzhp8Niz6GEiKzSFt5fc76UHNuThqmUgiwW1P1-451tDcx7pK59RW/s1600/access-blocked-websites-hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu5EEcgs1XrKXPdiyB1Q9PXqvHPrQfndedFITprHVBeAFc0Ob0eu6tPF6Q9cnbSsn_9PcqWs-TgRQ5VdO5HmWfRMMgzhp8Niz6GEiKzSFt5fc76UHNuThqmUgiwW1P1-451tDcx7pK59RW/s1600/access-blocked-websites-hackthesec.co.in.png" /></a></div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">We understand now that 443 port traffic is passing through iptables firewall. So with the help of iptables string matching feature we will see how to block Facebook, Twitter and YouTube HTTPS traffic.</span></span><br />
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Iptables Rule to Block Facebook in Squid Transparent Proxy Setup</u></b></span></span><br />
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">iptables -I FORWARD -p tcp --dport 80 -m string --string 'facebook.com' --algo bm --to 65535 -j DROP</span></span></pre>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">
iptables -I FORWARD -p tcp --dport 443 -m string --string 'facebook.com' --algo bm --to 65535 -j DROP</span></span></pre>
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Iptables Rule to Block Twitter in Squid Transparent Proxy Setup</u></b></span></span><br />
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">iptables -I FORWARD -p tcp --dport 80 -m string --string 'twitter.com' --algo bm --to 65535 -j DROP</span></span></pre>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">
iptables -I FORWARD -p tcp --dport 443 -m string --string 'twitter.com' --algo bm --to 65535 -j DROP</span></span></pre>
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Iptables Rule to Block YouTube in Squid Transparent Proxy Setup</u></b></span></span><br />
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">iptables -I FORWARD -p tcp --dport 80 -m string --string 'youtube.com' --algo bm --to 65535 -j DROP</span></span></pre>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">
iptables -I FORWARD -p tcp --dport 443 -m string --string 'youtube.com' --algo bm --to 65535 -j DROP</span></span></pre>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Above rules will block entire traffic destine to 443 port but you can apply same rule on particular single ip, range of ips or complete network.</span></span><br />
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>To Apply Same Rule on Single IP Address</u></b></span></span><br />
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">iptables -I FORWARD -p tcp --dport 443 -s 192.168.2.10 -m string --string 'youtube.com' --algo bm --to 65535 -j DROP</span></span></pre>
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>To Apply Same Rule on Range of IP Addresses</u></b></span></span><br />
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">iptables -I FORWARD -p tcp --dport 443 -m iprange --src-range 192.168.2.11-192.168.2.15 -m string --string 'youtube.com' --algo bm --to 65535 -j DROP</span></span></pre>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Above rule will block YouTube.com only specified ips from 11 to 15 other all range is allowed.</span></span><br />
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>To Apply Same Rule on Whole Subnet of 192.168.2.0/24</u></b></span></span><br />
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">iptables -I FORWARD -p tcp --dport 443 -s 192.168.2.0/24 -m string --string 'youtube.com' --algo bm --to 65535 -j DROP</span></span></pre>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></pre>
</div>

How to Block Facebook, Twitter and YouTube HTTPS Traffic In Squid Transparent Proxy Mode

Block Facebook, Twitter and YouTube’s HTTPS Traffic In Squid Transparent Proxy Mode After setting up Squid As Transparent Proxy Mode , mos...

How to Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7

<div dir="ltr" style="text-align: left;" trbidi="on">
<h2 class="post-heading" style="background-color: white; border: 0px; font-family: sans-serif; font-size: 24px; line-height: 30px; margin: 30px 0px 15px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: red;">Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7</span></h2>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">There are several benefits of using a transparent proxy. First of all, for end users, a transparent proxy can enhance their web browsing performance by caching frequently accessed web content, while introducing minimal configuration overhead for them. For administrators, it can be used to enforce various administrative policies such as content/URL/IP filtering, rate limiting, etc.</span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1VrRyKPmaAN8_k1ni3Alq0RVqEPZim4tvw83TXom35GD6ZGJrboNOHhJ97rT251n4G6I7iWctMMqdO5wN9jm5mrF3yErWGe65h2lNz-DioH6G_eOWTR2IFdWRyI2pi9EiwY8B7F-8CN0J/s1600/squid-installation-hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1VrRyKPmaAN8_k1ni3Alq0RVqEPZim4tvw83TXom35GD6ZGJrboNOHhJ97rT251n4G6I7iWctMMqdO5wN9jm5mrF3yErWGe65h2lNz-DioH6G_eOWTR2IFdWRyI2pi9EiwY8B7F-8CN0J/s1600/squid-installation-hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">A proxy server acts as an intermediary between a client and a destination server. The client sends requests to the proxy server which then evaluates the requests and takes necessary actions. In this tutorial, we will be setting up a web proxy server using Squid, which is a robust, customizable and stable proxy server. Personally, I had administered a Squid server with 400+ client workstations for about a year. Although I had to restart the service about once a month in average, CPU and storage utilization, throughput and client response time were all great.</span></span></div>
<div>
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Squid Installation and Configuration</u></b></span></span></div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"># yum install squid –y</span></span></pre>
</div>
<div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Edit squid configuration file</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Before you edit default configuration file it is highly recommended to keep backup.</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"># cp /etc/squid/squid.conf /etc/squid/squid.conf.bk-26-05-2016</span></span></pre>
</div>
</div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Open configuration file and add below mentioned parameters</span></span></div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"># vi /etc/squid/squid.conf</span></span></pre>
</div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Add transparent proxy setting and add and allow our network</span></span></div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"># vi /etc/squid/squid.conf</span></span></pre>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"># Allow LAN Network
acl our_network src 192.168.2.0/24

# Allow Network ACL Allow/Deny Section#
http_access allow our_network

# Transparent Proxy Parameters
http_port 3128 intercept

visible_hostname pxy.hackthesec.co.in</span></span></pre>
</div>
<div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Save & Exit</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Now start squid service and make sure it is added on startup.</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"># systemctl start squid
# systemctl enable squid</span></span></pre>
</div>
</div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Add necessary iptables rules to setup squid as transparent proxy.</span></span></div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">ptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.2.100:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables --t nat -A POSTROUTING --out-interface eth1 -j MASQUERADE</span></span></pre>
</div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Now you can save your iptable rules by following command:</span></span></div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="color: white; font-family: Monaco, Courier New, DejaVu Sans Mono, Bitstream Vera Sans Mono, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;">service iptables save</span></span></pre>
</div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">That’s It, Now squid should work smoothly in transparent proxy mode.</span></span></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></div>
</div>

How to Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7

Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7 There are several benefits of using a transparent proxy. First of all, for...

How to install and configure Tinyproxy on Ubuntu 14.04

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" style="background-color: white; box-sizing: border-box; font-family: Lato, sans-serif; line-height: 1.1; margin: 20px 0px 10px;">
<span style="color: #990000; font-size: large;"><u>Install and configure Tinyproxy on Ubuntu 14.04</u></span></h1>
<div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b>Tinyproxy </b>is a HTTP <b><a href="http://www.hackthesec.co.in/search/label/proxy">proxy</a> </b>server daemon for POSIX operating systems. Designed to be fast and small, it is useful when an HTTP/HTTPS <a href="http://www.hackthesec.co.in/search/label/proxy">proxy </a>is required, but the system resources for a larger proxy are unavailable. Because of this it has been put to uses such as a tether on the iPhone, and on the OpenWrt.</span></span></div>
<div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdPo2ovKOZSguZewmZtbrjS66xCPAOih2Dg_d9hOokOELBMyLoPFG8q8Hf9qeTnd-NKrOdbs8G81X5e3ZklP2wzWuGhfAawOfSskuCMS8w15Y1MRYYCKmX8ZM1pStNc1VudsfKzr7VQgWd/s1600/tinyproxy_block.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdPo2ovKOZSguZewmZtbrjS66xCPAOih2Dg_d9hOokOELBMyLoPFG8q8Hf9qeTnd-NKrOdbs8G81X5e3ZklP2wzWuGhfAawOfSskuCMS8w15Y1MRYYCKmX8ZM1pStNc1VudsfKzr7VQgWd/s1600/tinyproxy_block.jpg" /></a></div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Tinyproxy is primarily designed to run on Unix-like systems. Released under the GNU General Public License, Tinyproxy is free software and has been developed for a number of years. It is currently being maintained on GitHub as a publicly accessible project. Ohloh analyses it to be a project with "mature, well-established codebase and increasing year-over-year development activity."</span></span></div>
</div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Features</u></b></span></span></div>
<div>
<div style="color: #222222; font-family: verdana, geneva, sans-serif;">
<ul style="font-size: 15px; line-height: 26px; text-align: left;">
<li><b>Anonymous mode:</b> Allows specification of individual HTTP headers that should be allowed through, and which should be blocked.</li>
<li><b>HTTPS support:</b> Tinyproxy allows forwarding of HTTPS connections without modifying traffic in any way.</li>
<li><b>Remote monitoring:</b> Tinyproxy can be monitored remotely to view logs and access details.</li>
<li><b>Load average monitoring:</b> Tinyproxy can be configured to refuse connections after the server load reaches a certain point.</li>
<li><b>Access control:</b> Tinyproxy can be configured to only allow connections from certain subnets or IP addresses.</li>
<li><b>Secure: </b>With some configuration, Tinyproxy can be made to run without any special privileges, thus minimizing the chance of system compromise. Furthermore, it was designed with an eye towards preventing buffer overflows.</li>
<li><b>Small footprint:</b> Tinyproxy requires very little in the way of system resources - the memory footprint tends to be around 2MB with glibc, and the CPU load increases linearly with the number of simultaneous connections (depending on the speed of the connection). Therefore, Tinyproxy can be run on a spare, older machine without any impact on performance.</li>
<li><b>URL based filtering:</b> Tinyproxy allows domain and URL-based black- and whitelisting.</li>
<li><b>Transparent proxying:</b> Tinyproxy supports being configured as a transparent proxy, so that a proxy can be used without requiring any client-side configuration.</li>
<li><b>Proxy chaining:</b> Tinyproxy can use an upstream proxy server for outbound connections, instead of direct connections to the target server, creating a so-called proxy chain.</li>
</ul>
<div>
<span style="font-size: 15px; line-height: 26px;">It’s always recommended to update your package repository cache before installing new packages.</span></div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: "trebuchet ms" , sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">sudo apt-get update</span></span></pre>
</div>
<div>
<div>
<span style="color: #0b5394; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Install and Configure Tinyproxy</u></b></span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Tinyproxy can be installed from the default Ubuntu repositories with:</span></span></div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: "trebuchet ms" , sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">sudo apt-get install tinyproxy</span></span></pre>
</div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Once the installation is complete, open the Tinyproxy configuration file with your editor of choice:</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: "trebuchet ms" , sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">sudo nano /etc/tinyproxy.conf</span></span></pre>
</div>
<div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">The default port number is set to 8888, but you can change it to whatever you like. In most cases, the default port number does not need to be changed. Please note that if you want to run your Tinyproxy server on a port lower than 1024 you will need to start Tinyproxy using root.</span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">By default Tinyproxy will only accept connections from 127.0.0.1. Scroll down to the authorization controls section and add your local computer’s IP address to the allow list:</span></span></div>
</div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><span style="font-size: large;">Allow 127.0.0.1
Allow your.local.ip.address</span></pre>
</div>
<div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">If you do not know your computer's IP address, open your web browser and navigate to http://ipinfo.io/ip. Copy and paste the IP address shown at this site into the Tinyproxy configuration file.</span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">All other default settings should be fine.</span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Save the configuration and restart the service.</span></span></div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: "trebuchet ms" , sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">sudo /etc/init.d/tinyproxy restart</span></span></pre>
</div>
<div>
<div>
<span style="color: #0b5394; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Setup a cron job</u></b></span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Setting up a daily cron job will prevent memory leaks.</span></span></div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Use the command <b>crontab -e</b> to edit the crontab file and add the following line:</span></span></div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: "trebuchet ms" , sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">0 2 * * * /etc/init.d/tinyproxy restart</span></span></pre>
</div>
<div>
<span style="color: #222222; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">That's it. You have successfully installed Tinyproxy on your Ubuntu 14.04.</span></span></div>
<div style="color: #222222; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
</div>
</div>

How to install and configure Tinyproxy on Ubuntu 14.04

Install and configure Tinyproxy on Ubuntu 14.04 Tinyproxy is a HTTP proxy server daemon for POSIX operating systems. Designed to be fa...

How to install squid proxy on centos

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 style="clear: both; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 30px; height: auto; line-height: 31px; margin: 0px; padding: 0px; width: 614px;">
<u><span style="color: #990000;">Install squid proxy on centos</span></u></h1>
<div>
<span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Squid is a caching and forwarding web proxy. It has a wide variety of uses, from speeding up a web server by caching repeated requests; to caching web, <a href="http://www.hackthesec.co.in/search/label/DNS">DNS</a> and other computer network lookups for a group of people sharing network resources; to aiding security by filtering traffic. Although primarily used for HTTP and <a href="http://www.hackthesec.co.in/search/label/ftp">FTP</a>, Squid includes limited support for several other protocols including TLS, SSL, Internet Gopher and HTTPS</span></span><span style="background-color: white; color: #333333; font-family: "verdana" , "geneva" , sans-serif; font-size: 15px; line-height: 26px;">.</span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtuLbkofJ_zaadojyg-kg2TTym3Z1SblRiTiwNCaRRxvNfwE7UGzMyriv33EkqCKKK-PNDNIrXMTxl633f8uUdiToe_67H4UK77mB5VOLK7hTbxGaSICl3pNA6navN1-2mqAmMYhmcMrOT/s1600/squid_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtuLbkofJ_zaadojyg-kg2TTym3Z1SblRiTiwNCaRRxvNfwE7UGzMyriv33EkqCKKK-PNDNIrXMTxl633f8uUdiToe_67H4UK77mB5VOLK7hTbxGaSICl3pNA6navN1-2mqAmMYhmcMrOT/s1600/squid_www.hackthesec.co.in.png" /></a></div>
<div>
<span style="background-color: white; color: #333333; font-family: "verdana" , "geneva" , sans-serif; font-size: 15px; line-height: 26px;"><br /></span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Update yum repositories and packages by typing the below command</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# yum update</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 1:- Install squid package and dependencies using the below command</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# yum install squid</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">By default squid configuration file "<b>/etc/squid/squid.conf</b>" will contains recommended minimum configuration  and squid caching feature will work without making any changes . Recommended minimum configuration will looks like the below</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128

# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|?) 0     0%      0
refresh_pattern .               0       20%     4320</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 2:- Now start squid service</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# service squid start</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and type this below command to start squid service automatically while booting.</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# chkconfig --levels 235 squid on</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;"></span></span><br />
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 3:- Setup your web browser to access Internet through proxy server on port 3128</span></span></div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">
<div>
<br /></div>
<div>
IE : Tools » Internet options »Connections » LAN settings » Choose "Use a proxy server for your LAN" » Type your Proxy server ip (192.168.1.11 ) and port no 3128</div>
<div>
<br /></div>
<div>
Firefox : Options / Preferences » Advanced » Network » Settings » Choose "Manual proxy configuration " » Type your Proxy server ip (192.168.1.11 ) and port no 3128</div>
<div>
<br /></div>
<div>
Step 4:- Browse some sites and check the access log file on proxy server</div>
</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">[root@hackthesec ~]# cat /var/log/squid/access.log
1343759484.645    265 192.168.1.15 TCP_MISS/304 477 GET http://platform.twitter.com/widgets.js - DIRECT/23.64.79.144 application/javascript
1343759484.681    309 192.168.1.15 TCP_MISS/304 839 GET http://apis.google.com/js/plusone.js - DIRECT/173.194.36.36 -
1343759485.005    178 192.168.1.15 TCP_MISS/200 495 GET http://www.google-analytics.com/__utm.gif? - DIRECT/74.125.236.142 image/gif
1343759502.763  20292 192.168.1.15 TCP_MISS/200 1898 CONNECT s-static.ak.facebook.com:443 - DIRECT/23.64.66.110 -
1343759502.765  20292 192.168.1.15 TCP_MISS/200 1898 CONNECT s-static.ak.facebook.com:443 - DIRECT/23.64.66.110 -
1343759723.040 240567 192.168.1.15 TCP_MISS/200 2904 CONNECT plusone.google.com:443 - DIRECT/173.194.36.41 -
1343759934.518    459 192.168.1.15 TCP_MISS/200 495 GET http://www.google-analytics.com/__utm.gif? - DIRECT/173.194.36.8 image/gif
1343759943.131   2186 192.168.1.15 TCP_MISS/200 8343 CONNECT www.facebook.com:443 - DIRECT/66.220.146.94 -
1343759943.266  10616 192.168.1.15 TCP_MISS/200 2790 CONNECT apis.google.com:443 - DIRECT/74.125.236.128 -
1343759943.267  10615 192.168.1.15 TCP_MISS/200 2228 CONNECT ssl.gstatic.com:443 - DIRECT/74.125.236.143 -
1343759950.875   2596 192.168.1.15 TCP_MISS/200 32219 CONNECT www.facebook.com:443 - DIRECT/66.220.146.94 -
1343759961.388  20443 192.168.1.15 TCP_MISS/200 1911 CONNECT s-static.ak.fbcdn.net:443 - DIRECT/23.64.77.177 -</pre>
</div>
<div>
<span style="background-color: white;"></span><br />
<div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
<span style="background-color: white;"><b><u><span style="color: #0b5394;">Troubleshooting :</span></u></b></span></div>
<span style="background-color: white;">
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
If you not able to browse using proxy settings , Disable the firewall ( iptables ) and selinux service on your squid proxy server .</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
<b>Disable firewall ( Iptables ) :-</b></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# service iptables stop
[root@hackthesec ~]# chkconfig iptables off</span></span></pre>
</div>
</span></div>
<div>
<span style="background-color: white;"></span><br />
<div>
<span style="background-color: white;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;"><span style="font-size: 15px; line-height: 26px;">Disable Selinux :- open the file /etc/selinux/config and find the line</span></span></span></div>
<span style="background-color: white;">
</span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">SELINUX=enforcing</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and replace with</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">SELINUX=disabled</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">now reboot the server and try step 4.</span></span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"></span></span><br />
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"><b><span style="color: #0b5394;"><u>Configure squid proxy as web filter:</u></span></b></span></span></div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;">
<div style="color: #333333;">
You can restrict user access to particular websites or keywords using access control lists (ACLs) .</div>
<div>
<b><span style="color: #0b5394;"><u>Restricting Access to specific web sites :</u></span></b></div>
<div style="color: #333333;">
For example , we can see how to block facebook.com and gmail.com .</div>
<div style="color: #333333;">
Step 1:- create a file ( <b>/etc/squid/blockedsites.squid</b> ) and add the site names one per line.</div>
</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# cat /etc/squid/blockedsites.squid
#blocked sites
www.facebook.com
www.gmail.com</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 2:- Open the /etc/squid/squid.conf and create a new acl " blocksites" and acl type "dstdomain" in the acl section like the below .</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
# ACL blocksites 
acl blocksites dstdomain "/etc/squid/blockedsites.squid"</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and add the following line "<b>http_access deny blocksites</b>" to http_section to deny the access to the acl "<b>blocksites</b>" .</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
# Deny access to blocksites ACL
http_access deny blocksites</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 3:- Now restart squid service</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# service squid restart</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 4:- Try to access facebook.com in your browser . you could see the blocked page as below .</span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitsQRp6xcr5AmcJgrWIHEyVE274ObQfkcEWpNTBGqT_25fkxX_ryBbASwHU-G3Iwsye8ZiK2CDfkIEo6AU3h-ZmCZtF4of10Dt34mqj-ryTojXljt7XEsIrjcl-LADcICkQ61A8Yl4cXKE/s1600/squid_proxy_server_block_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitsQRp6xcr5AmcJgrWIHEyVE274ObQfkcEWpNTBGqT_25fkxX_ryBbASwHU-G3Iwsye8ZiK2CDfkIEo6AU3h-ZmCZtF4of10Dt34mqj-ryTojXljt7XEsIrjcl-LADcICkQ61A8Yl4cXKE/s1600/squid_proxy_server_block_www.hackthesec.co.in.jpg" /></a></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;"><br /></span></span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and check the log file you can see the facebook request is denied .</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"> [root@hackthesec ~]# tail -f /var/log/squid/access.log
.................................................................................
1343820985.542      1 192.168.1.15 TCP_DENIED/403 4255 GET http://www.facebook.com/ - NONE/- text/html
1343820986.998   1411 192.168.1.15 TCP_MISS/200 13152 GET http://www.squid-cache.org/Artwork/SN.png - DIRECT/198.186.193.234 image/png
1343820987.004      0 192.168.1.15 TCP_DENIED/403 4178 GET http://www.facebook.com/favicon.ico - NONE/- text/html</pre>
</div>
<div>
<span style="background-color: white;"></span><br />
<div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
<span style="background-color: white;"><b><u><span style="color: #0b5394;">Restricting Access to specific keywords :</span></u></b></span></div>
<span style="background-color: white;">
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Step 1:- create a file (<b> /etc/squid/blockkeywords.squid</b> ) and add the keywords one per line.</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# cat /etc/squid/blockkeywords.squid
#blocked keywords
sex
porn
xxx</span></span></pre>
</div>
</span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 2:- Open the <b>/etc/squid/squid.conf</b> and create a new acl "blockkeywords" and acl type "url_regex" in the acl section</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
# ACL blocksites 
acl blocksites dstdomain "/etc/squid/blockedsites.squid"
# ACL blockkeywords
acl blockkeywords url_regex -i "/etc/squid/blockkeywords.squid"</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and add the following line "http_access deny blockkeywords" to http_section to deny the access to the acl "<b>blockkeywords</b>" .</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
# Deny access to blocksites ACL
http_access deny blocksites
# Deny access to blockkeywords ACL
http_access deny blockkeywords</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"></span></span><br />
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"><b><span style="color: #0b5394;"><u>Restricting Access to specific Ipaddress :</u></span></b></span></span></div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;">
<div style="color: #333333;">
Step 1:- create a file ( /etc/squid/blockip.squid ) and add the ip adresses one per line.</div>
</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# cat /etc/squid/blockip.squid
#blocked ips
192.168.1.20
192.168.1.21</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 2:- Open the /etc/squid/squid.conf and create a new acl "blockip" and acl type "src" in the acl section</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
# ACL blocksites 
acl blocksites dstdomain "/etc/squid/blockedsites.squid"
# ACL blockkeywords
acl blockkeywords url_regex -i "/etc/squid/blockkeywords.squid"
# ACL blockip
acl blockip src "/etc/squid/blockip.squid"</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and add the following line "http_access deny blockip" to http_section to deny the access to the acl "blockip" .</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
# Deny access to blockip ACL
http_access deny blockip
# Deny access to blocksites ACL
http_access deny blocksites
# Deny access to blockkeywords ACL
http_access deny blockkeywords</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"></span></span><br />
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"><b><u><span style="color: #0b5394;">Allow Full access to specific Ipaddress :</span></u></b></span></span></div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;">
<div style="color: #333333;">
You can allow specific ip address to gain full access without blocking sites and keywords . just create a file "/etc/squid/allowip.squid" and add the ip address one per line and create an acl "allowip"  and acl type "src" in the acl section</div>
</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># ACL allowip
acl allowip src "/etc/squid/allowip.squid"</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and add the "allowip" in the http_access as below</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
# Deny access to blockip ACL
http_access deny blockip
# Deny access to blocksites ACL
http_access deny blocksites !allowip
# Deny access to blockkeywords ACL
http_access deny blockkeywords !allowip</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"></span></span><br />
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;"><b><u><span style="color: #0b5394;">Changing squid proxy port number:</span></u></b></span></span></div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: "verdana" , "geneva" , sans-serif;">
<div style="color: #333333;">
You can change squid proxy port number , by default it uses 3128 port .</div>
<div style="color: #333333;">
Just find the below line in "/etc/squid/squid.conf"</div>
</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">http_port 3128</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and replace with</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">http_port 8000 # whatever port number you want</span></span></pre>
</div>
<div>
<span style="background-color: white;"></span><br />
<div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
<span style="background-color: white;"><b><u><span style="color: #0b5394;">Restricting Download size :</span></u></b></span></div>
<span style="background-color: white;">
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
You can restrict download file size  using reply_body_max_size .</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Add the below line at the bottom of the http_access section</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">#Restrict download size
reply_body_max_size 10 MB all</span></span></pre>
</div>
</span></div>
<div>
<span style="background-color: white; color: #333333; font-family: "verdana" , "geneva" , sans-serif; font-size: 15px; line-height: 26px;">or</span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">#Restrict download size
reply_body_max_size 10 MB !allowip</span></span></pre>
</div>
<div>
<span style="background-color: white;"></span><br />
<div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
<span style="background-color: white;"><b><u><span style="color: #0b5394;">Configuring Squid as Transparent Proxy :</span></u></b></span></div>
<span style="background-color: white;">
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
You can configure squid as transparent proxy .</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Step 1:- just find the below line</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;"># Squid normally listens to port 3128
http_port 3128</span></span></pre>
</div>
</span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and replace with</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;"># Squid normally listens to port 3128
http_port 3128 intercept</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 2:- Create a file "/root/squidfw.sh" and add the following firewall script ( modify as per your interface configuration ).</span></span></div>
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">#!/bin/sh
# squid server IP
SQUID_SERVER="192.168.1.11"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="3128"
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP</pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 3:- just run the script</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">[root@hackthesec ~]# sh /root/squidfw.sh</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">and add the below line to "/etc/rc.local" to run the script during startup</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;">sh /root/squidfw.sh</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;"></span></span><br />
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">Step 4 (Updated):- Change default gateway ip to squid server ip on the user machines </span></span></div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: "verdana" , "geneva" , sans-serif;">
<div>
Now users can access Internet without setting proxy in the browser settings.</div>
</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: medium;"><span style="line-height: 20.8px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></pre>
</div>
</div>

How to install squid proxy on centos

Install squid proxy on centos Squid is a caching and forwarding web proxy. It has a wide variety of uses, from speeding up a web server ...