[리눅스마스터 1급 실기] 프록시(Proxy) 서버 관리 (squid)

프록시(Proxy) 서버 관리 (squid)

프록시의 정의

프록서(Proxy) 서버

• 보통 네트워크 속도가 느린 환경에서 보다 빠른 인터넷을 이용하기 위해 사용한다.
• 자주 방문하는 사이트의 정보를 저장하는 일종의 캐시(Cache) 서버
• 사용자들이 동일한 사이트에 접속할 경우, 서버에 저장된 데이터 정보를 전달함으로서 처리 속도를 높일 수 있다.

• 웹 사용자들을 무조건적으로 이용하게 하는 투명 프록시를 구성했을 경우, 네트워크 보안을 유지할 때도 사용할 수 있다.
  • 웹 사이트 접속 제한 등

 

Proxy의 서버 구성과 이용

• 리눅스에서 프록시 서버 프로그램으로 squid 를 주로 사용한다.
  • squid
    • 고성능의 웹 캐싱 서버
    • HTTP, Gopher, FTP 등 지원
    • 관련 사이트 : http://www.squid-cahce.org
    • 설치
      • yum install squid
• 클라이언트에서 Proxy 서버를 사용하기 위해서는 웹 브라우저에서 별도로 설정해야 한다.
  • 사용하는 웹 브라우저마다 다르지만, 환경 설정 영역에서 ‘프록시 서버 수동 설정’ 관련 부분에 프록시 서버 주소와 포트 번호를 적으면 사용 가능하다.
• iptables 기반으로 동작하는 클라이언트
  • 간단한 룰 셋 적용을 통해 별도의 설정이 필요 없는 투명 프록시를 구성할 수 있다.

 

squid

(1) squid의 개요

• 프록시 서버 프로그램인 squid 를 yum install squid 로 설치할 경우, 환경 설정 파일은 다음의 경로에 위치하게 된다.
  • /etc/squid/squid.conf
• 환경 설정 후, systemctl start squid.service 를 실행하면 프록시 서버를 사용할 수 있다.

 

(2) squid.conf 파일의 주요 설정

항목 1

http_port 3128

• squid 프록시 서버의 포트 번호를 지정하는 항목
• 기본 프트 : 3128

 

항목 2

cache_dir ufs /var/spool/squid 100 16 256

• 캐시 정보가 저장될 경로를 지정해주는 항목
• ufs : squid의 저장 포멧
• var/spool/squid : 관련 디렉터리
• 100 : 저장되는 캐시 정보의 크기 (단위 : MB )
• 16 : 캐시가 저장되는 첫 번째 하위 디렉터리의 개수
• 256 : 두 번째 하위 디렉터리의 개수

 

(3) 프록시 서버의 접근 제어

• squid.conf 파일은 acl(Access Control List) 항목을 이용해서 접근 제어 가능
  • acl
    • 다음을 별칭(Alias) 형태로 저장
      • IP 주소
      • 네트워크 대역
      • 도메인
    • 다음을 이용하여 접근 제어
      • http_access allow
      • http_access deny
    • 적용되는 규칙(Rule)
      • 중복 정책인 경우, 먼저 설정된 정책이 반영된다.

 

사용법

① acl 설정

acl 별칭 src IP 주소/넷마스크값
acl 별칭 dst IP 주소/넷마스크값
acl 별칭 srcdomain .foo.com
acl 별칭 dstdomain .foo.com

 

② acl에 대한 접근 제어

http_access allow 별칭
http_access deny 별칭

 

사용 예

① 특정 대역만 사용 허가 설정

acl starrykss src 192.168.4.0/255.255.255.0

http_access allow starrykss
http_access deny all

 

② 특정 대역만 사용 거부 설정

acl cracker src 192.168.3.0/255.255.255.0

http_access deny cracker
http_access allow all

 

③ 특정 도메인으로 들어오는 사용자들만 프록시 서버 사용 거부 설정

acl cracker srcdomain .cracker.org

http_access deny cracker
http_access allow all

 

④ 특정 도메인으로 들어오는 사용자들만 프록시 서버 사용 허가 설정

acl example srcdomain .example.org

http_access allow .example.com
http_access deny all

 

⑤ 프록시 사용자들의 특정 사이트로의 접속 막기

acl exploit dstdomain .exploit-db.org

http_access deny exploit
http_access allow all

 

문제 해결 전략

• rpm -qc squid 명령으로 검색하여 환경설정 파일인 /etc/squid/squid.conf 파일을 찾은 후, 내용을 확인한다.
  • 사용 방법이 주석 처리로 되어있다.

$ rpm -qc squid

/etc/httpd/conf.d/squid.conf
/etc/logrotate.d/squid
/etc/pam.d/squid
/etc/squid/cachemgr.conf
/etc/squid/cachemgr.conf.default
/etc/squid/errorpage.css
/etc/squid/errorpage.css.default
/etc/squid/mime.conf
/etc/squid/mime.conf.default
/etc/squid/squid.conf
/etc/squid/squid.conf.default
/etc/sysconfig/squid

 

$ cat /etc/squid/squid.conf

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern .		0	20%	4320

 

 

• 필요할 경우, man squid 명령을 사용하여 메뉴얼을 확인하면서 문제를 해결한다.

$ man squid

squid(8)                                 System Manager's Manual                                 squid(8)



NAME
       squid - HTTP web proxy caching server

SYNOPSIS
       squid  [-dhisrvzCFNRSVYX]  [-l  facility  ]  [-f config-file ] [-[au] port ] [-k signal ] [-n ser‐
       vice-name ] [-O command-line ]

DESCRIPTION
       squid is a high-performance proxy caching server for web clients, supporting  FTP,  gopher,  ICAP,
       ICP,  HTCP and HTTP data objects.  Unlike traditional caching software, Squid handles all requests
       in a single, non-blocking process.

       Squid keeps meta data and especially hot objects cached  in  RAM,  caches  DNS  lookups,  supports
       non-blocking DNS lookups, and implements negative caching of failed requests.

       Squid supports SSL, extensive access controls, and full request logging.  By using the lightweight
       Internet Cache Protocols ICP, HTCP or CARP, Squid caches can be arranged in a  hierarchy  or  mesh
       for additional bandwidth savings.

       Squid  consists  of a main server program squid , some optional programs for custom processing and
       authentication, and some management and client tools.  When squid starts up, it spawns  a  config‐
       urable  number  of helper processes, each of which can perform parallel lookups.  This reduces the
       amount of time the cache waits for results.

       Squid is derived from the ARPA-funded Harvest Project.

       This manual page only lists the command line arguments.  For details on how to configure Squid see
       the  file  /usr/share/doc/squid-3.5.20/squid.conf.documented,  the  Squid wiki FAQ and examples at
       http://wiki.squid-cache.org/  ,  or  the   configuration   manual   on   the   Squid   home   page
       http://www.squid-cache.org/Doc/config/

OPTIONS
       -a port     Specify  HTTP  port  number where Squid should listen for requests, in addition to any
                   http_port specifications in squid.conf

       -C          Do not catch fatal signals.

       -d level    Write debugging to stderr also.

       -f file     Use the given config-file instead of /etc/squid/squid.conf .  If the file name  starts
                   with  a !  or | then it is assumed to be an external command or command line.  Can for
                   example be used to pre-process the configuration before it is being read by Squid.  To
                   facilitate  this  Squid  also understands the common #line notion to indicate the real
                   source file.

       -F          Don't serve any requests until store is rebuilt.

       -h          Print help message.

       -i          Install as a Windows Service (see -n option).

       -k reconfigure | rotate | shutdown | interrupt | kill | debug | check | parse
                   Parse configuration file, then send signal to running copy  (except  -k  parse  )  and
                   exit.

       -l facility Use specified syslog facility. Implies -s

       -n name     Specify Windows Service name to use for service operations, default is: Squid

       -N          No daemon mode.

       -O options  Set Windows Service Command line options in Registry.

       -r          Remove a Windows Service (see -n option).

       -R          Do not set REUSEADDR on port.

       -s          Enable logging to syslog. Also configurable in /etc/squid/squid.conf

       -S          Double-check swap during rebuild.

       -u port     Specify ICP port number (default: 3130), disable with 0.

       -v          Print version and build details.

       -X          Force full debugging.

       -Y          Only return UDP_HIT or UDP_MISS_NOFETCH during fast reload.

       -z          Create missing swap directories and other missing cache_dir structures, then exit. All
                   cache_dir types create the configured top-level directory  if  it  is  missing.  Other
                   actions  are  type-specific.  For example, ufs-based storage systems create missing L1
                   and L2 directories while Rock creates the missing database file.

                   This option does not enable validation of any present swap structures. Its focus is on
                   creation of missing pieces. If nothing is missing, squid -z just exits. If you suspect
                   cache_dir corruption, you must delete the top-level cache_dir directory before running
                   squid -z.

                   By  default,  squid -z runs in daemon mode (so that configuration macros and other SMP
                   features work as expected). Use -N option to overwrite this.

FILES
       Squid configuration files located in /etc/squid/:

       squid.conf
              The main configuration file. You must initially make changes to  this  file  for  squid  to
              work.  For  example, the default configuration only allows access from RFC private LAN net‐
              works.  Some packaging distributions block even that.

       squid.conf.default
              Reference copy of the configuration file. Always kept up to date with the version of  Squid
              you are using.

              Use this to look up the default configuration settings and syntax after upgrading.

       squid.conf.documented
              Reference  copy of the configuration file. Always kept up to date with the version of Squid
              you are using.

              Use this to read the documentation for configuration options available  in  your  build  of
              Squid.  The  online configuration manual is also available for a full reference of options.
              seehttp://www.squid-cache.org/Doc/config/

       cachemgr.conf
              The main configuration file for the web cachemgr.cgi tools.

       msntauth.conf
              The main configuration file for the Sample MSNT authenticator.

       errorpage.css
              CSS Stylesheet to control the display of generated error pages.  Use this to set  any  com‐
              pany branding you need, it will apply to every language Squid provides error pages for.

       Some files also located elsewhere:

       /etc/squid/mime.conf (mime_table)
              MIME type mappings for FTP gatewaying

       /usr/share/squid/errors
              Location of Squid error pages and templates.

AUTHOR
       Squid was written over many years by a changing team of developers and maintained in turn by Duane
       Wessels <duane@squid-cache.org> Henrik Nordstrom  <hno@squid-cache.org>  Amos  Jeffries  <amosjef‐
       fries@squid-cache.org>

       With  contributions  from many others in the Squid community.  see CONTRIBUTORS for a full list of
       individuals who contributed code.  see CREDITS for a list of  major  code  contributing  copyright
       holders.

COPYRIGHT
        * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
        *
        * Squid software is distributed under GPLv2+ license and includes
        * contributions from numerous individuals and organizations.
        * Please see the COPYING and CONTRIBUTORS files for details.

QUESTIONS
       Questions  on  the  usage  of  this  program  can  be sent to the Squid Users mailing list <squid-
       users@squid-cache.org>

REPORTING BUGS
       Bug reports need to be made in English.  See http://wiki.squid-cache.org/SquidFaq/BugReporting for
       details of what you need to include with your bug report.

       Report bugs or bug fixes using http://bugs.squid-cache.org/

       Report serious security bugs to Squid Bugs <squid-bugs@squid-cache.org>

       Report ideas for new improvements to the Squid Developers mailing list <squid-dev@squid-cache.org>

SEE ALSO
       cachemgr.cgi  (8),  squidclient  (1),  basic_pam_auth (8), basic_ldap_auth (8), ext_ldap_group_acl
       (8), ext_session_acl (8), ext_unix_group_acl (8),
       The Squid FAQ wiki http://wiki.squid-cache.org/SquidFaq
       The Squid Configuration Manual http://www.squid-cache.org/Doc/config/



                                                                                                 squid(8)

 

문제 유형

① squid 프록시 서버의 접근 제한 설정을 하는 과정에 대한 문제

• 특정 호스트에 대한 별칭은 acl 로 지정하고, 네트워크 대역 표기법은 10.20.30.40/255.255.255.0 또는 10.20.30.40/24 와 같은 형식만 가능하다.
• 접근 제어는 http_access 항목에서 allow 또는 deny를 사용한다.

(  acl  ) kait src (  10.20.117.0/24(또는 10.20.17.0/255.255.255.0)  )
http_access (  allow ) (  kait  )
http_access (  deny  ) (  all  )

 

② squid 환경 설정 파일에 주요 설정을 하는 문제

가. Proxy 서버 포트를 8080으로 지정한다.
(  http_port 8080  )

나. 192.168.5.0 네트워크 내역에 호스트들의 별칭을 ihdnet으로 설정하고, 해당 호스트들의 사용을 허가로 설정한다.
(  acl ihdnet src 192.168.5.0/24  )
(  http_access allow ihdnet  )