[Day 4] 6. SQUID

For this setup, we need to configure Squid as a reverse proxy. Follow the steps below:

Important: SQUID runs on port 3128 by default. Make sure that your web server is not running (Apache or Nginx)

The Squid configuration file has over 9149 lines. Check its line count using:

bash
wc -l /etc/squid/squid.conf

Backup the configuration file before editing:

bash
cp /etc/squid/squid.conf /etc/squid/squid.conf.bak

Configure ACL (Access Control List):
- Search for the
```
ACL
```
  tag in the configuration file and scroll to the end of the ACL section. In Vim editor, you can use
```
/TAG: acl
```
  to search.
- Add the following ACL entry:
```
bash
acl shuhari_users dstdomain <squid_ip>
```
- Place this above the line that says
```
acl ssl_ports port 443
```
  . This tells Squid that any traffic with the destination IP
```
<squid_ip>
```
  is associated with
```
shuhari_users
```
  .
Allow Access for shuhari_users:
- Search for the
```
HTTP
```
  tag and scroll to the end of the HTTP section. In Vim editor, you can use
```
/TAG: http_access
```
  to search.
- Add this line:
```
bash
http_access allow shuhari_users
```
- Place it above the line
```
http_access deny !Safe_ports
```
  . This allows the
```
shuhari_users
```
  to pass through.

Set the HTTP Port for Squid:

Find the

http_port

section using

/TAG: http_port

. and add the following line:

bash
http_port 3128 accel defaultsite=<squid_ip> vhost

Configure Cache Peer:

Search for the

cache_peer

section using

/TAG: cache_peer

and add this line to the end of this section:

bash
cache_peer <apache_ip> parent 80 0 no-query originserver name=<line_name>

For the

cache_peer_access

section, add this to the end of this section:

bash
cache_peer_access <line_name> allow shuhari_users
cache_peer_access shuhari deny all

This allows
```
shuhari_users
```
to access the cache peer and denies all other access (recommended for security).

Restart Squid:

After making the changes, restart Squid:

bash
sudo systemctl restart squid
sudo systemctl status squid

Access the Proxy:

To test, try accessing Squid through the browser:

plaintext
http://<squid_ip>:3128

This setup configures Squid to act as a reverse proxy, forwarding requests to an Apache server. Ensure you replace placeholder values like

<squid_ip>

<apache_ip>

, and

<line_name>

with actual values specific to your network.