Configure the /etc/squid/squid.conf file -in httpd-accelerator mode

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev | Chapter 28. Software -Server/Proxy Network | Next

# 28.6. Configure the `/etc/squid/squid.conf` file -in `httpd-accelerator mode`

The `squid.conf` file is used to set and configure all the different options for your Squid proxy server. In the configuration file below, we'll configure the `/etc/squid/squid.conf` file to be in `httpd-accelerator` mode. In this acceleration mode, if the Web Server runs on the same server where Squid is installed, you must set its daemon to run on port 81. With the Apache web server, you can do it by assigning the line `Port 80` to `Port 81` in its `httpd.conf` file. If the Web Server runs on other servers in your network like we do, you can keep the same port number (80) for Apache, since Squid will bind on a different IP number where port (80) is not already in use.

Edit the `squid.conf file`, vi `/etc/squid/squid.conf` and add/change the following options:

                     http_port 80
                     icp_port 0
                     acl QUERY urlpath_regex cgi-bin \?
                     no_cache deny QUERY
                     cache_mem 16 MB
                     cache_dir ufs /cache 200 16 256
                     emulate_httpd_log on
                     redirect_rewrites_host_header off
                     replacement_policy GDSF
                     acl all src 0.0.0.0/0.0.0.0
                     http_access allow all
                     cache_mgr admin@openna.com
                     cache_effective_user squid
                     cache_effective_group squid
                     httpd_accel_host 208.164.186.3
                     httpd_accel_port 80
                     log_icp_queries off
                     cachemgr_passwd my-secret-pass all
                     buffered_logs on

This tells the `squid.conf` file to set itself up for this particular configuration setup with:

`http_port` 80

  The option `http_port` specifies the port number where Squid will listen for HTTP client requests. If you set this option to port 80, the client will have the illusion of being connected to the Apache Web Server. Since we are running Squid in accelerator mode, we must listen on port 80.

`icp_port 0`

  The option `icp_port` specifies the port number where Squid will sends and receive ICP requests from neighboring caches. We must set the value of this option to 0 to disable it, since we are configuring Squid to be in accelerator mode for the Web Server. The ICP feature is needed only in a multi-level cache environment with multiple siblings and parent caches. Using ICP in an accelerator mode configuration would add unwanted overhead to Squid.

`acl QUERY urlpath_regex cgi-bin \? and no_cache deny QUERY`

  The options `acl QUERY urlpath_regex cgi-bin \? and no_cache deny QUERY` are used to force certain objects to never be cached, like files under `cgi-bin` directory. This is a security feature.

`cache_mem 16 MB`

  The option `cache_mem` specifies the amount of memory; RAM, to be used for caching the so called: In-Transit objects, Hot Objects, Negative-Cached objects. This is an optimization feature. It's important to note that Squid can uses much more memory than the value you specify in this parameter, and for this reason if you have 48 MB free for Squid, you must put 48/3 = 16 MB here.

`cache_dir ufs /cache 200 16 256`

  The option `cache_dir` specifies in this order: which kind of storage system to use; ufs, the name of the cache directory; `/cache` for Squid, the disk space in megabytes to use under this directory 200 Mbytes, the number of first-level subdirectories to be created under the cache directory; 16 Level-1, and the number of second-level subdirectories to be created under each first-level cache directory; 256 Level-2. In accelerator mode, this option is directly related to the size and number of files that you want to serve with your Apache web server.

`emulate_httpd_log on`

  The option `emulate_httpd_log,` if set to `ON,` specifies that Squid should emulate the log file format of the Apache web server. This is very useful if you want to use a third party program like Webalizer to analyze the Web Server `httpd` log file.

`redirect_rewrites_host_header off`

  The option `redirect_rewrites_host_header`, if set to `OFF,` tells Squid to not rewrites any Host: header in redirected requests. It's recommended to set this option to `OFF` if you are running Squid in accelerator mode.

`replacement_policy GDSF`

  The option `replacement_policy` specifies the cache policy Squid will use to determine which objects in the cache must be replaced when the proxy need to make disk space. The Squid LRU policy is used by default if you have not specified the `--enable-heap-replacement` option during compile time. In our configuration, we choose the GDSF -Greedy-Dual Size Frequency policy as our default policy. See http://www.hpl.hp.com/techreports/1999/HPL-1999-69.html and http://fog.hpl.external.hp.com/techreports/98/HPL-98-173.html for more information.

`acl all src 0.0.0.0/0.0.0.0` and `http_access allow all`

  The options `acl` and `http_access` specify and define an access control list to be applied on the proxy server Squid. Our `acl` and `http_access` options are not restricted, and allow every one to connect on the proxy server since we use this proxy to accelerate the public Apache Web Server. See your Squid documentation for more information when using Squid in non-accelerator mode.

`cache_mgr admin`

  The option `cache_mgr` specify the email-address of the administrator responsible for the Squid proxy server. This person is the one who will receive mail if Squid encounter problems. You can specify the name or the complete email address in this option.

`cache_effective_user squid` and `cache_effective_group squid`

  The options `cache_effective_user` and `cache_effective_group` specify the UID/GID that the cache will run on. Don't forget to never run Squid as `root`. In our configuration we use the UID `squid` and the GID `squid`.

`httpd_accel_host 208.164.186.3` and `httpd_accel_port 80`

  The options `httpd_accel_host` and `httpd_accel_port` specify to Squid the IP address and port number where the real HTTP Server i.e. Apache is. In our configuration, the real HTTP Web Server is on the IP address `208.164.186.3`, `www.openna.com` and on port (80). `www.openna.com` is another host name on our network, and since the Squid Proxy Server doesn't reside on the same host of Apache HTTP Web Server, we can use port (80) for our Squid Proxy Server, and port (80) for our Apache Web Server, and the illusion is perfect.

`log_icp_queries off`

  The option `log_icp_queries` specifies if you want ICP; ICP is used to exchange hints about the existence of URLs in neighbor caches queries to be logged to the `access.log` file or not. Since we don't use the ICP feature in Squid accelerator mode, we can safely set this option to `OFF`.

`cachemgr_passwd my-secret-pass all`

  The option `cachemgr_passwd` specifies a password that will be required for accessing the operations of the `cachemgr.cgi` program utility. This CGI utility program is designed to run through a web interface and outputs statistics about the Squid configuration and performance. The `my-secret-pass` is the password that you have chosen, and the keyword `all` specifies to set this password to be the same for all actions you can perform with this program. See The cachemgr.cgi program utility of Squid, below in this chapter for more information.

`buffered_logs on`

  The option `buffered_logs`, if turned `ON`, can speed up the writing of some log files slightly. This is an optimization feature.

Prev | Home | Next
Configurations | Up | Configure of the `/etc/squid/squid.conf` file -/proxy-caching mode