Squid

http://www.squid-cache.org/Doc/
Admin
Squid is an open-source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more, designed to...
Tokens:72,098
Snippets:1,216
Trust Score:9.7
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example cache_swap_log configuration

Source: http://www.squid-cache.org/Doc/config/cache_swap_log/index.html

Example showing the configuration block for the cache_swap_log directive.

```text
	Location for the cache "swap.state" file. This log file holds
	the metadata of objects saved on disk.  It is used to rebuild
	the cache during startup.  Normally this file resides in each
	'cache_dir' directory, but you may specify an alternate
	pathname here.  Note you must give a full filename, not just
	a directory. Since this is the index for the whole object
	list you CANNOT periodically rotate it!

	If %s can be used in the file name it will be replaced with a
	a representation of the cache_dir name where each / is replaced
	with '.'. This is needed to allow adding/removing cache_dir
	lines when cache_swap_log is being used.

	If have more than one 'cache_dir', and %s is not used in the name
	these swap logs will have names such as:

		cache_swap_log.00
		cache_swap_log.01
		cache_swap_log.02

	The numbered extension (which is added automatically)
	corresponds to the order of the 'cache_dir' lines in this
	configuration file.  If you change the order of the 'cache_dir'
	lines in this file, these log files will NOT correspond to
	the correct 'cache_dir' entry (unless you manually rename
	them).  We recommend you do NOT use this option.  It is
	better to keep these log files in each 'cache_dir' directory.
```

--------------------------------

### Configure cachemgr_passwd examples

Source: http://www.squid-cache.org/Doc/config/cachemgr_passwd

Examples showing how to set passwords for specific actions, multiple actions, or all actions.

```text
 cachemgr_passwd secret shutdown
 cachemgr_passwd lesssssssecret info stats/objects
 cachemgr_passwd disable all
```

--------------------------------

### Example client_delay_access configuration

Source: http://www.squid-cache.org/Doc/config/client_delay_access

Example rules assigning different networks to specific delay pools.

```text
client_delay_access 1 allow low_rate_network
client_delay_access 2 allow vips_network
```

--------------------------------

### Example adaptation_service_set configurations

Source: http://www.squid-cache.org/Doc/config/adaptation_service_set

Practical examples of defining service sets for blocking and logging purposes.

```text
adaptation_service_set svcBlocker urlFilterPrimary urlFilterBackup
adaptation service_set svcLogger loggerLocal loggerRemote
```

--------------------------------

### Example adaptation service chain configuration

Source: http://www.squid-cache.org/Doc/config/adaptation_service_chain

A practical example of chaining multiple services for request processing.

```text
adaptation_service_chain svcRequest requestLogger urlFilter leakDetector
```

--------------------------------

### Common ACL configuration examples

Source: http://www.squid-cache.org/Doc/config/acl

Standard examples for matching MAC addresses, destination AS numbers, authentication requirements, and MIME types.

```text
acl macaddress arp 09:00:2b:23:45:67
acl myexample dst_as 1241
acl password proxy_auth REQUIRED
acl fileupload req_mime_type -i ^multipart/form-data$
acl javascript rep_mime_type -i ^application/x-javascript$
```

--------------------------------

### request_header_add configuration example

Source: http://www.squid-cache.org/Doc/config/request_header_add

Basic syntax and usage example for adding a custom header to outgoing requests.

```text
Usage:   request_header_add field-name field-value [ acl ... ]
Example: request_header_add X-Client-CA "CA=%ssl::>cert_issuer" all
```

--------------------------------

### Configure upgrade_http0.9 exception

Source: http://www.squid-cache.org/Doc/config/upgrade_http0.9

Example configuration to prevent upgrading ShoutCast responses to HTTP.

```squid
# Don't upgrade ShoutCast responses to HTTP
acl shoutcast rep_header X-HTTP09-First-Line ^ICY.[0-9]
upgrade_http0.9 deny shoutcast
```

--------------------------------

### Configure htcp_access rules

Source: http://www.squid-cache.org/Doc/config/htcp_access

Example configuration for restricting HTCP queries to local networks.

```text
# Allow HTCP queries from local networks only
#htcp_access allow localnet
#htcp_access deny all
```

--------------------------------

### Configure udp_outgoing_address

Source: http://www.squid-cache.org/Doc/config/udp_outgoing_address

Example configuration block for the udp_outgoing_address directive.

```text
	udp_outgoing_address	is used for UDP packets sent out to other
				caches.

	The default behavior is to not bind to any specific address.

	Instead it will use the same socket as udp_incoming_address.
	Only change this if you want to have UDP queries sent using another
	address than where this Squid listens for UDP queries from other
	caches.

	NOTE: udp_outgoing_address is used by the ICP, HTCP, and DNS
	modules. Altering it will affect all of them in the same manner.

	see also; udp_incoming_address

	NOTE, udp_incoming_address and udp_outgoing_address can not
	have the same value since they both use the same port.
```

--------------------------------

### Configure auth_param authentication schemes

Source: http://www.squid-cache.org/Doc/config/auth_param

Example configuration for various authentication schemes including negotiate, digest, ntlm, and basic.

```text
#auth_param negotiate program <uncomment and complete this line to activate>
#auth_param negotiate children 20 startup=0 idle=1
#
#auth_param digest program <uncomment and complete this line to activate>
#auth_param digest children 20 startup=0 idle=1
#auth_param digest realm Squid proxy-caching web server
#auth_param digest nonce_garbage_interval 5 minutes
#auth_param digest nonce_max_duration 30 minutes
#auth_param digest nonce_max_count 50
#
#auth_param ntlm program <uncomment and complete this line to activate>
#auth_param ntlm children 20 startup=0 idle=1
#
#auth_param basic program <uncomment and complete this line>
#auth_param basic children 5 startup=5 idle=1
#auth_param basic credentialsttl 2 hours
```

--------------------------------

### Suggested icp_access Configuration

Source: http://www.squid-cache.org/Doc/config/icp_access

Example configuration for allowing ICP queries from local networks while denying all others.

```text
# Allow ICP queries from local networks only
#icp_access allow localnet
#icp_access deny all
```

--------------------------------

### Configure cache_store_log output

Source: http://www.squid-cache.org/Doc/config/cache_store_log

Examples of configuring the storage log path using different output modules.

```text
cache_store_log stdio:/usr/local/squid/var/logs/store.log
cache_store_log daemon:/usr/local/squid/var/logs/store.log
```

--------------------------------

### Configure snmp_access rules

Source: http://www.squid-cache.org/Doc/config/snmp_access

Example configuration for allowing access to the SNMP port from localhost and denying all other traffic.

```text
snmp_access allow snmppublic localhost
snmp_access deny all
```

--------------------------------

### Configure mark_client_connection for FTP

Source: http://www.squid-cache.org/Doc/config/mark_client_connection

Example configuration to mark intercepted FTP connections using a specific mask.

```text
acl proto_ftp proto FTP
mark_client_connection 0x200/0xff00 proto_ftp
```

--------------------------------

### Configure WCCP2 services

Source: http://www.squid-cache.org/Doc/config/wccp2_service

Examples of defining standard and dynamic WCCP2 services, including optional MD5 password authentication.

```text
wccp2_service standard 0	w# for the 'web-cache' standard service
wccp2_service dynamic 80	# a dynamic service type which will be
				# fleshed out with subsequent options.
wccp2_service standard 0 password=foo
```

--------------------------------

### Configure Protocol Upgrade Rules

Source: http://www.squid-cache.org/Doc/config/http_upgrade_request_protocols

Examples demonstrating how to allow or deny specific protocols using the http_upgrade_request_protocols directive.

```squid
# never upgrade to protocol Foo; all others are OK
http_upgrade_request_protocols Foo deny all
http_upgrade_request_protocols OTHER allow all
```

```squid
# only allow upgrades to protocol Bar (except for its first version)
http_upgrade_request_protocols Bar/1 deny all
http_upgrade_request_protocols Bar allow all
http_upgrade_request_protocols OTHER deny all # this rule is optional
```

```squid
# only allow upgrades to protocol Baz, and only if Baz is the only offer
acl UpgradeHeaderHasMultipleOffers ...
http_upgrade_request_protocols Baz deny UpgradeHeaderHasMultipleOffers
http_upgrade_request_protocols Baz allow all
```

--------------------------------

### Configure a basic disk cache directory

Source: http://www.squid-cache.org/Doc/config/cache_dir

Example configuration line to enable a disk cache using the ufs storage type.

```text
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /usr/local/squid/var/cache/squid 100 16 256
```

--------------------------------

### Configure Round-Robin Cache Directory Selection

Source: http://www.squid-cache.org/Doc/config/store_dir_select_algorithm

Example of interleaving cache_dir configurations to prevent selection bias when using the round-robin algorithm.

```text
store_dir_select_algorithm round-robin
cache_dir rock /hdd1 ... min-size=100000
cache_dir rock /ssd1 ... max-size=99999
cache_dir rock /hdd2 ... min-size=100000
cache_dir rock /ssd2 ... max-size=99999
cache_dir rock /hdd3 ... min-size=100000
cache_dir rock /ssd3 ... max-size=99999
```

--------------------------------

### Configure SSL Bumping Rules

Source: http://www.squid-cache.org/Doc/config/ssl_bump

Example configuration to splice traffic from localhost or specific domains while bumping all other TLS connections.

```text
# Example: Bump all TLS connections except those originating from
# localhost or those going to example.com.

acl broken_sites ssl::server_name .example.com
ssl_bump splice localhost
ssl_bump splice broken_sites
ssl_bump bump all
```

--------------------------------

### Configure reply_body_max_size

Source: http://www.squid-cache.org/Doc/config/reply_body_max_size

Example syntax for setting the maximum reply body size in the Squid configuration file.

```text
reply_body_max_size 10 MB
```

--------------------------------

### Configure request_header_replace

Source: http://www.squid-cache.org/Doc/config/request_header_replace

Defines the syntax and provides an example for replacing a specific request header with a fixed string.

```text
	Usage:   request_header_replace header_name message
	Example: request_header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
```

--------------------------------

### Configure mark_client_packet with ACLs

Source: http://www.squid-cache.org/Doc/config/mark_client_packet

Example configuration applying different Netfilter MARK values to packets based on source network ACLs.

```text
acl normal_service_net src 10.0.0.0/24
acl good_service_net src 10.0.1.0/24
mark_client_packet 0x00 normal_service_net
mark_client_packet 0x20 good_service_net
```

--------------------------------

### Configure on_unsupported_protocol actions

Source: http://www.squid-cache.org/Doc/config/on_unsupported_protocol

Example configuration showing how to use ACLs to define whether Squid should tunnel or respond to unsupported protocols.

```squid
  # define what Squid errors indicate receiving non-HTTP traffic:
  acl foreignProtocol squid_error ERR_PROTOCOL_UNKNOWN ERR_TOO_BIG
  # define what Squid errors indicate receiving nothing:
  acl serverTalksFirstProtocol squid_error ERR_REQUEST_START_TIMEOUT
  # tunnel everything that does not look like HTTP:
          on_unsupported_protocol tunnel foreignProtocol
  # tunnel if we think the client waits for the server to talk first:
  on_unsupported_protocol tunnel serverTalksFirstProtocol
  # in all other error cases, just send an HTTP "error page" response:
  on_unsupported_protocol respond all
```

--------------------------------

### Configure clientside_mark with ACLs

Source: http://www.squid-cache.org/Doc/config/clientside_mark

Example configuration applying different Netfilter mark values to packets based on source network ACLs.

```text
acl normal_service_net src 10.0.0.0/24
acl good_service_net src 10.0.1.0/24
clientside_mark 0x00 normal_service_net
clientside_mark 0x20 good_service_net
```

--------------------------------

### Replicate http_anonymizer paranoid behavior

Source: http://www.squid-cache.org/Doc/config/request_header_access

Example configuration to explicitly allow necessary headers and deny all others for a paranoid anonymization policy.

```text
request_header_access Authorization allow all
request_header_access Proxy-Authorization allow all
request_header_access Cache-Control allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Connection allow all
request_header_access All deny all
```

--------------------------------

### Configure delay pool limits

Source: http://www.squid-cache.org/Doc/config/delay_parameters

Examples of applying specific bandwidth limits to different delay pool classes using the restore/maximum syntax.

```text
delay_parameters 1 none 8000/8000
```

```text
delay_parameters 2 32000/32000 8000/8000 600/8000
```

```text
delay_parameters 4 32000/32000 8000/8000 600/64000 16000/16000
```

--------------------------------

### Configure reply_header_replace

Source: http://www.squid-cache.org/Doc/config/reply_header_replace

Example usage of the reply_header_replace directive to modify the Server header.

```text
reply_header_replace Server Foo/1.0
```

--------------------------------

### Configure server_pconn_for_nonretriable

Source: http://www.squid-cache.org/Doc/config/server_pconn_for_nonretriable

Example showing how to define an ACL and apply the server_pconn_for_nonretriable directive to allow persistent connection reuse for specific request methods.

```squid
acl SpeedIsWorthTheRisk method POST
server_pconn_for_nonretriable allow SpeedIsWorthTheRisk
```

--------------------------------

### Configure accept_filter for FreeBSD and Linux

Source: http://www.squid-cache.org/Doc/config/accept_filter

Examples of enabling accept filters for HTTP readiness or data availability on supported operating systems.

```text
accept_filter httpready
accept_filter data
```

--------------------------------

### Configure reply_header_add

Source: http://www.squid-cache.org/Doc/config/reply_header_add

Example usage of the reply_header_add directive to inject a custom header into HTTP responses.

```text
reply_header_add X-Client-CA "CA=%ssl::>cert_issuer" all
```

--------------------------------

### Configure cache_peer_domain restrictions

Source: http://www.squid-cache.org/Doc/config/cache_peer_domain

Examples of defining domain-based query restrictions for a neighbor cache host.

```text
cache_peer_domain cache-host domain [domain ...]
cache_peer_domain cache-host !domain
```

```text
cache_peer_domain parent.foo.net	.edu
```

--------------------------------

### Configure always_direct for FTP requests

Source: http://www.squid-cache.org/Doc/config/always_direct

Example of forcing all FTP protocol requests to be forwarded directly.

```squid
acl FTP proto FTP
always_direct allow FTP
```

--------------------------------

### Configure adaptation_masterx_shared_names

Source: http://www.squid-cache.org/Doc/config/adaptation_masterx_shared_names

Example usage of the directive to specify a shared header name for adaptation transactions.

```text
adaptation_masterx_shared_names X-Subscriber-ID
```

--------------------------------

### Replicate http_anonymizer standard behavior

Source: http://www.squid-cache.org/Doc/config/request_header_access

Example configuration to deny specific headers to achieve standard anonymization.

```text
request_header_access From deny all
request_header_access Referer deny all
request_header_access User-Agent deny all
```

--------------------------------

### Configure Basic Authentication Parameters

Source: http://www.squid-cache.org/Doc/config/auth_param

Directives for managing Basic authentication credential TTL and username case sensitivity.

```text
"credentialsttl" timetolive
"casesensitive" on|off
```

--------------------------------

### Configure header_replace directive

Source: http://www.squid-cache.org/Doc/config/header_replace

Usage syntax and example for replacing a specific HTTP header with a fixed string.

```text
	Usage:   header_replace header_name message
	Example: header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
```

--------------------------------

### Configure rock storage type

Source: http://www.squid-cache.org/Doc/config/cache_dir

Usage syntax for the SMP-aware rock database-style storage format.

```text
Usage:
	    cache_dir rock Directory-Name Mbytes [options]
```

--------------------------------

### Configure always_direct for local servers

Source: http://www.squid-cache.org/Doc/config/always_direct

Example of forcing requests for a specific domain to bypass cache peers.

```squid
acl local-servers dstdomain my.domain.net
always_direct allow local-servers
```

--------------------------------

### Configure reply_header_access for anonymization

Source: http://www.squid-cache.org/Doc/config/reply_header_access

Examples demonstrating how to configure header access to mimic standard or paranoid anonymizer settings.

```text
reply_header_access Server deny all
		reply_header_access WWW-Authenticate deny all
		reply_header_access Link deny all
```

```text
reply_header_access Allow allow all
		reply_header_access WWW-Authenticate allow all
		reply_header_access Proxy-Authenticate allow all
		reply_header_access Cache-Control allow all
		reply_header_access Content-Encoding allow all
		reply_header_access Content-Length allow all
		reply_header_access Content-Type allow all
		reply_header_access Date allow all
		reply_header_access Expires allow all
		reply_header_access Last-Modified allow all
		reply_header_access Location allow all
		reply_header_access Pragma allow all
		reply_header_access Content-Language allow all
		reply_header_access Retry-After allow all
		reply_header_access Title allow all
		reply_header_access Content-Disposition allow all
		reply_header_access Connection allow all
		reply_header_access All deny all
```

--------------------------------

### Configure sslproxy_cert_adapt

Source: http://www.squid-cache.org/Doc/config/sslproxy_cert_adapt

Syntax for defining certificate adaptation algorithms with associated ACLs.

```text
sslproxy_cert_adapt <adaptation algorithm> acl ...
```

--------------------------------

### Define ICAP Services

Source: http://www.squid-cache.org/Doc/config/icap_service

Examples of defining ICAP services using the icap_service directive with different protocols and parameters.

```text
icap_service svcBlocker reqmod_precache icap://icap1.mydomain.net:1344/reqmod bypass=0
icap_service svcLogger reqmod_precache icaps://icap2.mydomain.net:11344/reqmod routing=on
```
Tokens:
Raw