### Example cache_swap_log configuration Source: http://www.squid-cache.org/Doc/config/cache_swap_log/index.html Example showing the configuration block for the cache_swap_log directive. ```text Location for the cache "swap.state" file. This log file holds the metadata of objects saved on disk. It is used to rebuild the cache during startup. Normally this file resides in each 'cache_dir' directory, but you may specify an alternate pathname here. Note you must give a full filename, not just a directory. Since this is the index for the whole object list you CANNOT periodically rotate it! If %s can be used in the file name it will be replaced with a a representation of the cache_dir name where each / is replaced with '.'. This is needed to allow adding/removing cache_dir lines when cache_swap_log is being used. If have more than one 'cache_dir', and %s is not used in the name these swap logs will have names such as: cache_swap_log.00 cache_swap_log.01 cache_swap_log.02 The numbered extension (which is added automatically) corresponds to the order of the 'cache_dir' lines in this configuration file. If you change the order of the 'cache_dir' lines in this file, these log files will NOT correspond to the correct 'cache_dir' entry (unless you manually rename them). We recommend you do NOT use this option. It is better to keep these log files in each 'cache_dir' directory. ``` -------------------------------- ### Configure cachemgr_passwd examples Source: http://www.squid-cache.org/Doc/config/cachemgr_passwd Examples showing how to set passwords for specific actions, multiple actions, or all actions. ```text cachemgr_passwd secret shutdown cachemgr_passwd lesssssssecret info stats/objects cachemgr_passwd disable all ``` -------------------------------- ### Example client_delay_access configuration Source: http://www.squid-cache.org/Doc/config/client_delay_access Example rules assigning different networks to specific delay pools. ```text client_delay_access 1 allow low_rate_network client_delay_access 2 allow vips_network ``` -------------------------------- ### Example adaptation_service_set configurations Source: http://www.squid-cache.org/Doc/config/adaptation_service_set Practical examples of defining service sets for blocking and logging purposes. ```text adaptation_service_set svcBlocker urlFilterPrimary urlFilterBackup adaptation service_set svcLogger loggerLocal loggerRemote ``` -------------------------------- ### Example adaptation service chain configuration Source: http://www.squid-cache.org/Doc/config/adaptation_service_chain A practical example of chaining multiple services for request processing. ```text adaptation_service_chain svcRequest requestLogger urlFilter leakDetector ``` -------------------------------- ### Common ACL configuration examples Source: http://www.squid-cache.org/Doc/config/acl Standard examples for matching MAC addresses, destination AS numbers, authentication requirements, and MIME types. ```text acl macaddress arp 09:00:2b:23:45:67 acl myexample dst_as 1241 acl password proxy_auth REQUIRED acl fileupload req_mime_type -i ^multipart/form-data$ acl javascript rep_mime_type -i ^application/x-javascript$ ``` -------------------------------- ### request_header_add configuration example Source: http://www.squid-cache.org/Doc/config/request_header_add Basic syntax and usage example for adding a custom header to outgoing requests. ```text Usage: request_header_add field-name field-value [ acl ... ] Example: request_header_add X-Client-CA "CA=%ssl::>cert_issuer" all ``` -------------------------------- ### Configure upgrade_http0.9 exception Source: http://www.squid-cache.org/Doc/config/upgrade_http0.9 Example configuration to prevent upgrading ShoutCast responses to HTTP. ```squid # Don't upgrade ShoutCast responses to HTTP acl shoutcast rep_header X-HTTP09-First-Line ^ICY.[0-9] upgrade_http0.9 deny shoutcast ``` -------------------------------- ### Configure htcp_access rules Source: http://www.squid-cache.org/Doc/config/htcp_access Example configuration for restricting HTCP queries to local networks. ```text # Allow HTCP queries from local networks only #htcp_access allow localnet #htcp_access deny all ``` -------------------------------- ### Configure udp_outgoing_address Source: http://www.squid-cache.org/Doc/config/udp_outgoing_address Example configuration block for the udp_outgoing_address directive. ```text udp_outgoing_address is used for UDP packets sent out to other caches. The default behavior is to not bind to any specific address. Instead it will use the same socket as udp_incoming_address. Only change this if you want to have UDP queries sent using another address than where this Squid listens for UDP queries from other caches. NOTE: udp_outgoing_address is used by the ICP, HTCP, and DNS modules. Altering it will affect all of them in the same manner. see also; udp_incoming_address NOTE, udp_incoming_address and udp_outgoing_address can not have the same value since they both use the same port. ``` -------------------------------- ### Configure auth_param authentication schemes Source: http://www.squid-cache.org/Doc/config/auth_param Example configuration for various authentication schemes including negotiate, digest, ntlm, and basic. ```text #auth_param negotiate program #auth_param negotiate children 20 startup=0 idle=1 # #auth_param digest program #auth_param digest children 20 startup=0 idle=1 #auth_param digest realm Squid proxy-caching web server #auth_param digest nonce_garbage_interval 5 minutes #auth_param digest nonce_max_duration 30 minutes #auth_param digest nonce_max_count 50 # #auth_param ntlm program #auth_param ntlm children 20 startup=0 idle=1 # #auth_param basic program #auth_param basic children 5 startup=5 idle=1 #auth_param basic credentialsttl 2 hours ``` -------------------------------- ### Suggested icp_access Configuration Source: http://www.squid-cache.org/Doc/config/icp_access Example configuration for allowing ICP queries from local networks while denying all others. ```text # Allow ICP queries from local networks only #icp_access allow localnet #icp_access deny all ``` -------------------------------- ### Configure cache_store_log output Source: http://www.squid-cache.org/Doc/config/cache_store_log Examples of configuring the storage log path using different output modules. ```text cache_store_log stdio:/usr/local/squid/var/logs/store.log cache_store_log daemon:/usr/local/squid/var/logs/store.log ``` -------------------------------- ### Configure snmp_access rules Source: http://www.squid-cache.org/Doc/config/snmp_access Example configuration for allowing access to the SNMP port from localhost and denying all other traffic. ```text snmp_access allow snmppublic localhost snmp_access deny all ``` -------------------------------- ### Configure mark_client_connection for FTP Source: http://www.squid-cache.org/Doc/config/mark_client_connection Example configuration to mark intercepted FTP connections using a specific mask. ```text acl proto_ftp proto FTP mark_client_connection 0x200/0xff00 proto_ftp ``` -------------------------------- ### Configure WCCP2 services Source: http://www.squid-cache.org/Doc/config/wccp2_service Examples of defining standard and dynamic WCCP2 services, including optional MD5 password authentication. ```text wccp2_service standard 0 w# for the 'web-cache' standard service wccp2_service dynamic 80 # a dynamic service type which will be # fleshed out with subsequent options. wccp2_service standard 0 password=foo ``` -------------------------------- ### Configure Protocol Upgrade Rules Source: http://www.squid-cache.org/Doc/config/http_upgrade_request_protocols Examples demonstrating how to allow or deny specific protocols using the http_upgrade_request_protocols directive. ```squid # never upgrade to protocol Foo; all others are OK http_upgrade_request_protocols Foo deny all http_upgrade_request_protocols OTHER allow all ``` ```squid # only allow upgrades to protocol Bar (except for its first version) http_upgrade_request_protocols Bar/1 deny all http_upgrade_request_protocols Bar allow all http_upgrade_request_protocols OTHER deny all # this rule is optional ``` ```squid # only allow upgrades to protocol Baz, and only if Baz is the only offer acl UpgradeHeaderHasMultipleOffers ... http_upgrade_request_protocols Baz deny UpgradeHeaderHasMultipleOffers http_upgrade_request_protocols Baz allow all ``` -------------------------------- ### Configure a basic disk cache directory Source: http://www.squid-cache.org/Doc/config/cache_dir Example configuration line to enable a disk cache using the ufs storage type. ```text # Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /usr/local/squid/var/cache/squid 100 16 256 ``` -------------------------------- ### Configure Round-Robin Cache Directory Selection Source: http://www.squid-cache.org/Doc/config/store_dir_select_algorithm Example of interleaving cache_dir configurations to prevent selection bias when using the round-robin algorithm. ```text store_dir_select_algorithm round-robin cache_dir rock /hdd1 ... min-size=100000 cache_dir rock /ssd1 ... max-size=99999 cache_dir rock /hdd2 ... min-size=100000 cache_dir rock /ssd2 ... max-size=99999 cache_dir rock /hdd3 ... min-size=100000 cache_dir rock /ssd3 ... max-size=99999 ``` -------------------------------- ### Configure SSL Bumping Rules Source: http://www.squid-cache.org/Doc/config/ssl_bump Example configuration to splice traffic from localhost or specific domains while bumping all other TLS connections. ```text # Example: Bump all TLS connections except those originating from # localhost or those going to example.com. acl broken_sites ssl::server_name .example.com ssl_bump splice localhost ssl_bump splice broken_sites ssl_bump bump all ``` -------------------------------- ### Configure reply_body_max_size Source: http://www.squid-cache.org/Doc/config/reply_body_max_size Example syntax for setting the maximum reply body size in the Squid configuration file. ```text reply_body_max_size 10 MB ``` -------------------------------- ### Configure request_header_replace Source: http://www.squid-cache.org/Doc/config/request_header_replace Defines the syntax and provides an example for replacing a specific request header with a fixed string. ```text Usage: request_header_replace header_name message Example: request_header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit) ``` -------------------------------- ### Configure mark_client_packet with ACLs Source: http://www.squid-cache.org/Doc/config/mark_client_packet Example configuration applying different Netfilter MARK values to packets based on source network ACLs. ```text acl normal_service_net src 10.0.0.0/24 acl good_service_net src 10.0.1.0/24 mark_client_packet 0x00 normal_service_net mark_client_packet 0x20 good_service_net ``` -------------------------------- ### Configure on_unsupported_protocol actions Source: http://www.squid-cache.org/Doc/config/on_unsupported_protocol Example configuration showing how to use ACLs to define whether Squid should tunnel or respond to unsupported protocols. ```squid # define what Squid errors indicate receiving non-HTTP traffic: acl foreignProtocol squid_error ERR_PROTOCOL_UNKNOWN ERR_TOO_BIG # define what Squid errors indicate receiving nothing: acl serverTalksFirstProtocol squid_error ERR_REQUEST_START_TIMEOUT # tunnel everything that does not look like HTTP: on_unsupported_protocol tunnel foreignProtocol # tunnel if we think the client waits for the server to talk first: on_unsupported_protocol tunnel serverTalksFirstProtocol # in all other error cases, just send an HTTP "error page" response: on_unsupported_protocol respond all ``` -------------------------------- ### Configure clientside_mark with ACLs Source: http://www.squid-cache.org/Doc/config/clientside_mark Example configuration applying different Netfilter mark values to packets based on source network ACLs. ```text acl normal_service_net src 10.0.0.0/24 acl good_service_net src 10.0.1.0/24 clientside_mark 0x00 normal_service_net clientside_mark 0x20 good_service_net ``` -------------------------------- ### Replicate http_anonymizer paranoid behavior Source: http://www.squid-cache.org/Doc/config/request_header_access Example configuration to explicitly allow necessary headers and deny all others for a paranoid anonymization policy. ```text request_header_access Authorization allow all request_header_access Proxy-Authorization allow all request_header_access Cache-Control allow all request_header_access Content-Length allow all request_header_access Content-Type allow all request_header_access Date allow all request_header_access Host allow all request_header_access If-Modified-Since allow all request_header_access Pragma allow all request_header_access Accept allow all request_header_access Accept-Charset allow all request_header_access Accept-Encoding allow all request_header_access Accept-Language allow all request_header_access Connection allow all request_header_access All deny all ``` -------------------------------- ### Configure delay pool limits Source: http://www.squid-cache.org/Doc/config/delay_parameters Examples of applying specific bandwidth limits to different delay pool classes using the restore/maximum syntax. ```text delay_parameters 1 none 8000/8000 ``` ```text delay_parameters 2 32000/32000 8000/8000 600/8000 ``` ```text delay_parameters 4 32000/32000 8000/8000 600/64000 16000/16000 ``` -------------------------------- ### Configure reply_header_replace Source: http://www.squid-cache.org/Doc/config/reply_header_replace Example usage of the reply_header_replace directive to modify the Server header. ```text reply_header_replace Server Foo/1.0 ``` -------------------------------- ### Configure server_pconn_for_nonretriable Source: http://www.squid-cache.org/Doc/config/server_pconn_for_nonretriable Example showing how to define an ACL and apply the server_pconn_for_nonretriable directive to allow persistent connection reuse for specific request methods. ```squid acl SpeedIsWorthTheRisk method POST server_pconn_for_nonretriable allow SpeedIsWorthTheRisk ``` -------------------------------- ### Configure accept_filter for FreeBSD and Linux Source: http://www.squid-cache.org/Doc/config/accept_filter Examples of enabling accept filters for HTTP readiness or data availability on supported operating systems. ```text accept_filter httpready accept_filter data ``` -------------------------------- ### Configure reply_header_add Source: http://www.squid-cache.org/Doc/config/reply_header_add Example usage of the reply_header_add directive to inject a custom header into HTTP responses. ```text reply_header_add X-Client-CA "CA=%ssl::>cert_issuer" all ``` -------------------------------- ### Configure cache_peer_domain restrictions Source: http://www.squid-cache.org/Doc/config/cache_peer_domain Examples of defining domain-based query restrictions for a neighbor cache host. ```text cache_peer_domain cache-host domain [domain ...] cache_peer_domain cache-host !domain ``` ```text cache_peer_domain parent.foo.net .edu ``` -------------------------------- ### Configure always_direct for FTP requests Source: http://www.squid-cache.org/Doc/config/always_direct Example of forcing all FTP protocol requests to be forwarded directly. ```squid acl FTP proto FTP always_direct allow FTP ``` -------------------------------- ### Configure adaptation_masterx_shared_names Source: http://www.squid-cache.org/Doc/config/adaptation_masterx_shared_names Example usage of the directive to specify a shared header name for adaptation transactions. ```text adaptation_masterx_shared_names X-Subscriber-ID ``` -------------------------------- ### Replicate http_anonymizer standard behavior Source: http://www.squid-cache.org/Doc/config/request_header_access Example configuration to deny specific headers to achieve standard anonymization. ```text request_header_access From deny all request_header_access Referer deny all request_header_access User-Agent deny all ``` -------------------------------- ### Configure Basic Authentication Parameters Source: http://www.squid-cache.org/Doc/config/auth_param Directives for managing Basic authentication credential TTL and username case sensitivity. ```text "credentialsttl" timetolive "casesensitive" on|off ``` -------------------------------- ### Configure header_replace directive Source: http://www.squid-cache.org/Doc/config/header_replace Usage syntax and example for replacing a specific HTTP header with a fixed string. ```text Usage: header_replace header_name message Example: header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit) ``` -------------------------------- ### Configure rock storage type Source: http://www.squid-cache.org/Doc/config/cache_dir Usage syntax for the SMP-aware rock database-style storage format. ```text Usage: cache_dir rock Directory-Name Mbytes [options] ``` -------------------------------- ### Configure always_direct for local servers Source: http://www.squid-cache.org/Doc/config/always_direct Example of forcing requests for a specific domain to bypass cache peers. ```squid acl local-servers dstdomain my.domain.net always_direct allow local-servers ``` -------------------------------- ### Configure reply_header_access for anonymization Source: http://www.squid-cache.org/Doc/config/reply_header_access Examples demonstrating how to configure header access to mimic standard or paranoid anonymizer settings. ```text reply_header_access Server deny all reply_header_access WWW-Authenticate deny all reply_header_access Link deny all ``` ```text reply_header_access Allow allow all reply_header_access WWW-Authenticate allow all reply_header_access Proxy-Authenticate allow all reply_header_access Cache-Control allow all reply_header_access Content-Encoding allow all reply_header_access Content-Length allow all reply_header_access Content-Type allow all reply_header_access Date allow all reply_header_access Expires allow all reply_header_access Last-Modified allow all reply_header_access Location allow all reply_header_access Pragma allow all reply_header_access Content-Language allow all reply_header_access Retry-After allow all reply_header_access Title allow all reply_header_access Content-Disposition allow all reply_header_access Connection allow all reply_header_access All deny all ``` -------------------------------- ### Configure sslproxy_cert_adapt Source: http://www.squid-cache.org/Doc/config/sslproxy_cert_adapt Syntax for defining certificate adaptation algorithms with associated ACLs. ```text sslproxy_cert_adapt acl ... ``` -------------------------------- ### Define ICAP Services Source: http://www.squid-cache.org/Doc/config/icap_service Examples of defining ICAP services using the icap_service directive with different protocols and parameters. ```text icap_service svcBlocker reqmod_precache icap://icap1.mydomain.net:1344/reqmod bypass=0 icap_service svcLogger reqmod_precache icaps://icap2.mydomain.net:11344/reqmod routing=on ```