Quantcast
Channel: tiq's tech-blog » anonymous
Viewing all articles
Browse latest Browse all 11

Installing High Anonymous + KA with Authentication Squid Proxy on Linux/Debian

$
0
0

Squid is probably the most commonly used proxy, however it can be a bit difficult to set it up as the configuration file is really huge.
In comparison to tinyproxy it supports authentication which is why I prefer squid over tinyproxy.

Here is how I set it up on Linux Debian 6 (Squeeze) minimal x86, including making it highly anonymous and with authentication:

At first update Debian and install the editor nano:

apt-get update
apt-get upgrade
apt-get install nano

Then install squid:

apt-get install squid3

When launched, it might display a warning that you can probably ignore.

The name in the repository might change over time, the newest version is squid3. To find out which is the newest you can execute the following command:

apt-cache search squid3

Next we set a username and a password using the tool “htpasswd”, which is part of the apache2 web server:

htpasswd -c /etc/squid3/passwd USERNAME

Enter your desired username and confirm with Enter, then you will be promted to enter a password, confirm it and done!

Should you get the notification “htpasswd: command not found” you have to install the tool first:

apt-get install apache2-utils

This installs the utilities of the apache2 web server, but not the web server itself (which you do not need).

Should you use a user without any rights to run squid you will probably have to set the rights for the passwd file so that squid can access it:

chmod 777 /etc/squid3/passwd

Chmod 644 will probably be enough, just experiment with it.

Now let’s change directory to where the squid configuration file is located and rename the file, because we will add our own which is much shorter:

cd /etc/squid3/
mv squid.conf squid1.conf

Now create a new, empty squid.conf file with the editor nano:

nano /etc/squid3/squid.conf

Add the following configuration, copy it and paste it into PuTTY by doing a right click in the PuTTY window:

http_port 8765
cache deny all
hierarchy_stoplist cgi-bin ?

access_log none
cache_store_log none
cache_log /dev/null

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports
auth_param basic program /usr/lib/squid3/ncsa_auth /etc/squid3/passwd

auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
acl password proxy_auth REQUIRED
http_access allow localhost
http_access allow password
http_access deny all

forwarded_for off
request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access WWW-Authenticate allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Authenticate allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-Language allow all
request_header_access Mime-Version allow all
request_header_access Retry-After allow all
request_header_access Title allow all
request_header_access Connection allow all
request_header_access Proxy-Connection allow all
request_header_access User-Agent allow all
request_header_access Cookie allow all
request_header_access All deny all

You can save the configuration file by holding CTRL+X , confirm with “y” and hit Enter to confirm the changes.

You can change settings according to your needs, especially the port (first line). I would recommend to choose none of the standard ports (3128, 8080, 8800, 8000, 8888,..) as some scripts try to access these ports to determine if you are using a proxy.
The bottom part below “forwarded_for off” is what makes the proxy anonymous.

Now you are almost ready to use it, restart squid:

/etc/init.d/squid3 restart

Done!

Find more information on the official website: http://www.squid-cache.org/

As usual, do not hesitate to post questions and suggestions in the comments.

Additional stuff:
If you would like to only allow access to a few select websites, use the following lines:

acl xacl dstdomain "/etc/squid3/xacl"

http_access allow password xacl
http_access deny all

Then add websites to the file “xacl” (or whatever you named it) in the following format:

.websiteexample1.TLD
.websiteexample2.TLD
...

Viewing all articles
Browse latest Browse all 11

Trending Articles