LPIC-2 208.3 — Squid Caching Proxy

Exam topic 208.3 — Squid Caching Proxy (weight: 2). Covers Squid 3.x configuration, ACL definitions, access control, client authentication, and redirectors.

What Is a Web Cache

A web cache (HTTP proxy) is an intermediary server between clients and web servers:

1. Client is configured to use the proxy (host + port)
2. All browser requests go to the proxy, not directly to the server
3. Proxy contacts the target server, saves the response in cache
4. On repeated requests — serves content from cache (fast, no network load)

Benefits: reduced bandwidth usage · faster access · content filtering · load balancing

Transparent Proxy

A transparent proxy intercepts traffic without any client-side configuration. Implemented as a combination of a proxy server and router with traffic redirection. The client is unaware of the proxy.

Configuration File Locations

Main configuration file: squid.conf (~125 options, only ~8 required to run).

If a directive is absent from squid.conf, Squid uses the default value. Squid can technically start with an empty config — but all clients will be denied.

Key squid.conf Parameters

cache_dir format:

cache_dir /usr/local/squid/cache/ 100 16 256
#                                  |   |   |
#                                  |   |   └─ 2nd-level subdirectory count
#                                  |   └───── 1st-level subdirectory count
#                                  └───────── cache size in MB

Squid creates many subdirectories with few files each — searching a directory with 1,000,000 entries is extremely slow. Subdirectory splitting speeds up disk access.

Access Control Lists (ACL)

An ACL is a named filter. Squid evaluates rules top to bottom and stops at the first match.

Structure:

acl <name> <type> <value>
http_access allow|deny <name>

ACL types:

ACL examples:

Allow only internal network:

acl ourallowedhosts src 192.168.1.0/255.255.255.0
acl all src 0.0.0.0/0.0.0.0

http_access allow ourallowedhosts
http_access deny all

Allow access only during lunch break:

acl allowed_hosts src 192.168.1.0/255.255.255.0
acl lunchtime MTWHF 12:00-13:00
http_access allow allowed_hosts lunchtime

MTWHF = Monday–Friday | WHFAS = Wednesday–Sunday

Block sites by domain name:

acl adults dstdomain playboy.com sex.com
acl ourallowedhosts src 192.168.1.0/255.255.255.0
acl all src 0.0.0.0/0.0.0.0

http_access deny adults
http_access allow ourallowedhosts
http_access deny all

Block social media except during lunch:

acl socialmedia dstdomain www.facebook.com www.twitter.com
acl lunch MTWHF 12:00-13:00
http_access allow socialmedia lunch
http_access deny socialmedia

Important ACL Behavior Rules

Last-rule default: Squid automatically appends the opposite rule after the last entry:

• Last rule is allow → Squid implicitly adds deny all
• Last rule is deny → Squid implicitly adds allow all

Always explicitly end the list with http_access deny all!

Authentication trap: A rule http_access allow name with a proxy_auth ACL behaves like deny !name — it denies unauthenticated users, but does NOT grant access to authenticated ones!

To actually grant access to authenticated users, add an explicit allow:

http_access allow name
http_access allow all

Common mistake: http_access allow name + the implicit deny all = authenticated users will be blocked. This is one of the most common beginner Squid mistakes.

User Authentication

How authentication works:

Browser → request without authorization header
Squid   → HTTP 407 (Proxy Authentication Required)
Browser → prompts user for login/password
Browser → repeat request with Authorization header
Squid   → passes credentials to external authenticator (stdin)
Auth.   → responds OK or ERR (stdout)
Squid   → allows or blocks the request

Authentication schemes:

digest, ntlm, and negotiate do not transmit passwords in plaintext. The order of schemes in squid.conf determines the order offered to clients.

Authentication backends:

PAM authentication example:

auth_param basic program /usr/lib/squid/pam_auth
auth_param basic children 5 startup=5 idle=1
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

acl ourhosts proxy_auth REQUIRED
http_access allow ourhosts
http_access allow all        # required! otherwise access will be denied

Redirectors

Squid can pass every URL through an external redirector — a program or script that reads a URL from stdin and returns a new URL (or an empty string if unchanged).

A redirector is not a standard part of Squid — it’s an external program. Examples are in the contrib/ directory of the source code. A ready-made simple redirector is squirm (uses a regex library).

redirect_program /usr/bin/my_redirector
redirect_children 5

Input line format:

URL  ip-address/fqdn  ident  method

Example input/output:

# Input:
ftp://ftp.gnome.org/pub/GNOME/stable/README  192.168.12.34/-  -  GET

# Output (redirect to mirror):
ftp://ftp.mirror.org/gnome/stable/README  192.168.12.34/-  -  GET

For HTTP redirect, the response must start with 301: or 302:

Perl redirector example:

#!/usr/local/bin/perl
$|=1;           # Disable output buffering
while (<>) {
    s@http://fromhost.com@http://tohost.org@;
    print;
}

Memory Management

Squid makes heavy use of RAM — reading from memory is much faster than reading from disk.

Metadata (StoreEntry) per object:

A cache with 1,000,000 objects requires ~72 MB just for metadata.

What else lives in memory:

• Disk read/write buffers
• Network I/O buffers
• IP cache and FQDN cache
• ICMP database (Netdb)
• Current request state (headers)
• “Hot” objects in full (frequently accessed)

Memory parameters:

cache_mem 64 MB               # RAM for hot objects
maximum_object_size 4096 KB   # max size for disk caching (4 MB)
minimum_object_size 0 KB      # min size (0 = no limit)
cache_swap 1024               # max disk cache in MB

Applying Changes

squid -k reconfigure    # reload config without restarting
squid -k shutdown       # stop Squid
squid -k parse          # parse and check config for errors

Exam Cheat Sheet

Directive Quick Reference

Minimal Working Configuration:

http_port 3128
cache_dir ufs /var/spool/squid 100 16 256

acl localnet src 192.168.0.0/255.255.0.0
acl all src 0.0.0.0/0.0.0.0

http_access allow localnet
http_access deny all

Day-of-Week Letters for time ACL:

Key Exam Facts