All right. In this demo, we're gonna take a look at squid.
We're gonna install it, set it up.
And if you're unfamiliar with what squid is, we'll do a quick intro and talk about it.
So why would you use squid?
Well,
part of it is the slash Bandwidth costs,
speed up web requests and block unwanted content.
This is what is commonly used for.
It's an open source
caching proxy server.
It supports HTTP HTPS and FTP.
It was originally developed by the
National Laboratory for Applied network research.
Now, how does squid work? Well, it caches content to save Bandwidth.
It controls access to web content through AC LS or access control lists
and it logs web usage for audits or analytics
and speeds up repeated requests.
Now, it's often used as a shared office, internet proxy
or for school internet content filtering,
enterprise gateway traffic logging and reverse proxy for web acceleration.
It uses
caching to really speed things up
now that you know what squid is and how it's used.
Let's check out a demo, let's install it, set it up and see how it works.
OK. I'm here on my
Ubuntu server and we're going to set up and install squid
actually very easy.
Now,
the way this works is every time a user
requests a website squid can cash that response.
So the next user gets it instantly from
your local server instead of pulling it over the
WAN. Again, this is one of the biggest advantages of squid
is it can really speed things up.
So here's how we'll install it
and that's it. Now, it's actually up and running
pretty simple, right?
But you never want to run Squid in its default form.
Um especially on a public facing Squid server.
So there are hackers Attackers, whatever you wanna call them
that will scan entire IP blocks looking for Squid servers
because they use them to do all kinds of NPAR
stuff.
So we want to lock this down
the way we do that
is by editing the Squid con.
And here we see a gigantic file with a whole bunch of values in it.
I'll show you the ones that we're really concerned with.
For instance,
HTTP port,
you can find it here and it says Squid normally listens to port 3128.
You can change this to whatever you want.
And in fact, I think you should,
especially like I said with a public facing squid server.
Um It's a little bit of security by obscurity
to do that, but it just makes it.
So it's not instantly available on port 3128
telling Attackers that it's a squid server immediately.
All right. But we're going to leave it alone here.
Now, the important part here that we need to look for
is AC L lists.
We'll say AC L.
Now in here, we'll see. The AC L section says, defining an access list.
Every access list definition must begin with an AC
L name AC L type followed by either type,
specific arguments or a quoted file name that they are read from.
So this file tells you exactly how to set this up.
Now, what I'm going to do is I'm gonna lock this down a little bit, right?
We'll go through all of this stuff. There is just a kind of AC L example you can use
super helpful.
Now, we have a set of AC LS here.
So I'm gonna add some,
I must say
AC L allowed
I
TS
source
and we're going to say 10.0
at zero
slash.
So this is a good way to allow the ips
that we want to allow.
Now,
there's some other stuff we could do, we could really
set this up
uh And rather than go through it
and type it all step by step, I will
paste it in.
Here's a really good AC L list that you can use
and we're going to include this.
So this is the bare minimum right here is just allowing an IP Subnet.
We're allowing an internal Subnet
use this
rather than
just saying anybody can connect, you have to be on this Subnet and that,
but let's dump in
this one and I
delete that because I have it down below.
Now here you can say
allow connect for HTTPS ports.
That's 443
will allow port 80 which is HTTP
uh not
commonly used much anymore.
And
actually it looks like
the safe port
here. So we have our SSL port.
We're gonna add that as a safe port as well as port 80
AC L connect method connect
here. We have AC L allowed IP S source and then the network that we did earlier,
we're going to allow connect from allowed IP S
right. And that's the AC L up here
and we'll say HDP access allow
allowed IP S so we're gonna allow connect, we're gonna allow pass through.
And then down here you can see we have deny everything else,
everything else will be denied.
And this gives us a good security setup. So really the only thing that can
get through is somebody on our network
that wants to get out into the internet
system, CTL enable squid
and then we will
restart it.
Awesome. Now, I'm gonna hop on to another machine
and connect to the internet through squid.
Ok. Now, I'm on another machine that's 10.0 0.0 0.66.
Our squid machine is 10.0 0.0 0.2.
So
I should be able to connect
here. Now, I'm gonna do
a cURL
dash L
Apollo redirects, HTTPS
www
cloud.com,
we load this up, we can see
the HTML from code cloud.com
and we could even do a dash B
make it verbose.
And then up here it will show all the details. So when you're debugging
your Squid server, you might want to use that dash V
so that you can scroll all the way up here
to the top and you will see more verbose messages.
As we know, we use a lot of sbgs and things like that. So
it's going to go, but
let's
use this Squid server
with our cURL command.
And one way that we can do this
is we can say
export
HT TB proxy
and then
have that be the HD proxy. Now, you may not want to do that
for whatever reason. So another way you could do this,
I will type in the following.
We're gonna do cURL dash X then HTTP 10.0 0.0 0.2
port 3128. And that's the squid server that we just set up and installed
then dash L. So we follow redirects
HTTPS www dot code cloud.com.
And now if we run it, we can once again see
all the script. So
we know that it worked.
But how do we really know it's going through the Squid server,
right? It might be kind of hard to tell,
but we can kind of go up here and look at the top,
you can see that we definitely specified it
etc,
but here's how we can find out
how to
see if we've actually gone through it.
So how do we know for sure that we're really going through that proxy?
Well, let's jump back over onto our proxy server.
Now, here I'm on 10.0 0.0 0.2. This is our squid proxy server.
Now, as long as this is running,
we should see the accesses that we make.
So I'm gonna jump over to 10.0 0.0
0.66 other server and start throwing some requests.
Ok. And once again, I'm doing cURL dash X
HTTP
10.0 0.0 0.2
colon 3128 dash L. So we're following redirects
code cloud.com
and there we can see the code cloud website.
Let's try some other sites. We'll do www
google.com.
We'll try jmorgan.com,
use.ycombinator.com, one of my favorite sites, right?
We'll hit that one a few times.
Ok.
So
now we've run this a few times.
We've directed it to go through our squid server.
But how do we know it really works? Well, let's jump back and check.
Ok.
Now we go back to our squid server where we
were looking at our access log and you can see here
we have
the access to the code cloud.com,
google.com, Jeremy, morgan.com, news.ycombinator.com, all of it is here.
So this is how we can prove
that
the squid access is working.
This is one of the things I recommend while you're setting it up
is to make sure that requests are actually going through
Squid and they're actually being processed.
You can do the same thing in a browser. You could put in that 10.0 0.0 0.2 in a browser
and open up a website and see if it works
and check the log there.
So this is the basic things that we covered.
Now, here's a little bonus thing that I'm gonna throw in here.
This likely won't be on the test,
but I just kind of wanna show it because it's a cool usage of squid.
OK? So we're not actually going to run this, but I'm going to
put it in here
into our squid comp.
Now, squid can also
sit in front of your web server. So the way that we've
configured this so far is
we're going to route all of our internet traffic on our internal
network through the squid server as a proxy to the outside world,
right?
So a lot of administrators
will lock down each individual machine on the network.
So it cannot connect to the internet without putting in
the address to Squid into their browsers or into their networking configuration.
Um They won't be able to access the network without going through Squid.
So that's from the internal, going through Squid to the outside internet.
You can also do that in reverse it can sit in front
of your web servers and it can cache static content like images,
HTML CSS javascript, stuff like that for faster load times.
And this is really cool.
So I'm going to copy in what you would put in your Squid pump.
So I would put in H TV B port
443 or SSL port Excel
default site code cloud.com,
right? So
this is gonna listen in on code cloud.com
and it's going to route it to appear.
So in here, I'll put cash peer 127001. That's our localhost
parent
8080.
That's the port that our web server is listening on.
So say we have something like engine
X setup.
We would set up engine X on port 8080
and then here no query origin server,
et cetera. So this way
Squid actually works in reverse.
So as people come in
squid is listening on port 443
and then it routes it to an engine X
or Apache instance or something that serves our website
and it works in the reverse direction where it caches
everything.
Like I said, images, HTML CSS whatever for faster load time.
So let's wrap this up with some takeaways here.
Why do we use Squid while squid saves Bandwidth, it improves performance.
And as we saw when we were able to look at our log files,
it gives you control and visibility over outbound traffic.
So you can see
where people are going,
what they're doing, et cetera
and it's easy to deploy and flexible, right?
It only took us just a couple of minutes to install this configure it and get it set up.
So
I wanted to show this
um just in case there are some things about Squid on the LF CS exam.
I've been told that there are.
Um So this will give you a good idea of how to set up squid, how to configure it,
how to test it and make sure it works.
But more importantly, um this shows you a good way of optimizing network traffic.
So if you're a Linux administrator, this is useful stuff to know,
even if it's not on the LF CS exam,
it's useful to know how to save
Bandwidth and improve performance with your internal
web browsing or your external website as we showed before.
So, thank you for watching.