Squid is a full-featured web proxy cache server application which provides proxy and cache services for HTTP, FTP, SSL requests and DNS lookups.

To get Squid installed you need to follow some steps to configure the port and adjust the access control list.

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers with Software Installation tasks on their Server.

In this context, we shall look into the steps to install and configure Squid Proxy on CentOS 7.

How to install Squid on CentOS 7?

The squid package is included in the default CentOS 7 repositories. To install it, run the following command as sudo user:

$ sudo yum install squid

Once the installation is completed, we can start and enable the Squid service:

$ sudo systemctl start squid
$ sudo systemctl enable squid

To verify that the installation was successful, type the following command which will print the service status:

$ sudo systemctl status squid
● squid.service - Squid caching proxy
Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2020-12-01 16:47:56 UTC; 12s ago
...

How to configure Squid on CentOS 7?

Squid can be configured by editing the /etc/squid/squid.conf file. Additional files with configuration options can be included using the “include” directive.

Before making any changes, back up the original configuration file with the cp command:

$ sudo cp /etc/squid/squid.conf{,.orginal}

To edit the file, open it in the text editor:

$ sudo nano /etc/squid/squid.conf

By default, Squid is configured to listen on port 3128 on all network interfaces on the server.

If we want to change the port and set a listening interface, locate the line starting with http_port and specify the interface IP address and the new port. If no interface is specified Squid will listen on all interfaces.

/etc/squid/squid.conf

# Squid normally listens to port 3128

http_port IP_ADDR:PORT

Running Squid on all interfaces and on the default port should be fine for most users.

We can control the access to the Squid server using the Access Control Lists (ACLs).

By default, Squid allows access only from localhost and localnet.

If all of the clients that will use the proxy have a static IP address we can create an ACL that will include the allowed IPs.

Instead of adding the IP addresses in the main configuration file, we will create a new dedicated file that will hold the IPs:

/etc/squid/allowed_ips.txt

IP_addresses_here

# All other allowed IPs

Replace IP_addresses_here with the actual IP addresses.

Once done open the main configuration file and create a new ACL named allowed_ips (first highlighted line) and allow access to that ACL using the http_access directive (second highlighted line):

/etc/squid/squid.conf

# ...
acl allowed_ips src "/etc/squid/allowed_ips.txt"
# ...
http_access allow localnet
http_access allow localhost
http_access allow allowed_ips

# And finally deny all other access to this proxy

http_access deny all

The order of the http_access rules is important. Make sure we add the line before http_access deny all.

The http_access directive works in a similar way as the firewall rules. Squid reads the rules from top to bottom, and when a rule matches the rules below are not processed.

Whenever we make changes to the configuration file we need to restart the Squid service for the changes to take effect:

$ sudo systemctl restart squid

How does Squid Authentication work?

Squid can use different back ends, including Samba, LDAP, and HTTP basic auth to authenticated users.

In this example, we will configure Squid to use basic auth. It is a simple authentication method built into the HTTP protocol.

We will use the openssl to generate the passwords and append the username:password pair to the /etc/squid/htpasswd file with the tee command as shown below:

$ printf "USERNAME:$(openssl passwd -crypt PASSWORD)\n" | sudo tee -a /etc/squid/htpasswd

For example to create a user named “ibmimedia” with password "Pz$lPk80" we would run:

$ printf "ibmimedia:$(openssl passwd -crypt 'Pz$lPk80')\n" | sudo tee -a /etc/squid/htpasswd
ibmimedia:3nkgQsTSPCsIo

The next step is to configure Squid to enable the HTTP basic authentication and use the file.

Open the main configuration and add the following:

/etc/squid/squid.conf
# ...
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/htpasswd
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
# ...
http_access allow localnet
http_access allow localhost
http_access allow authenticated
# And finally deny all other access to this proxy
http_access deny all

With the first three lines, we are creating a new ACL named authenticated. The last highlighted line is allowing access to authenticated users.

How to Restart the Squid service?

Execute the following command to restart squid service;

$ sudo systemctl restart squid

How to Configure firewall for squid?

If we are running a firewall we will need to open port 3128. 

To do so, run the following commands:

$ sudo firewall-cmd --permanent --add-port=3128/tcp
$ firewall-cmd --reload

If Squid is running on another, non-default port, we need to allow traffic on that port.

How to Configure the Browser to Use Squid Proxy?

Now that we have Squid set up, the last step is to configure the browser to use it.

In Firefox

The steps below are the same for Windows, macOS, and Linux.

1. In the upper right-hand corner, click on the hamburger icon ☰ to open Firefox’s menu.

2. Click on the ⚙ Preferences link.

3. Scroll down to the Network Settings section and click on the Settings… button.

4. A new window will open. Select the Manual proxy configuration radio button.

5. Then, enter the Squid server IP address in the HTTP Host field and 3128 in the Port field.

6. Now, select the Use this proxy server for all protocols check box.

7. Finally, click on the OK button to save the settings.

At this point, Firefox is configured and we can browse the Internet through the Squid proxy. To verify it, open google.com, type "what is my IP" and you should see your Squid server IP address.

To revert back to the default settings go to Network Settings, select the Use system proxy settings radio button and save the settings.

For Google Chrome

Google Chrome uses the default system proxy settings. Instead of changing the operating system proxy settings we can either use an addon such as SwitchyOmega or start Chrome web browser from the command line.

To launch Chrome using a new profile and connect to the Squid server, use the following command:

In Linux:

/usr/bin/google-chrome \
--user-data-dir="$HOME/proxy-profile" \
--proxy-server="http://SQUID_IP:3128"

In macOS:

"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
--user-data-dir="$HOME/proxy-profile" \
--proxy-server="http://SQUID_IP:3128"

In Windows:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" ^
--user-data-dir="%USERPROFILE%\proxy-profile" ^
--proxy-server="http://SQUID_IP:3128"

The profile will be created automatically if it does not exist. This way you can run multiple instances of Chrome at the same time.

To confirm the proxy server is working properly, open google.com, and type "what is my IP". 

The IP shown in the browser should be the IP address of the server.

[Need urgent assistance to install squid on Centos 7? – We are available 24*7]