3. 安装和配置必要的软件

3.1. 安装带有延迟池功能的 Squid

正如我之前提到的，Squid 具有一个名为延迟池的功能，它允许我们控制下载带宽。不幸的是，在大多数发行版中，Squid 在发布时没有启用该功能。

因此，如果您已经安装了 Squid，我必须让您失望了 -- 您需要卸载它，并按照我下面解释的方式重新安装并启用延迟池功能。

1. 为了从我们的 Squid 代理获得最佳性能，最好为其缓存创建一个单独的分区，称为 /cache/。其大小应约为 300 兆字节，具体取决于我们的需求。

   如果您不知道如何创建单独的分区，您可以在主分区上创建 /cache/ 目录，但 Squid 性能可能会受到一些影响。

2. 我们添加一个安全的 'squid' 用户

   # useradd -d /cache/ -r -s /dev/null squid >/dev/null 2>&1

   包括 root 用户在内，任何人都无法以 squid 用户身份登录。

3. 我们从 http://www.squid-cache.org 下载 Squid 源代码

   当我编写本 HOWTO 时，最新版本是 Squid 2.4 stable 1

   http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE1-src.tar.gz

4. 我们将所有内容解压到/var/tmp:

5. # tar xzpf squid-2.4.STABLE1-src.tar.gz

6. 我们编译并安装 Squid（所有内容都在一行中）

   # ./configure --prefix=/opt/squid --exec-prefix=/opt/squid --enable-delay-pools --enable-cache-digests --enable-poll --disable-ident-lookups --enable-truncate --enable-removal-policies

   # make all

   # make install

3.2. 配置 Squid 以使用延迟池功能

1. 配置我们的 squid.conf 文件（位于 /opt/squid/etc/squid.conf 下）

   #squid.conf #Every option in this file is very well documented in the original squid.conf file #and on http://www.visolve.com/squidman/Configuration%20Guide.html # #The ports our Squid will listen on. http_port 8080 icp_port 3130 #cgi-bins will not be cached. acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY #Memory the Squid will use. Well, Squid will use far more than that. cache_mem 16 MB #250 means that Squid will use 250 megabytes of disk space. cache_dir ufs /cache 250 16 256 #Places where Squid's logs will go to. cache_log /var/log/squid/cache.log cache_access_log /var/log/squid/access.log cache_store_log /var/log/squid/store.log cache_swap_log /var/log/squid/swap.log #How many times to rotate the logs before deleting them. #See the FAQ for more info. logfile_rotate 10 redirect_rewrites_host_header off cache_replacement_policy GDSF acl localnet src 192.168.1.0/255.255.255.0 acl localhost src 127.0.0.1/255.255.255.255 acl Safe_ports port 80 443 210 119 70 20 21 1025-65535 acl CONNECT method CONNECT acl all src 0.0.0.0/0.0.0.0 http_access allow localnet http_access allow localhost http_access deny !Safe_ports http_access deny CONNECT http_access deny all maximum_object_size 3000 KB store_avg_object_size 50 KB #Set these if you want your proxy to work in a transparent way. #Transparent proxy means you generally don't have to configure all #your client's browsers, but hase some drawbacks too. #Leaving these uncommented won't do any harm. httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on #all our LAN users will be seen by external web servers #as if they all used Mozilla on Linux. :) anonymize_headers deny User-Agent fake_user_agent Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.6+) Gecko/20011122 #To make our connection even faster, we put two lines similar #to the ones below. They will point a parent proxy server our own Squid #will use. Don't forget to change the server to the one that will #be fastest for you! #Measure pings, traceroutes and so on. #Make sure that http and icp ports are correct. #Uncomment lines beginning with "cache_peer" if necessary. #This is the proxy you are going to use for all connections... #cache_peer w3cache.icm.edu.pl parent 8080 3130 no-digest default #...except for the connections to addresses and IPs beginning with "!". #It's a good idea not to use a higher #cache_peer_domain w3cache.icm.edu.pl !.pl !7thguard.net !192.168.1.1 #This is useful when we want to use the Cache Manager. #Copy cachemgr.cgi to cgi-bin of your www server. #You can reach it then via a web browser typing #the address http://your-web-server/cgi-bin/cachemgr.cgi cache_mgr your@email cachemgr_passwd secret_password all #This is a name of a user our Squid will work as. cache_effective_user squid cache_effective_group squid log_icp_queries off buffered_logs on #####DELAY POOLS #This is the most important part for shaping incoming traffic with Squid #For detailed description see squid.conf file or docs at http://www.squid-cache.org #We don't want to limit downloads on our local network. acl magic_words1 url_regex -i 192.168 #We want to limit downloads of these type of files #Put this all in one line acl magic_words2 url_regex -i ftp .exe .mp3 .vqf .tar.gz .gz .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .iso .raw .wav .mov #We don't block .html, .gif, .jpg and similar files, because they #generally don't consume much bandwidth #We want to limit bandwidth during the day, and allow #full bandwidth during the night #Caution! with the acl below your downloads are likely to break #at 23:59. Read the FAQ in this bandwidth if you want to avoid it. acl day time 09:00-23:59 #We have two different delay_pools #View Squid documentation to get familiar #with delay_pools and delay_class. delay_pools 2 #First delay pool #We don't want to delay our local traffic. #There are three pool classes; here we will deal only with the second. #First delay class (1) of second type (2). delay_class 1 2 #-1/-1 mean that there are no limits. delay_parameters 1 -1/-1 -1/-1 #magic_words1: 192.168 we have set before delay_access 1 allow magic_words1 #Second delay pool. #we want to delay downloading files mentioned in magic_words2. #Second delay class (2) of second type (2). delay_class 2 2 #The numbers here are values in bytes; #we must remember that Squid doesn't consider start/stop bits #5000/150000 are values for the whole network #5000/120000 are values for the single IP #after downloaded files exceed about 150000 bytes, #(or even twice or three times as much) #they will continue to download at about 5000 bytes/s delay_parameters 2 5000/150000 5000/120000 #We have set day to 09:00-23:59 before. delay_access 2 allow day delay_access 2 deny !day delay_access 2 allow magic_words2 #EOF

   好的，当我们配置完所有内容后，我们必须确保以下目录下的所有内容/opt/squid和/cache目录属于用户 'squid'。

   # mkdir /var/log/squid/

   # chown squid:squid /var/log/squid/

   # chmod 770 /var/log/squid/

   # chown -R squid:squid /opt/squid/

   # chown -R squid:squid /cache/

   现在一切都已准备就绪，可以运行 Squid 了。当我们第一次运行时，我们必须创建它的缓存目录

   # /opt/squid/bin/squid -z

   我们运行 Squid 并检查一切是否正常工作。一个很好的工具是 IPTraf；您可以在 http://freshmeat.net 上找到它。确保您已在 Web 浏览器中设置了适当的代理（在我们的示例中为 192.168.1.1，端口 8080）

   # /opt/squid/bin/squid

   如果一切正常工作，我们添加/opt/squid/bin/squid行到我们初始化脚本的末尾。通常，它可以是/etc/rc.d/rc.local.

   Squid 中其他有用的选项可能是

   # /opt/squid/bin/squid -k reconfigure （如果我们对其 squid.conf 文件进行了任何更改，它将重新配置 Squid）

   # /opt/squid/bin/squid -help :) 不言自明

   您还可以复制cachemgr.cgi到您的 WWW 服务器的 cgi-bin 目录，以使用有用的缓存管理器。

3.3. 解决剩余的问题

好的，我们已经安装了 Squid 并配置它使用延迟池。我敢打赌没有人愿意受到限制，特别是我们聪明的局域网用户。他们可能会试图避开我们的限制，只是为了更快地下载他们最喜欢的 mp3（从而导致您的头痛）。

我假设您在局域网上使用 IP 伪装，以便您的用户可以使用 IRC、ICQ、电子邮件等。这没问题，但我们必须确保我们的局域网用户将使用我们的延迟池 Squid 来访问网页并使用ftp.

我们可以通过使用以下工具解决大多数这些问题ipchains（Linux 2.2.x 内核）或iptables（Linux 2.4.x 内核）。