实验环境：
公司有两台web服务器，运行同一套网站，读取同一台mysql数据库。
两台web服务器的主机名如下：
test1.com 192.168.1.119
test2.com 192.168.1.120
squid服务器ip：192.168.1.123
DNS: 192.168.9.254
实验思路：DNS将www.fb.com解析给squid服务器，squid轮询web主机返回其中一台作应答，并提供缓冲加速的服务！
注意：在次试验中，针对https的部分有点问题，需要负载均衡设备做一些设置！另外，两台web服务器部分网站目录的同步问题，已解决可以才从NFS挂载目录的方式来实现！
一、基础配置
A、更新
1、更换更新源(服务器位于国内做此操作)
sed -i "s/mirror.centos.org/centos/mirrors.centos.91.com/g" /etc/yum.repos.d/CentOS-Base.repo
sed -i "s/^mirrorlist/#mirrorlist/g" /etc/yum.repos.d/CentOS-Base.repo
sed -i "s/^#baseurl/baseurl/g" /etc/yum.repos.d/CentOS-Base.repo
2、更新
yum clean all
yum -y update
[sepatator]
B、优化
1、增加以下内容到/etc/sysctl.conf末尾
kernel.core_uses_pid = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_window_scaling = 0
net.ipv4.tcp_sack = 0
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.ip_local_port_range = 1024 65536
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_retries2 = 5
fs.file-max = 655360
net.core.somaxconn = 4096
执行：
sysctl -p
使之生效
2、加大可允许打开的文件句柄数
echo "* soft nofile 65536" >>/etc/security/limits.conf
echo "* hard nofile 65536" >>/etc/security/limits.conf
3、时间校对
yum -y install ntp
service ntpd restart
service ntpd stop
echo "#time update" >> /etc/crontab
echo "0 23 * * * root /usr/sbin/ntpdate time.windows.com" >> /etc/crontab
C、硬盘分区挂载
查看硬盘
fdisk -l
根据实际物理机器是否硬raid及硬盘数量做不同的raid及分区情况
因为这里是做cache，不建议使用软raid
二、squid的编译安装配置
1、squid的安装
安装gcc等工具包
yum install gcc gcc+ gcc-c++ gcc-g77 autoconf automake ncurses-devel flex openssl-devel mod_ssl make
cd /home/soft
tar zxvf squid-3.1.16.tar.gz
cd squid-3.1.16
./configure --prefix=/usr/local/squid --enable-gnuregex --enable-dlmalloc --with-pthreads --enable-ssl --enable-stacktrace --enable-removal-policies=heap,lru --enable-delay-pools --enable-kill-parent-hack --enable-snmp --enable-icmp --enable-err-language=simplify_Chinese --enable-default-err-languages=Simplify_Chinese --enable-cahce-digests --disable-ident-lookups --with-filedescriptors=65536 --enable-underscore --enable-large-cache-files --with-large-files --enable-storeio=aufs,diskd,ufs --enable-linux-netfilter --enable-async-io=160 --enable-cachemgr
make
make install
cd /usr/local/squid
2、生成证书并申请新证书
openssl genrsa -des3 -out *.squid.key 1024
openssl req -new -key *.squid.key -out *.squid.csrc
这是需要生成正式证书使用的，如果只是需要未认证的证书，可使用以下命令生成：
openssl req -utf8 -new -key *.squid.key -out *.squid.csr
这里生成的证书不要使用密码，貌似squid不能使用密码，我第一次使用了密码能正常启动，但会提示未认证，让我搞了好久的时间。
3、squid配置
mkdir /data/cache1
mkdir /data/cache2
mkdir /data/cachelog
chown squid /data/cache*
把服务商提供的证书放到/data/key/目录下，包括中级根证书，证书，公钥三个文件。
修改squid.conf文件内容：
------------------------------------------------------------------------------
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
# acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
# acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.9.0/24 # RFC1918 possible internal network
# acl localnet src fc00::/7 # RFC 4193 local private network range
# acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
# http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
# http_port 3128
# Uncomment and adjust the following to add a disk cache directory.
# cache_dir ufs /usr/local/squid/var/cache 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid/var/cache
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
##---------------------------------------
# host and cache port setting
##----------------------------------------
# 主机名（3.0加入配置），无此项无法启动
visible_hostname squid
cache_mgr jason.kou@factorybuy.com
# 设置运行squid用户，一般不能以root运行
cache_effective_user squid
cache_effective_group squid
cachemgr_passwd password all
client_persistent_connections off
server_persistent_connections on
half_closed_clients off
# 设定squid为accel加速模式,vhost必须要加.否则将无法将主机头转发至后端服务器,
# 访问时就会出现无法找到主机头的错误
http_port 80 accel vhost vport
# 添加443端口之后可能导致IE浏览器无法正常访问https页面，未测试
http_port 443 accel vhost vport
# https_port 443 cert=/data/squid.csr key=/data/squid.key defaultsite=www.fb.com
# https_port 443 cert=/usr/local/squid/data/cert.pem /usr/local/squid/data/key.pem
##----------------------------------------
# cache directory setting
##----------------------------------------
# 缓存目录8192M，其中一级目录16个，二级256个（每个一级下16个二级）
cache_dir ufs /usr/local/squid/data/cache 8192 16 256
max_open_disk_fds 0
##-----------------------------------------
# cache storage setting
##-----------------------------------------
# 大于此容量的对象将不会被保存在磁盘上,默认大小是4M,如果squid服务器用于缓冲flash等大型文件,
# 建议将此值变大.否则过大的文件在下次重>启后将需要重新获取
maximum_object_size_in_memory 4 MB
minimum_object_size 0 KB
maximum_object_size 4 MB
# 缓存内容大小控制，当cache目录被占用到95%时，内容将被清空20%
cache_swap_high 95
cache_swap_low 80
# 替换机制(lru叫做“最近不常用的单元”unit一般就是常说object， 也就是当cache
# 中的内容比如内存或硬盘达到上限时就需要进行数据的换进和换出工作)
memory_replacement_policy lru
cache_replacement_policy lru
##------------------------------------------
# cache time out setting
##------------------------------------------
forward_timeout 20 seconds
connect_timeout 15 seconds
read_timeout 3 minutes
request_timeout 1 minutes
persistent_request_timeout 15 seconds
client_lifetime 15 minutes
shutdown_lifetime 5 seconds
negative_ttl 10 seconds
##---------------------------------------------
# cache log setting
##---------------------------------------------
emulate_httpd_log on
logformat squid %ts.%tu %tr %>a %Ss/%>Hs %<st %rm %ru %un %Sh/%<A %mt
access_log /usr/local/squid/data/logs/access_log.log common
cache_log /usr/local/squid/data/logs/cache.log
cache_store_log /usr/local/squid/data/logs/store.log
cache_swap_log /usr/local/squid/data/logs/cache_swap.log
mime_table /usr/local/squid/etc/mime.conf
# 错误信息目录
error_directory /usr/local/squid/share/errors/en-us/
pid_filename /usr/local/squid/data/squid.pid
# 不记录store.log
# cache_store_log none
##--------------------------------------------
# vhost setting
##--------------------------------------------
# 定义不同的父节点,将节点设为no-query以及originserver说明这些节点是实际服务器
cache_peer test1.com parent 80 0 no-query no-digest originserver name=test1 round-robin
cache_peer test2.com parent 80 0 no-query no-digest originserver name=test2 round-robin
# 设定不同域名转发到不同的cache_peer上,如果没有这项.不同域名的域名可能被分发到同一台服务器上.
cache_peer_domain test1 www.fb.com
cache_peer_domain test2 www.fb.com
# 允许客户端所有请求（这里可以设置拦截url，格式如下面两行缓存设置）
http_access allow all
# 设置不缓存url类型（空格隔开
acl QUERY urlpath_regex .php .jsp .asp .pl .cgi
cache deny QUERY
---------------------------------------------------------------------
hosts_file /etc/hosts
4、启动
/usr/local/squid/sbin/squid -z 生成缓存目录
/usr/local/squid/sbin/squid -s
netstat -na |grep 443
netstat -na |grep 80
看端口监听是否启动了
如果OK，那么squid配置完毕，这里不做squid配置的一些讲解，因为我本人也不是非常熟悉！
三、双机高可用
一些关于squid调试的命令:
1，初始化你在 squid.conf 里配置的 cache 目录
#squid/sbin/squid -z
如果有错误提示，请检查你的 cache目录的权限。
2，对你的squid.conf 排错，即验证 squid.conf 的 语法和配置。
#squid/sbin/squid -k parse
如果squid.conf 有语法或配置错误，这里会返回提示你，如果没有返回，恭喜，可以尝试启动squid。
3，在前台启动squid，并输出启动过程。
#/usr/local/squid/sbin/squid -N -d1
如果有到 ready to server reques，恭喜，启动成功。
然后 ctrl + c，停止squid，并以后台运行的方式启动它。
4，启动squid在后台运行。
#squid/sbin/squid -s
这时候可以 ps -A 来查看系统进程，可以看到俩个 squid 进程。
5，停止 squid
#squid/sbin/squid -k shutdown
这个不用解释吧。
6，重引导修改过的 squid.conf
#squid/sbin/squid -k reconfigure
当你发现你的配置有不尽你意的时候，可以随时修改squid.conf，然后别忘记对你的 squid.conf排错，
然后再执行此指令，即可让squid重新按照你的 squid.conf 来运行。
7，把squid添加到系统启动项
编辑 /etc/rc.d/rc.local
添加如下行： /usr/local/squid/sbin/squid -s
再来点其他的。
1，修改cache 缓存目录的权限。
#chown -R squid:squid /home/cache
我的cache缓存目录是 /home/cache,squid执行用户和用户组是 squid，squid。
2，修改squid 日志目录的权限
#chown -R squid:squid /usr/local/squid/data/logs
这一步并不是适合每一个使用squid的用户.意为让squid有权限在该目录进行写操作 。
例如生成 access.log cache.log store.log
3，查看你的日志文档。
#more /usr/local/squid/var/logs/access.log | grep TCP_MEM_HIT
该指令可以看到在squid运行过程中，有那些文件被squid缓存到内存中，并返回给访问用户。
#more /usr/local/squid/var/logs/access.log | grep TCP_HIT
该指令可以看到在squid运行过程中，有那些文件被squid缓存到cache目录中，并返回给访问用户。
#more /usr/local/squid/var/logs/access.log | grep TCP_MISS
该指令可以看到在squid运行过程中，有那些文件没有被squid缓存，而是现重原始服务器获取并返回给访问用户。
关掉不必要的服务
echo 'alias vi="vim" alias grep="grep --color"' >> /etc/profile
echo -e "* soft nofile 65536* hard nofile 65536" > /etc/security/limits.conf
chkconfig --level 0123456 NetworkManager off
chkconfig --level 0123456 NetworkManagerDispatcher off
chkconfig --level 0123456 anacron off
chkconfig --level 0123456 atd off
chkconfig --level 0123456 auditd off
chkconfig --level 0123456 autofs off
chkconfig --level 0123456 avahi-daemon off
chkconfig --level 0123456 avahi-dnsconfd off
chkconfig --level 0123456 bluetooth off
chkconfig --level 0123456 capi off
chkconfig --level 0123456 centcore off
chkconfig --level 0123456 centstorage off
chkconfig --level 0123456 conman off
chkconfig --level 0123456 cups off
chkconfig --level 0123456 dc_client off
chkconfig --level 0123456 dc_server off
chkconfig --level 0123456 dhcdbd off
chkconfig --level 0123456 dovecot off
chkconfig --level 0123456 dund off
chkconfig --level 0123456 firstboot off
chkconfig --level 0123456 gpm off
chkconfig --level 0123456 hidd off
chkconfig --level 0123456 hplip off
chkconfig --level 0123456 httpd off
chkconfig --level 0123456 innd off
chkconfig --level 0123456 ip6tables off
chkconfig --level 0123456 ipmi off
chkconfig --level 0123456 irda off
chkconfig --level 0123456 irqbalance off
chkconfig --level 0123456 isdn off
chkconfig --level 0123456 kdump off
chkconfig --level 0123456 kudzu off
chkconfig --level 0123456 ldap off
chkconfig --level 0123456 lisa off
chkconfig --level 0123456 mdmonitor off
chkconfig --level 0123456 mdmpd off
chkconfig --level 0123456 microcode_ctl off
chkconfig --level 0123456 multipathd off
chkconfig --level 0123456 nagios off
chkconfig --level 0123456 named off
chkconfig --level 0123456 netconsole off
chkconfig --level 0123456 netfs off
chkconfig --level 0123456 netplugd off
chkconfig --level 0123456 nfs off
chkconfig --level 0123456 nfslock off
chkconfig --level 0123456 nscd off
chkconfig --level 0123456 ntpd off
chkconfig --level 0123456 oddjobd off
chkconfig --level 0123456 pand off
chkconfig --level 0123456 pcscd off
chkconfig --level 0123456 portmap off
chkconfig --level 0123456 postgresql off
chkconfig --level 0123456 psacct off
chkconfig --level 0123456 rdisc off
chkconfig --level 0123456 readahead_later off
chkconfig --level 0123456 restorecond off
chkconfig --level 0123456 rpcgssd off
chkconfig --level 0123456 rpcidmapd off
chkconfig --level 0123456 rpcsvcgssd off
chkconfig --level 0123456 rwhod off
chkconfig --level 0123456 saslauthd off
chkconfig --level 0123456 setroubleshoot off
chkconfig --level 0123456 smb off
chkconfig --level 0123456 snmpd off
chkconfig --level 0123456 snmptrapd off
chkconfig --level 0123456 spamassassin off
chkconfig --level 0123456 sysstat off
chkconfig --level 0123456 tux off
chkconfig --level 0123456 vncserver off
chkconfig --level 0123456 vsftpd off
chkconfig --level 0123456 wdaemon off
chkconfig --level 0123456 winbind off
chkconfig --level 0123456 wpa_supplicant off
chkconfig --level 0123456 xfs off
chkconfig --level 0123456 xinetd off
chkconfig --level 0123456 ypbind off
chkconfig --level 0123456 yum-updatesd off
chkconfig --level 0123456 acpid off
chkconfig --level 0123456 iptables off
service NetworkManager stop
service NetworkManagerDispatcher stop
service anacron stop
service atd stop
service auditd stop
service autofs stop
service avahi-daemon stop
service avahi-dnsconfd stop
service bluetooth stop
service capi stop
service centcore stop
service centstorage stop
service conman stop
service cups stop
service dc_client stop
service dc_server stop
service dhcdbd stop
service dovecot stop
service dund stop
service firstboot stop
service gpm stop
service hidd stop
service hplip stop
service httpd stop
service innd stop
service ip6tables stop
service ipmi stop
service irda stop
service irqbalance stop
service isdn stop
service kdump stop
service kudzu stop
service ldap stop
service lisa stop
service mdmonitor stop
service mdmpd stop
service microcode_ctl stop
service multipathd stop
service nagios stop
service named stop
service netconsole stop
service netfs stop
service netplugd stop
service nfs stop
service nfslock stop
service nscd stop
service ntpd stop
service oddjobd stop
service pand stop
service pcscd stop
service portmap stop
service postgresql stop
service psacct stop
service rdisc stop
service readahead_later stop
service restorecond stop
service rpcgssd stop
service rpcidmapd stop
service rpcsvcgssd stop
service rwhod stop
service saslauthd stop
service setroubleshoot stop
service smb stop
service snmpd stop
service snmptrapd stop
service spamassassin stop
service sysstat stop
service tux stop
service vncserver stop
service vsftpd stop
service wdaemon stop
service winbind stop
service wpa_supplicant stop
service xfs stop
service xinetd stop
service ypbind stop
service yum-updatesd stop
service acpid stop
service nfslock stop
chkconfig nfslock off
service portmap stop
chkconfig portmap off
service iptables stop
chkconfig iptables off
service sendmail stop
chkconfig sendmail off
service cups stop
chkconfig cups off
chkconfig --list | grep :on
转载于:https://blog.51cto.com/centilinux/777899
