Universitas Indonesia (Kambing)

deb http://kambing.ui.edu/debian lenny main non-free contrib
deb http://kambing.ui.edu/debian-volatile lenny/volatile main contrib
deb http://kambing.ui.edu/debian-security lenny/updates main non-free contrib
deb http://kambing.ui.edu/debian lenny-proposed-updates main non-free contrib

PENS ITS – Surabaya

deb http://kebo.vlsm.org/debian lenny main non-free contrib
deb http://kebo.vlsm.org/debian-volatile lenny/volatile main contrib
deb http://kebo.vlsm.org/debian-security lenny/updates main non-free contrib
deb http://kebo.vlsm.org/debian stable-proposed-updates main non-free contrib

Institut Teknologi Sepuluh Nopember – Surabaya

deb http://mirror.its.ac.id/debian lenny main non-free contrib
deb http://mirror.its.ac.id/debian-volatile lenny/volatile main contrib
deb http://mirror.its.ac.id/debian-security lenny/updates main non-free contrib
deb http://mirror.its.ac.id/debian stable-proposed-updates main non-free contrib

Universitas Jember

deb http://mirror.unej.ac.id/debian lenny main non-free contrib
deb http://mirror.unej.ac.id/debian-volatile lenny/volatile main contrib
deb http://mirror.unej.ac.id/debian-security lenny/updates main non-free contrib
deb http://mirror.unej.ac.id/debian stable-proposed-updates main non-free contrib

UGM

deb http://repo.ugm.ac.id/debian lenny main non-free contrib
deb http://repo.ugm.ac.id/debian-volatile lenny/volatile main contrib
deb http://repo.ugm.ac.id/debian-security lenny/updates main non-free contrib
deb http://repo.ugm.ac.id/debian stable-proposed-updates main non-free contrib

Indika

deb http://debian.indika.net.id/debian lenny main non-free contrib
deb http://debian.indika.net.id/debian-volatile lenny/volatile main contrib
deb http://debian.indika.net.id/debian-security lenny/updates main non-free contrib
deb http://debian.indika.net.id/debian stable-proposed-updates main non-free contrib

KLAS

deb http://buaya.klas.or.id/debian lenny main non-free contrib
deb http://buaya.klas.or.id/debian-volatile lenny/volatile main contrib
deb http://buaya.klas.or.id/debian-security lenny/updates main non-free contrib
deb http://buaya.klas.or.id/debian stable-proposed-updates main non-free contrib

Oregon State University

deb ftp://ftp.us.debian.org/debian lenny main non-free contrib
deb ftp://ftp.us.debian.org/debian-volatile lenny/volatile main contrib
deb ftp://ftp.us.debian.org/debian-security lenny/updates main non-free contrib
deb ftp://ftp.us.debian.org/debian stable-proposed-updates main non-free contrib

Squid memiliki Access List atau ACL yang bisa digunakan sebagai sarana untuk memfilter akses terhadap alamat url (situs) tertentu, acl yang digunakan disini adalah “url_regex“.

url_regex ini digunakan untuk memfilter berdasarkan alamat url-nya, misalkan kita ingin blok situs “www.playboy.com“, nah yang kita gunakan sebagai keyword untuk “url_regex” nya adalah “playboy.com“. Efek dari acl ini adalah akses ke seluruh situs yang menggunakan alamat domain “*.playboy.com” akan diblokir.

Namun jika kita hanya ingin blok akses ke subdomain saja dan akses ke domain induknya tetap bisa, maka kita bisa gunakan subdomain-nya sebagai keyword acl nya. Misalnya disini kita mau blok akses ke situs “pornstar.playboy.com” saja dan akses ke “www.playboy.com” dibolehkan, maka disini kita masukkan “pornstar.playboy.com” sebagai keyword acl-nya.

Cukup dengan penjelasan dan teori-teorinya, bosan kali yaa…pengennya langsung praktek..Kita lanjuut..

Kita asumsikan disini anda telah menginstall squid proxy dengan baik dan sudah berfungsi, dan file konfigurasi squid berada pada lokasi “/etc/squid/squid.conf”

Langkah-langkah yang kita lakukan untuk konfigurasi squid nya :

1. Bikin file baru untuk simpan list dari alamat situs yang akan kita blok aksesnya, disini saya menggunakan “vi” karena memang editor favorit saya..

# vi /etc/squid/porn.block.txt

2. Tambahkan list alamat situs yang sudah kita data untuk di blok pada file “/etc/squid/porn.block.txt“, contoh penulisannya adalah sbb :

playboy.com
penthouse.com
duniasex.com
17tahun.com
bangbros.com

Jumlah baris dari alamat tersebut, tergantung dari jumlah situs yang ingin anda blok, untuk database situs porno lainnya bisa anda ambil dari squidguard.org. Kemudian simpanlah file tersebut.

3. Edit file “/etc/squid/squid.conf” dan tambahkan konfigurasi ACL url_regex berikut :

acl porn url_regex “/etc/squid/porn.block.txt”

konfigurasi ini ditambahkan pada bagian acl dari file “squid.conf” nya, contohnya spt dibawah ini :

—–potongan file squid.conf ——

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl Lan src 192.168.10.0/24
acl porn url_regex “/etc/squid/porn.block.txt” <— ACL ditambahkan pada baris ini

—–potongan file squid.conf ——

Penjelasan terhadap acl ini adalah, kita mendefinisikan “porn” sebagai nama access list dengan tipe “url_regex“, dimana list dari url tersebut disimpan pada file dengan nama “/etc/squid/porn.block.txt”

4. Setelah acl porn kita definisikan, kita lanjutkan dengan definisi http_access terhadap list url dari acl porn tadi, dengan cara kita tambahkan lagi pada file “squid.conf” konfigurasi berikut :

http_access deny porn

konfigurasi ini ditambahkan pada bagian http_access dari squid.conf, contohnya spt dibawah ini :

—– potongan file squid.conf —–

http_access deny porn <— ditambahkan pada urutan paling atas dari http_access nya
http_access allow manager localhost
http_access allow lan
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow CONNECT !irc_ports
http_access deny all

—– potongan file squid.conf —–

penjelasan dari http_access ini adalah, akses http terhadap acl dengan nama “porn” akan diblok (deny),
dimana isi dari acl porn ini adalah alamat-alamat situs porno yang memang ingin kita blok.

Contoh file squid.conf setelah dikonfigurasi akan seperti ini :

—–potongan file squid.conf ——

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl Lan src 192.168.10.0/24
acl porn url_regex “/etc/squid/porn.block.txt”

http_access deny porn
http_access allow manager localhost
http_access allow lan
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow CONNECT !irc_ports
http_access deny all

—–potongan file squid.conf ——

5. Selanjutnya kita instruksikan supaya squid untuk membaca ulang file konfigurasi “squid.conf” nya, kita lakukan dengan perintah berikut ini :

# squid -k reconfigure

6. Sekarang kita ujicoba blok akses ke situs pornonya, buka browser favorit kamu misalnya Firefox, kemudian ketikkan salah satu alamat situs yang ada pada file acl porn, misalnya “www.playboy.com“. Jika muncul halaman error “acess denied” maka blokir situs dengan squid nya sukses..

kalo masih bisa diakses..coba di croscheck lagi langkah-langkah diatas…Good Luck..!

perintah [option…] [argumen…]

Option merupakan pilihan yang dapat kita gunakan untuk memberikan hasil tertentu dari suatu perintah. Argumen umumnya merupakan sesuatu yang akan diproses oleh perintah, misalnya nama file atau nama direktori.

Tanda [ ] merupakan simbol bahwa option dan argumen tidak harus selalu digunakan dalam menjalankan perintah. Tanda titik-titik menandakan bahwa baik option dan argumen dapat lebih dari satu. Seluruh perintah dalam Linux dan UNIX bersifat case sensitive, jadi perintah LS akan dianggap berbeda dengan ls.

Sekarang kita mulai dengan perintah-perintah dasar yang umum digunakan dalam Linux :

ls
Perintah ini merupakan perintah untuk menampilkan isi suatu direktori. Perintah ini mirip seperti perintah dir dalam DOS.
Ada beberapa cara untuk menggunakan perintah ini, misalnya :
# ls
# ls -l
Untuk mengetahui lebih lengkap tentang perintah ls, silakan lihat di manual dengan perintah man ls.

more
Perintah more dapat digunakan untuk melihat isi suatu file teks dengan layar per layar. untuk keluar dari tampilan more dengan menekan tombol q.

cat
Perintah ini digunakan untuk menampilkan isi file ke layar tanpa fasilitas tampilan layar per layar.
Biasanya digunakan bersamaan dengan pipeline atau redirection. Misal untuk menampilkan isi file /etc/passwd dan /etc/group, gunakan perintah :
# cat /etc/passwd /etc/group

cd
Perintah ini mirip seperti perintah cd dalam DOS yaitu digunakan untuk pindah ke direktori tertentu. Contoh perintah :
# cd /home/adje
Untuk menuju kembali ke direktori /home, maka digunakan perintah :
# cd ..

cp
Perintah ini digunakan untuk mengkopi suatu file atau direktori. misalnya :
# cp contoh1 contoh2
Perintah di atas maksudnya akan mengkopi contoh1 ke file contoh2. Untuk mengkopi seluruh direktori menggunakan perintah :
# cp -R /home/adje /home/afri

mv
Perintah ini digunakan untuk memindahkan suatu file ke lokasi lain atau dengan nama lain. Contoh :

# mv contoh1.php contoh2.php
#mv contoh1.php /home/adje/contoh2.php

rm
Perintah ini digunakan untuk menghapus direktori atau file. Perintah ini mirip dengan perintah del dalam DOS. Dalam menggunakan perintah ini agar hati-hati karena dalam Linux tidak ada perintah undelete atau unerase. Contoh penggunaan rm sbb :
#rm contoh1.php
Untuk menghapus suatu direktori gunakan perintah :
#rm /home/adje/temp

mkdir
Perintah ini digunakan untuk membuat direktori. Misalnya :
#mkdir contoh

Pipeline
Pada Linux dan UNIX, hasil keluaran suatu proses program dapat diberikan sebagai input pada proses lainnya. Contohnya :

#ls -l /home/adje | more

grep
Perintah grep digunakan untuk men-filter masukan dan menampilkan dalam bentuk baris-baris yang sesuai dengan pola yang anda inginkan. Contoh :

# ps ax | grep wvdial

Redirection
Di dalam Linux atau UNIX, anda dapat membelok-belokkan standar input, output ataupun standar error menuju tujuan lain.

Misalnya anda dapat membelokkan standar output suatu program ke file atau membelokkan standar input suatu program dari suatu file. Proses pembelokkan ini disebut redirection dan di *NIX digunakan simbol “>” (untuk membelokkan standar output ke file) dan simbol “<” (untuk membelokkan standar input dari file). Contoh :

Untuk menyimpan tampilan isi seluruh directori /etc ke sebuah file, gunakan perintah :

#ls -lR /etc > isi-etc

Untuk menambahkan isi file isi-etc dengan data lain, gunakan simbol “>>” (append) pada redirection, misal :

#ls -lR /home/adje >> isi-etc

Untuk membuat perintah mensortir data yang terdapat pada file contoh.txt dapat digunakan perintah :

#sort < contoh.txt

Perintah-perintah di atas adalah perintah-perintah yang sering digunakan dalam Linux atau UNIX. Bila anda masih merasa kesulitan silakan baca manual-nya terlebih dahulu. Karena membaca manual itu sangat penting bila kita sering meng-oprek Linux atau UNIX. Dari manual itu kita bisa mendapat solusi dari masalah yang kita hadapi

Copy from http://aceh.linux.or.id/archives/182

Copy from http://wiki.linux.or.id/Perintah_dasar_Linux

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

Namun untuk squid dengan versi 2.6.xx cukup dengan menambahkan konfigurasi berikut pada squid.conf nya :

http_port 3128 transparent
always_direct allow all

Sepertinya untuk versi squid 2.6.xx, transparent proxy bisa di set lebih gampang

Here, we will look at monitoring the local system’s swap and memory usage over time. This assumes that MRTG is already configured or you have an understanding of how to configure MRTG .The first step is to create the script, which is very simplistic. Save it as /usr/local/bin/memstat.sh with the following contents:

#!/bin/sh/usr/bin/free -b | /bin/awk 'NR==2 {ramUsed = $3 }NR==4 {swapUsed = $3 }END { print swapUsed "n" ramUsed "n0n0" }'

The output, for a human, is not very interesting:

# /usr/local/bin/memstat.sh0154800947200

For MRTG, however, with the appropriate configuration, it becomes very interesting. Add the following snippet to /etc/mrtg.cfg. Ideally, MRTG should be running every five minutes for a good sampling.

Target[localmem]: `/usr/local/bin/memstat.sh`Title[localmem]: Mem and Swap Usage [surtr]PageTop[localmem]: <h1>Memory and Swap Usage [surtr]</h1>MaxBytes[localmem]: 100000000000ShortLegend[localmem]: BYLegend[localmem]: MemoryLegendI[localmem]: SwapLegendO[localmem]: MemLegend1[localmem]: SwapLegend2[localmem]: MemOptions[localmem]: gauge,growright,nopercentkMG[localmem]: k,M,G,T,P,XColours[localmem]: RED#bb0000,BLUE#1000ff,GREEN#006600,VIOLET#ff00ff

This code tells MRTG to execute the /usr/local/bin/memstat.sh script and take the numbers it provides as output as input for itself, which will then be used to create a typical MRTG graph of the data. This will then give you a sampling of memory and swap usage over time. MRTG will create graphs for yearly, monthly, weekly, and daily statistics.Using the same, you could perform the same data analysis for CPU usage, disk usage, e-mail statistics, Web traffic, and much more.(from www.builderau.com.au)

• Client-side TCP connections
• Server-side TCP connections
• Writing cachable responses to disk
• Reading cache hits from disk
• Log files
• Communication with external helper processes, such as redirectors and authenticators
• Idle (persistent) HTTP connections

Even when Squid is not doing anything, it has some number of file descriptors open for log files and helpers. In most cases, this is between 10 and 25, so it’s probably not a big deal. If you have a lot of external helpers, that number goes up. However, the file descriptor count really goes up once Squid starts serving requests. In the worst case, each concurrent request requires three file descriptors: the client-side connection, a server-side connection for cache misses, and a disk file for reading hits or writing misses.A Squid cache with just a few users might be able to get by with a file descriptor limit of 256. For a moderately busy Squid, 1024 is a better limit. Very busy caches should use 4096 or more. One thing to keep in mind is that file descriptor usage often surges above the normal level for brief amounts of time. This can happen during short, temporary network outages or other interruptions in service.There are a number of ways to determine the file descriptor limit on your system. One is to use the built-in shell commands limit or ulimit.For Bourne shell users:

root# ulimit -n1024

For C shell users:

root# limit descdescriptors     1024

If you already have Squid compiled and installed, you can just look at the cache.log file for a line like this:

2003/12/12 11:10:54| With 1024 file descriptors available

If Squid detects a file descriptor shortage while it is running, you’ll see a warning like this in cache.log:

WARNING! Your cache is running out of file descriptors

If you see the warning, or know in advance that you’ll need more file descriptors, you should increase the limits. The technique for increasing the file descriptor limit varies between operating systems.

For Linux Users

Linux users need to edit one of the system include files and twiddle one of the system parameters via the /proc interface. First, edit /usr/include/bits/types.h and change the value for __FD_SETSIZE. Then, give the kernel a new limit with this command:

root# echo 1024 > /proc/sys/fs/file-max

Finally, before compiling or running Squid, execute this shell command to set the process limit equal to the kernel limit:

root# ulimit -Hn 1024

After you have set the limit in this manner, you’ll need to reconfigure, recompile, and reinstall Squid. Also note that these two commands do not permanently set the limit. They must be executed each time your system boots. You’ll want to add them to your system startup scripts.

For NetBSD/OpenBSD/FreeBSD Users

On BSD-based systems, you’ll need to compile a new kernel. The kernel configuration file lives in a directory such as /usr/src/sys/i386/conf or /usr/src/sys/arch/i386/conf. There you’ll find a file, possibly named GENERIC, to which you should add a line like this:

options       MAXFILES=8192

For OpenBSD, use option instead of options. Reboot your system after you’ve finished configuring, compiling, and installing your new kernel. Then, reconfigure, recompile, and reinstall Squid.

For Solaris Users

Add this line to your /etc/system file:

set rlim_fd_max = 1024

Then, reboot the system, reconfigure, recompile, and reinstall Squid.For further information on file descriptor limits, see Chapter 3, “Compiling and Installing”, of Squid: The Definitive Guide or section 11.4 of the Squid FAQ.  

web experience as Firefox suddenly decides to run painfully slow. About 30 minutes wasted on finding the culprit (like changing your DNS servers, clearing browser cache, etc.) until you decide to check the router and then Squid and then its logs. And then you find something fishy:

WARNING! Your cache is running out of filedescriptors

I won’t be explaining why this happens. Others have done it before. What I’m going to do is present you with a solution that does not require a complete Squid recompilation/reinstallation procedure.

However, I believe it requires a fairly modern setup to work. I was using Squid 2.6 STABLE6 on Fedora Core 6 with 2.6.18 kernel. Your mileage may vary.

Stopping the Squid

This is important:

/etc/init.d/squid stop

/etc/squid/squid.conf

At the very end of this file there is a line which needs adding/changing so it reads:

max_filedesc 8192

/etc/init.d/squid

Just after the comments (before any code) add this line:

ulimit -HSn 8192

/usr/include/bits/typesizes.h

Edit the __FD_SETSIZE line so it reads:

#define __FD_SETSIZE            8192

Starting the squid

/etc/init.d/squid start

And now watch the /var/log/squid/cache.log for a similar line:

2007/01/01 18:32:27| With 8192 file descriptors available

If it still says 1024 file descriptors available (or similarly low value) you are out of luck (or you’ve just messed something up).

An easy way to monitor Squid’s memory usage is with standard system tools such as top and ps. You can also ask Squid itself how much memory it is using, through either the cache manager or SNMP interfaces. If the process size becomes too large, you’ll want to take steps to reduce it. A good rule of thumb is to not let Squid’s process size exceed 60% to 80% of your RAM capacity.

One of the most important uses for memory is the main cache index. This is a hash table that contains a small amount of metadata for each object in the cache. Unfortunately, all of these “small” data structures add up to a lot when Squid contains millions of objects. The only way to control the size of the in-memory index is to change Squid’s disk cache size (with the cache_dir directive). Thus, if you have plenty of disk space, but are short on RAM, you may have to leave the disk space underutilized.

Squid’s in-memory cache can also use significant amounts of RAM. This is where Squid stores incoming and recently retrieved objects. Its size is controlled by setting the cache_mem directive. Note that the cache_mem directive only affects the size of the memory cache, not Squid’s entire memory footprint.

Squid also uses some memory for various I/O buffers. For example, each time a client makes an HTTP request to Squid, a number of memory buffers are allocated and then later freed. Squid uses similar buffers when forwarding requests to origin servers, and when reading and writing disk files. Depending on the amount and type of traffic coming to Squid, these I/O buffers may require a lot of memory. There’s not much you can do to control memory usage for these purposes. However, you can try changing the TCP receive buffer size with the tcp_recv_bufsize directive.

If you have a large number of clients accessing Squid, you may find that the “client DB” consumes more memory than you would like. It keeps a small number of counters for each client IP address that sends requests to Squid. You can reduce Squid’s memory usage a little by disabling this feature. Simply put client_db off in squid.conf.

Another thing that can help is to simply restart Squid periodically, say, once per week. Over time, something may happen (such as a network outage) that causes Squid to temporarily allocate a large amount of memory. Even though Squid may not be using that memory, it may still be attached to the Squid process. Restarting Squid allows your operating system to truly free up the memory for other uses.

You can use Squid’s high_memory_warning directive to warn you when its memory size exceeds a certain limit. For example, add a line like this to squid.conf:

high_memory_warning 400 MB

Then, if the process grows beyond that value, Squid writes warnings to cache.log and syslog if configured.

Use the following access control rules to make sure this never happens to you. First, always deny all requests that don’t come from your local network. Define an ACL element for your subnet:

acl MyNetwork src 10.0.0.0/16

Then, place a deny rule near the top of your http_access rules that matches requests from anywhere else:

http_access deny !MyNetwork
http_access ...
http_access ...

While that may stop outsiders, it may not be good enough. It won’t stop insiders who intentionally, or unintentionally, try to forward spam through Squid. To add even more security, you should make sure that Squid never connects to another server’s SMTP port:

acl SMTP_port port 25
http_access deny SMTP_port

In fact, there are many well-known TCP ports, in addition to SMTP, to which Squid should never connect. The default squid.conf includes some rules to address this. There, you’ll see a Safe_ports ACL element that defines good ports. A deny !Safe_ports rule ensures that Squid does not connect to any of the bad ports, including SMTP.