Squid反向代理加速缓存+负载均衡实验架构
實(shí)驗(yàn)環(huán)境：
公司有兩臺(tái)web服務(wù)器，運(yùn)行同一套網(wǎng)站，讀取同一臺(tái)mysql數(shù)據(jù)庫(kù)。
兩臺(tái)web服務(wù)器的主機(jī)名如下：
test1.com 192.168.1.119
test2.com 192.168.1.120
squid服務(wù)器ip：192.168.1.123
DNS: 192.168.9.254
實(shí)驗(yàn)思路：DNS將www.fb.com解析給squid服務(wù)器，squid輪詢web主機(jī)返回其中一臺(tái)作應(yīng)答，并提供緩沖加速的服務(wù)！
注意：在次試驗(yàn)中，針對(duì)https的部分有點(diǎn)問題，需要負(fù)載均衡設(shè)備做一些設(shè)置！另外，兩臺(tái)web服務(wù)器部分網(wǎng)站目錄的同步問題，已解決可以才從NFS掛載目錄的方式來實(shí)現(xiàn)！
一、基礎(chǔ)配置
A、更新
1、更換更新源(服務(wù)器位于國(guó)內(nèi)做此操作)
sed -i "s/mirror.centos.org/centos/mirrors.centos.91.com/g" /etc/yum.repos.d/CentOS-Base.repo
sed -i "s/^mirrorlist/#mirrorlist/g" /etc/yum.repos.d/CentOS-Base.repo
sed -i "s/^#baseurl/baseurl/g" /etc/yum.repos.d/CentOS-Base.repo
2、更新
yum clean all
yum -y update
[sepatator]
B、優(yōu)化
1、增加以下內(nèi)容到/etc/sysctl.conf末尾
kernel.core_uses_pid = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_window_scaling = 0
net.ipv4.tcp_sack = 0
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.ip_local_port_range = 1024 65536
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_retries2 = 5
fs.file-max = 655360
net.core.somaxconn = 4096
執(zhí)行：
sysctl -p
使之生效
2、加大可允許打開的文件句柄數(shù)
echo "* soft nofile 65536" >>/etc/security/limits.conf
echo "* hard nofile 65536" >>/etc/security/limits.conf
3、時(shí)間校對(duì)
yum -y install ntp
service ntpd restart
service ntpd stop
echo "#time update" >> /etc/crontab
echo "0 23 * * * root /usr/sbin/ntpdate time.windows.com" >> /etc/crontab
C、硬盤分區(qū)掛載
查看硬盤
fdisk -l
根據(jù)實(shí)際物理機(jī)器是否硬raid及硬盤數(shù)量做不同的raid及分區(qū)情況
因?yàn)檫@里是做cache，不建議使用軟raid
二、squid的編譯安裝配置
1、squid的安裝
安裝gcc等工具包
yum install gcc gcc+ gcc-c++ gcc-g77 autoconf automake ncurses-devel flex openssl-devel mod_ssl make
cd /home/soft
tar zxvf squid-3.1.16.tar.gz
cd squid-3.1.16
./configure --prefix=/usr/local/squid --enable-gnuregex --enable-dlmalloc --with-pthreads --enable-ssl --enable-stacktrace --enable-removal-policies=heap,lru --enable-delay-pools --enable-kill-parent-hack --enable-snmp --enable-icmp --enable-err-language=simplify_Chinese --enable-default-err-languages=Simplify_Chinese --enable-cahce-digests --disable-ident-lookups --with-filedescriptors=65536 --enable-underscore --enable-large-cache-files --with-large-files --enable-storeio=aufs,diskd,ufs --enable-linux-netfilter --enable-async-io=160 --enable-cachemgr
make
make install
cd /usr/local/squid
2、生成證書并申請(qǐng)新證書
openssl genrsa -des3 -out *.squid.key 1024
openssl req -new -key *.squid.key -out *.squid.csrc
這是需要生成正式證書使用的，如果只是需要未認(rèn)證的證書，可使用以下命令生成：
openssl req -utf8 -new -key *.squid.key -out *.squid.csr
這里生成的證書不要使用密碼，貌似squid不能使用密碼，我第一次使用了密碼能正常啟動(dòng)，但會(huì)提示未認(rèn)證，讓我搞了好久的時(shí)間。
3、squid配置
mkdir /data/cache1
mkdir /data/cache2
mkdir /data/cachelog
chown squid /data/cache*
把服務(wù)商提供的證書放到/data/key/目錄下，包括中級(jí)根證書，證書，公鑰三個(gè)文件。
修改squid.conf文件內(nèi)容：
------------------------------------------------------------------------------
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
# acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
# acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.9.0/24 # RFC1918 possible internal network
# acl localnet src fc00::/7 # RFC 4193 local private network range
# acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
?
acl CONNECT method CONNECT
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
# http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
# http_port 3128
# Uncomment and adjust the following to add a disk cache directory.
# cache_dir ufs /usr/local/squid/var/cache 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid/var/cache
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
##---------------------------------------
# host and cache port setting
##----------------------------------------
# 主機(jī)名（3.0加入配置），無此項(xiàng)無法啟動(dòng)
visible_hostname squid
cache_mgr jason.kou@factorybuy.com
# 設(shè)置運(yùn)行squid用戶，一般不能以root運(yùn)行
cache_effective_user squid
cache_effective_group squid
cachemgr_passwd password all
client_persistent_connections off
server_persistent_connections on
half_closed_clients off
# 設(shè)定squid為accel加速模式,vhost必須要加.否則將無法將主機(jī)頭轉(zhuǎn)發(fā)至后端服務(wù)器,
# 訪問時(shí)就會(huì)出現(xiàn)無法找到主機(jī)頭的錯(cuò)誤
http_port 80 accel vhost vport
# 添加443端口之后可能導(dǎo)致IE瀏覽器無法正常訪問https頁面，未測(cè)試
http_port 443 accel vhost vport
# https_port 443 cert=/data/squid.csr key=/data/squid.key defaultsite=www.fb.com
# https_port 443 cert=/usr/local/squid/data/cert.pem /usr/local/squid/data/key.pem
##----------------------------------------
# cache directory setting
##----------------------------------------
# 緩存目錄8192M，其中一級(jí)目錄16個(gè)，二級(jí)256個(gè)（每個(gè)一級(jí)下16個(gè)二級(jí)）
cache_dir ufs /usr/local/squid/data/cache 8192 16 256
max_open_disk_fds 0
##-----------------------------------------
# cache storage setting
##-----------------------------------------
# 大于此容量的對(duì)象將不會(huì)被保存在磁盤上,默認(rèn)大小是4M,如果squid服務(wù)器用于緩沖flash等大型文件,
# 建議將此值變大.否則過大的文件在下次重>啟后將需要重新獲取
maximum_object_size_in_memory 4 MB
minimum_object_size 0 KB
maximum_object_size 4 MB
# 緩存內(nèi)容大小控制，當(dāng)cache目錄被占用到95%時(shí)，內(nèi)容將被清空20%
cache_swap_high 95
cache_swap_low 80
# 替換機(jī)制(lru叫做“最近不常用的單元”unit一般就是常說object， 也就是當(dāng)cache
# 中的內(nèi)容比如內(nèi)存或硬盤達(dá)到上限時(shí)就需要進(jìn)行數(shù)據(jù)的換進(jìn)和換出工作)
memory_replacement_policy lru
cache_replacement_policy lru
##------------------------------------------
# cache time out setting
##------------------------------------------
forward_timeout 20 seconds
connect_timeout 15 seconds
read_timeout 3 minutes
request_timeout 1 minutes
persistent_request_timeout 15 seconds
client_lifetime 15 minutes
shutdown_lifetime 5 seconds
negative_ttl 10 seconds
##---------------------------------------------
# cache log setting
##---------------------------------------------
emulate_httpd_log on
logformat squid %ts.%tu %tr %>a %Ss/%>Hs %<st %rm %ru %un %Sh/%<A %mt
access_log /usr/local/squid/data/logs/access_log.log common
cache_log /usr/local/squid/data/logs/cache.log
cache_store_log /usr/local/squid/data/logs/store.log
cache_swap_log /usr/local/squid/data/logs/cache_swap.log
mime_table /usr/local/squid/etc/mime.conf
# 錯(cuò)誤信息目錄
error_directory /usr/local/squid/share/errors/en-us/
pid_filename /usr/local/squid/data/squid.pid
# 不記錄store.log
# cache_store_log none
##--------------------------------------------
# vhost setting
##--------------------------------------------
# 定義不同的父節(jié)點(diǎn),將節(jié)點(diǎn)設(shè)為no-query以及originserver說明這些節(jié)點(diǎn)是實(shí)際服務(wù)器
cache_peer test1.com parent 80 0 no-query no-digest originserver name=test1 round-robin
cache_peer test2.com parent 80 0 no-query no-digest originserver name=test2 round-robin
# 設(shè)定不同域名轉(zhuǎn)發(fā)到不同的cache_peer上,如果沒有這項(xiàng).不同域名的域名可能被分發(fā)到同一臺(tái)服務(wù)器上.
cache_peer_domain test1 www.fb.com
cache_peer_domain test2 www.fb.com
# 允許客戶端所有請(qǐng)求（這里可以設(shè)置攔截url，格式如下面兩行緩存設(shè)置）
http_access allow all
# 設(shè)置不緩存url類型（空格隔開
acl QUERY urlpath_regex .php .jsp .asp .pl .cgi
cache deny QUERY
---------------------------------------------------------------------
hosts_file /etc/hosts
4、啟動(dòng)
/usr/local/squid/sbin/squid -z 生成緩存目錄
/usr/local/squid/sbin/squid -s
netstat -na |grep 443
netstat -na |grep 80
看端口監(jiān)聽是否啟動(dòng)了
如果OK，那么squid配置完畢，這里不做squid配置的一些講解，因?yàn)槲冶救艘膊皇欠浅Ｊ煜?#xff01;
三、雙機(jī)高可用
一些關(guān)于squid調(diào)試的命令:
1，初始化你在 squid.conf 里配置的 cache 目錄
#squid/sbin/squid -z
如果有錯(cuò)誤提示，請(qǐng)檢查你的 cache目錄的權(quán)限。
2，對(duì)你的squid.conf 排錯(cuò)，即驗(yàn)證 squid.conf 的 語法和配置。
#squid/sbin/squid -k parse
如果squid.conf 有語法或配置錯(cuò)誤，這里會(huì)返回提示你，如果沒有返回，恭喜，可以嘗試啟動(dòng)squid。
3，在前臺(tái)啟動(dòng)squid，并輸出啟動(dòng)過程。
#/usr/local/squid/sbin/squid -N -d1
如果有到 ready to server reques，恭喜，啟動(dòng)成功。
然后 ctrl + c，停止squid，并以后臺(tái)運(yùn)行的方式啟動(dòng)它。
4，啟動(dòng)squid在后臺(tái)運(yùn)行。
#squid/sbin/squid -s
這時(shí)候可以 ps -A 來查看系統(tǒng)進(jìn)程，可以看到倆個(gè) squid 進(jìn)程。
5，停止 squid
#squid/sbin/squid -k shutdown
這個(gè)不用解釋吧。
6，重引導(dǎo)修改過的 squid.conf
#squid/sbin/squid -k reconfigure
當(dāng)你發(fā)現(xiàn)你的配置有不盡你意的時(shí)候，可以隨時(shí)修改squid.conf，然后別忘記對(duì)你的 squid.conf排錯(cuò)，
然后再執(zhí)行此指令，即可讓squid重新按照你的 squid.conf 來運(yùn)行。
7，把squid添加到系統(tǒng)啟動(dòng)項(xiàng)
編輯 /etc/rc.d/rc.local
添加如下行： /usr/local/squid/sbin/squid -s
再來點(diǎn)其他的。
1，修改cache 緩存目錄的權(quán)限。
#chown -R squid:squid /home/cache
我的cache緩存目錄是 /home/cache,squid執(zhí)行用戶和用戶組是 squid，squid。
2，修改squid 日志目錄的權(quán)限
#chown -R squid:squid /usr/local/squid/data/logs
這一步并不是適合每一個(gè)使用squid的用戶.意為讓squid有權(quán)限在該目錄進(jìn)行寫操作 。
例如生成 access.log cache.log store.log
3，查看你的日志文檔。
#more /usr/local/squid/var/logs/access.log | grep TCP_MEM_HIT
該指令可以看到在squid運(yùn)行過程中，有那些文件被squid緩存到內(nèi)存中，并返回給訪問用戶。
#more /usr/local/squid/var/logs/access.log | grep TCP_HIT
該指令可以看到在squid運(yùn)行過程中，有那些文件被squid緩存到cache目錄中，并返回給訪問用戶。
#more /usr/local/squid/var/logs/access.log | grep TCP_MISS
該指令可以看到在squid運(yùn)行過程中，有那些文件沒有被squid緩存，而是現(xiàn)重原始服務(wù)器獲取并返回給訪問用戶。
關(guān)掉不必要的服務(wù)
echo 'alias vi="vim" alias grep="grep --color"' >> /etc/profile
echo -e "* soft nofile 65536* hard nofile 65536" > /etc/security/limits.conf
chkconfig --level 0123456 NetworkManager off
chkconfig --level 0123456 NetworkManagerDispatcher off
chkconfig --level 0123456 anacron off
chkconfig --level 0123456 atd off
chkconfig --level 0123456 auditd off
chkconfig --level 0123456 autofs off
chkconfig --level 0123456 avahi-daemon off
chkconfig --level 0123456 avahi-dnsconfd off
chkconfig --level 0123456 bluetooth off
chkconfig --level 0123456 capi off
chkconfig --level 0123456 centcore off
chkconfig --level 0123456 centstorage off
chkconfig --level 0123456 conman off
chkconfig --level 0123456 cups off
chkconfig --level 0123456 dc_client off
chkconfig --level 0123456 dc_server off
chkconfig --level 0123456 dhcdbd off
chkconfig --level 0123456 dovecot off
chkconfig --level 0123456 dund off
chkconfig --level 0123456 firstboot off
chkconfig --level 0123456 gpm off
chkconfig --level 0123456 hidd off
chkconfig --level 0123456 hplip off
chkconfig --level 0123456 httpd off
chkconfig --level 0123456 innd off
chkconfig --level 0123456 ip6tables off
chkconfig --level 0123456 ipmi off
chkconfig --level 0123456 irda off
chkconfig --level 0123456 irqbalance off
chkconfig --level 0123456 isdn off
chkconfig --level 0123456 kdump off
chkconfig --level 0123456 kudzu off
chkconfig --level 0123456 ldap off
chkconfig --level 0123456 lisa off
chkconfig --level 0123456 mdmonitor off
chkconfig --level 0123456 mdmpd off
chkconfig --level 0123456 microcode_ctl off
chkconfig --level 0123456 multipathd off
chkconfig --level 0123456 nagios off
chkconfig --level 0123456 named off
chkconfig --level 0123456 netconsole off
chkconfig --level 0123456 netfs off
chkconfig --level 0123456 netplugd off
chkconfig --level 0123456 nfs off
chkconfig --level 0123456 nfslock off
chkconfig --level 0123456 nscd off
chkconfig --level 0123456 ntpd off
chkconfig --level 0123456 oddjobd off
chkconfig --level 0123456 pand off
chkconfig --level 0123456 pcscd off
chkconfig --level 0123456 portmap off
chkconfig --level 0123456 postgresql off
chkconfig --level 0123456 psacct off
chkconfig --level 0123456 rdisc off
chkconfig --level 0123456 readahead_later off
chkconfig --level 0123456 restorecond off
chkconfig --level 0123456 rpcgssd off
chkconfig --level 0123456 rpcidmapd off
chkconfig --level 0123456 rpcsvcgssd off
chkconfig --level 0123456 rwhod off
chkconfig --level 0123456 saslauthd off
chkconfig --level 0123456 setroubleshoot off
chkconfig --level 0123456 smb off
chkconfig --level 0123456 snmpd off
chkconfig --level 0123456 snmptrapd off
chkconfig --level 0123456 spamassassin off
chkconfig --level 0123456 sysstat off
chkconfig --level 0123456 tux off
chkconfig --level 0123456 vncserver off
chkconfig --level 0123456 vsftpd off
chkconfig --level 0123456 wdaemon off
chkconfig --level 0123456 winbind off
chkconfig --level 0123456 wpa_supplicant off
chkconfig --level 0123456 xfs off
chkconfig --level 0123456 xinetd off
chkconfig --level 0123456 ypbind off
chkconfig --level 0123456 yum-updatesd off
chkconfig --level 0123456 acpid off
chkconfig --level 0123456 iptables off
service NetworkManager stop
service NetworkManagerDispatcher stop
service anacron stop
service atd stop
service auditd stop
service autofs stop
service avahi-daemon stop
service avahi-dnsconfd stop
service bluetooth stop
service capi stop
service centcore stop
service centstorage stop
service conman stop
service cups stop
service dc_client stop
service dc_server stop
service dhcdbd stop
service dovecot stop
service dund stop
service firstboot stop
service gpm stop
service hidd stop
service hplip stop
service httpd stop
service innd stop
service ip6tables stop
service ipmi stop
service irda stop
service irqbalance stop
service isdn stop
service kdump stop
service kudzu stop
service ldap stop
service lisa stop
service mdmonitor stop
service mdmpd stop
service microcode_ctl stop
service multipathd stop
service nagios stop
service named stop
service netconsole stop
service netfs stop
service netplugd stop
service nfs stop
service nfslock stop
service nscd stop
service ntpd stop
service oddjobd stop
service pand stop
service pcscd stop
service portmap stop
service postgresql stop
service psacct stop
service rdisc stop
service readahead_later stop
service restorecond stop
service rpcgssd stop
service rpcidmapd stop
service rpcsvcgssd stop
service rwhod stop
service saslauthd stop
service setroubleshoot stop
service smb stop
service snmpd stop
service snmptrapd stop
service spamassassin stop
service sysstat stop
service tux stop
service vncserver stop
service vsftpd stop
service wdaemon stop
service winbind stop
service wpa_supplicant stop
service xfs stop
service xinetd stop
service ypbind stop
service yum-updatesd stop
service acpid stop
service nfslock stop
chkconfig nfslock off
service portmap stop
chkconfig portmap off
service iptables stop
chkconfig iptables off
service sendmail stop
chkconfig sendmail off
service cups stop
chkconfig cups off
chkconfig --list | grep :on
?
轉(zhuǎn)載于:https://blog.51cto.com/centilinux/777899
總結(jié)
以上是生活随笔為你收集整理的Squid反向代理加速缓存+负载均衡实验架构的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： mysql---复杂的sql语句join
- 下一篇： 重载运算符操作_学习