Squid
There is a bug with RESPMOD (REQMOD is working well) of Squid from version 5.5 to 6.11 then the file > 65563 bytes can not be download (https://bugs.squid-cache.org/show_bug.cgi?id=5463)
Please use Squid version 4.13 or 6.13 or 7.0.1 (Which has already included the bug fix)
Basic Configuration
Squid configuration should be done by modifying “squid.conf” (e.g, /etc/squid3/squid.conf). Below is an example of a simplified version of configuration for Squid. For more detailed documentation, please refer to the Squid manual.
- Enable acl localnet.
Search for “acl localnet” section, uncomment all “acl localnet” lines. Below is an example of how the configuration might look:
- Allow localnet and localhost access by adding the following lines. (under the "Recommended minimum Access Permission configuration" section)
- Enable ICAP and set the Preview Size to 0. (these values don't exist, so you simply add them anywhere in the file)
- Enable ReqMod (upload mode)...these don't exist, so add them anywhere
- Enable RespMod (download mode) again, these don't exist, so add them anywhere
Persistent connections
By default, Squid is using persistent connections to the MetaDefender ICAP Server, this feature can be controlled explicitly by the following directive:
If persistent connections are enabled in Squid, the same setting should be applied to the ICAP side or Squid might report some ICAP errors. See 3. Configuring MetaDefender ICAP Server.
Restart Squid to apply the new configuration.
If you are using Squid 3.1 there is a bug in Squid that drops the connection to the ICAP server. You will notice messages in Squid's cache.log file similar to the following:
essential ICAP service is down after an options fetch failure: icap://<MetaDefender ICAP Server>:1344/OMSScanReq-AV [down,!opt]
This may cause you to get Squid error messages when trying to access websites.
To fix this, either upgrade to Squid 3.2 or higher, or add icap_persistent_connections off to your squid.conf file.
Scanning HTTPS content
Learn how to configure Squid to scan HTTPS content below. This allows Squid to send HTTPS content to the MetaDefender ICAP Server for scanning purposes.
Requirements
- Version: Tested with 3.5.19
- Squid has to be compiled with SSL support. For further information, please see: http://docs.diladele.com/
Configuration
Tell Squid to listen on the following ports by modifying the line
to this:
In addition, the following lines have to be inserted:
replace security_file_certgen.exe by ssl_crtd.exe
Certificate
Generate a new root certificate for Squid:
After generating a new certificate, the certificate storage should be reinitialized by deleting the <SQUIDFOLDER>\var\cache\squid_ssldb folder and running:
The certificate has to be installed as a root certificate in the browser. Squid has to be restarted after the changes.