Monday, October 26, 2009

Linux Securirty Notes 14: Squid notes 7: Bandwidth Management using Delay Pools

Squid - Delay Pools Bandwidth Management
    This feature is used to restrict the bandwidth usage for the user community. It  has been introduced in ver 2.x

Implementing bandwidth management using delay pool

Delay Pools have 3 different class for restriction

1. class 1 pool allows to restrict the rate of bandwidth for large downloads.
    This makes the restriction of rate of download of a large file.
Implementing Class1 delay pool
Steps:
  1.  Define the ACL for the delay pool
  2.  Defines the number of delay pools (delay_pools 1)
  3.  Define the class of delay pool    (delay_calss 1 1)
  4.  Set the parameters for the pool number (delay_parameres 1 restore_rate/max_size). Once the request exceds the max_size then the squid will make the bandwidth to the given restore_rate for a user/source(The mesurement is taken in "bytes")  eg:- delay_parameters 1 20000/15000
  5.  Enable the delay_access to include the feature (delay_access)
Configure the class 1 delay pool
# vim squid.conf
--------
acl    bw_users    src    192.168.1.0/24      # The acl defined for the Network    
delay_pools    1                                         # This will tell the delay pool number
delay_calss    1 1                                       # This defines the delay pool number 1 is a class1 type delay pool
delay_parameters    1    20000/15000        #This is delay parameter for pool number 1 which has the restore rate of 20000 when the usage hits 15000 bytes
delay_access    1    allow    bw_users      # This is the access tag which tie to the acl bw_users
--------
# relaod the squid

    This will make the bandwidth usage for any one of the src when execeds the download limit of 15K, restores the rate of download to 20K/s.
Test the configuration by downloading files using wget
Limitations of class pool1:
    If we have a bandwidth of 1500000 Bytes and if we configure a rate of 20000 bytes per sec then the max simultaneous connections will be 1500000/20000 = 75. This will max out the connection if we have a large number of connections from the src
 
2. Class 2 pool allows to set the bandwidth usage to a sustained rate

    Using the class 2 pool we can overcome the Limitation of max out in class1. So here we can implement the Bandwidth in aggregate rate.


Configure the class 2 pool

If we have a Link with bandwidth of -(1.5Mb/s) 1544000 bytes/s of bandwidth
If we need to limit or set ceiling of 62500 bytes/s (500k/s) as bandwidth for the netusage
and 10% of the ceiling for each users

# vim squid.conf
----------
acl    bw_users    src    192.168.1.0/24 # The acl defined for the Network
delay_pools    1                                    # Number of Pool
delay_class    1 2                                  # Defines the class of pool for the Pool Number 1
delay_parametes    1 62500/62500 6250/6250 # This tells to create a cieling of 500K (62500) for our bandwidth having (1.5M) with a indivigual cieling of  #10% of the cieling (Any given time the users will be restricted to the 10% of the cieling bandwidth 500k)
delay_access  1  allow  bw_users        # This is the access tag which tie to the acl bw_users
----------
# reload squid

    Test the rate of bandwidth using wget. Here we can see that all the rate will be restricted to 10% of the cieling from the begning for all the src. This makes the rest of the bandwidth free for usage of other purpose i.e, Out of 1.5M we have taken a cieling of .5M for internel network and  we have told to squid that each request from src should get a 10% of .5M of bandwidth.
Note:-
 In the class1 pool the restriction of the bandwidth was started only after meeting the max size of download. But in class 2 instead of the max download size here we defined a ceiling and user is restricted to it from the beginning.
   
3. Class3 pool allows to restrict the bandwidth usage for subnets
    This will implement the bandwidth management with aggregate rate per subnets. i.e, the class2 pool with subnet-based ceiling

Configuring the class 3 pool
# vim squid.conf
----------
acl    bw_users    src    192.168.1.0/24 # The acl defined for the Network
delay_pools    1                                    # Number of Pool
delay_class    1 3                                 # Defines the class of pool for the Pool Number 1
delay_parametes    1 62500/62500 31250/31250 6250/6250 # This tells to create a cieling of 500K (62500) for our bandwidth having (1.5M) with a subnets cieling of 50% of the cieling (Any given time the request from the each subnets will be restricted to the 50% of the cieling bandwidth 500k and each users in subnet will have 20% of the bandwidth rate of subnet cieling)
delay_access  1  allow  bw_users       # This is the access tag which tie to the acl bw_users
----------
# reload squid

    This makes the squid to make the bandwidth usage 50% per subnet(Incase if we have 2 subnets in our network) and each user will get 20% of the subnet cieling. (i.e, out of 1.5M we have taken a cieling of .5M. the subnet cieling will share 50% of this .5M clieing(.25M). In each subnet the users will get 20%(.05M) of bandwidth of the subnet cieling (.25M)).
 
Delay Pool class2 with Time based ACL:
    This will implement the bandwidth management only during the business hours.

Configure the Class2 pool with time restriction
# vim squid.conf
----------
acl    bw_users src 192.168.1.0/24         # The acl defined for the Network
acl work_time time MTWHF 09:00-18:00
delay_pools    1                                      # Number of Pool
delay_class    1 2                                    # Defines the class of pool for the Pool Number 1
delay_parametes    1 62500/62500 25000/25000 # each user has given an average of 25000 bytes of bandwidth
delay_access  1  allow work_time         # This is the access tag which tie to the acl all and work_time.
----------
# reload squid

    This will make the class 2 pool to be activated only while the office hours. Test by changing the time in the squid servers after configuring the class 2 pool with time period.

Linux Securirty Notes 14: Squid notes 6: DNS Round Robin

Squid - Force proxy usage
    Here will explain how configure all the outbound traffic (to internet) to only route through proxy.
Step 1:
    We will disable all the outbound access to the internet from local network except the squid server in the firewall.
    And explicitly allow the squid server outbound traffic to port 80/443.
Step 2:
    Now configure the Proxy server. Setup the proxy variable in the client (Browser settings as well the http_proxy variable settings). And check the access.log file. This is the recommended setup so that all the outbound traffic from our network will be monitored and controlled using squid.

Squid Load balancing - Using DNS Round Robin:
    This configuration will make squid to run in a load-balance fashion. The DNS ROUND ROBIN will take care of routing request from source to all the squid servers configured with DNS Round Robin. Here the cache can be shared among the squid servers. This make the same cache access for all the requests on load balancing.

To obtain this we will configure two squid servers for our network
Network:          192.168.1.0/24
Squidserver1:    192.168.1.1
Squidserver2:    192.168.1.254

Step 1:
    Install squid on both the servers and configure both the servers with the same business rule. Start squid servers. Make sure that the squid is running on both the servers.
Step 2:
Configure the DNS for ROUND ROBIN:
    Here we will make entry of both the squid servers in DNS. Here we have to make a same "A" record pointing to different IP address of the two squid servers
Eg:    cache.domain.com    A    192.168.1.1
         cache.domain.com    A    192.168.1.254

        So when we make a query to the DNS server the DNS server will reply both the IPs, subsequent reply will alter the position of the A record. This means If the result for the first query for the FQDN returns "cache.domain.com    A 192.168.1.1". Then the subsequent query will yield the result of "cache.domain.com A 192.168.1.254". Thus the Load will be balanced equally to both of the servers.
Check the working of DNS ROUND ROBIN using
# dig cache.domain.com
&
# nslookup cache.domain.com


Step 3:
    Configure the browsers and the variables in the client for the squid server "cache.domain.com". and try to brows.
Note:-
        Keep in mind about the DNS cache used by client.

Friday, October 23, 2009

Linux Securirty Notes 14: Squid notes 5: ACL - Cache Management

Squid ACL Cache Management:
    Here we can will have a look in to the squid cache management. We can make squid to start caching only a certain number of websites, or u can turn off all the caching ability or even we can run with full caching ability of squid.

Setting up squid as a non-caching service:
    In this mode the squid will not cache any of the request. And will be running only for logging the access and honouring the ACLs defined according to the company rule.

Disable caching for request from all the source address
# vim squid.conf
------------
acl    noncaching_hosts    src 0.0.0.0/0.0.0.0
no_cache    deny    noncaching_hosts
------------
# reload squid

    no_cache tag is used to configure the caching management in ACL. Here with the deny option no_cache makes all the request from the given src address to run in non cache-mode. So monitor the access.log file for any "HITs" to verify. "HITS" are denoted for the caching sites and "MISS" for non caching sites. So from now itself we will get only the MISS in access.log.

Disable caching for specific sites in Internet/Intranet:
# vim squid.cond
---------
acl    no_cache_sites    dstdomain    .domain.com
no_cache    deny    no_cache_sites
---------
# reload squid

    This will make squid to disable caching only for the given domain. But all other domains will be cached. A number of domains can be defined to a file as well.

Disable caching for dynamic sites (sites which runs on .php/.asp/.pl/.cgi/.jsp etc)
       
# vim squid.conf
---------
acl    no_cache_dynamic_sites    url_regex    "/etc/squid/no_cache_sites"
no_cache    deny no_cache_dynamic sites
---------
# vim /etc/squid/no_cache_sites
---------
\.php$
\.cgi$
\.jsp
\.pl$
\.asp$
---------
# reload squid

    This will make squid to not cache the sites with has the expression listed in the file.

Caching based on the User access using IP address:
End result should be no cache activity for the request from Admins(192.168.100.0) and executive (192.168.200.3)But every one else should be cached.

# vim squid.conf
--------
acl no_cache_users    src    192.168.100.0/24    192.168.200.3
no_cache    deny    no_cache_users
--------

# reload squid

    Here all the request from the network 192.168.100.0/24 and IP address 192.168.200.3 will not be cached. But all other request will be cached.