VPS下ubuntu搭建代理服务器

来源：互联网发布：漩涡知乎编辑：程序博客网时间：2024/05/22 11:46

组成方式：squid3 + stunnel4

squid3：负责代理

stunnel4：负责加密传输

如果仅用squid，会出现 “连接被重置” 的提示。单独的stunnel是无法使用的,必须配合http代理,如squid

VPS Linux Ubuntu14.04 服务端安装：

$ sudo apt-get update$ sudo apt-get vim

$ sudo apt-get install squid3 stunnel4

squid默认代理端口号3128,可自行修改,默认此代理只能本地有权限访问（默认即可，无需更改）

$ grep --color '^http_port' /etc/squid3/squid.conf

stunnel的证书

$ sudo -s  $ cd /etc/stunnel

生成证书文件stunnel.pem，生成证书的过程中需要填写一些国家城市公司等信息,全部随便填写即可

$ openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem

下面的命令执行的时间叫长耐心等待

$ openssl gendh 2048 >> stunnel.pem

出现unable to write 'random state'错误的请执行

$ rm ~/.rnd

查看生成的证书相关信息

$ openssl x509 -subject -dates -fingerprint -in stunnel.pem

配置证书

$ cd /var/lib/stunnel4/  $ sudo mkdir certs  $ cp /etc/stunnel/stunnel.pem certs/`openssl x509 -hash -noout -in /etc/stunnel/stunnel.pem`.0.

stunnel配置

$ cat /etc/stunnel/README

拷贝默认的配置文件

$ sudo cp /usr/share/doc/stunnel4/examples/stunnel.conf-sample /etc/stunnel/stunnel.conf

修改配置文件 /etc/stunnel/stunnel.conf

去掉 chroot = /var/lib/stunnel4/ 的注释

开启调试模式，去掉 debug = 7 的注释，并在其下边添加 foreground = yes
设置证书路径，cert = /etc/stunnel/mail.pem修改成cert = /etc/stunnel/stunnel.pem

开启证书有效性验证，verify = 2去掉注释改成verify = 3

设置证书目录，CApath = /certs去掉注释，并改成 CApath = /var/lib/stunnel4/certs
CAfile = /etc/stunnel/certs.pem 去掉注释，并改成 CAfile = /etc/stunnel/stunnel.pem

配置stunnel的端口和squid的http代理

编辑/etc/stunnel/stunnel.conf,找到
; **************************************************************************
; * Service definitions (remove all services for inetd mode) *
; **************************************************************************
从这里一直文件结尾,全部删除,添加如下内容:

client = no[https]accept = 8990connect = 0.0.0.0:3128cert = /etc/stunnel/stunnel.pem

简单解释:client = no可以不要，stunnel默认工作在服务器模式。

[https]这个https是服务名称，可以随便写,。

accept部分，8990是stunnel监听端口,stunnel将使用这个代理,也就是127.0.0.1:8990.

connect部分是stunnel要连接到的代理服务器端口，也即是127.0.0.1：3128，3128是squid的默认端口

服务器端配置完毕，重新启动服务

$ sudo killall stunnel4  $ sudo /etc/init.d/stunnel4 start

出现如下表示成功

Starting SSL tunnels: 2017.11.06 08:55:43 LOG7[23133:140344155465536]: Clients allowed=5002017.11.06 08:55:43 LOG5[23133:140344155465536]: stunnel 4.53 on x86_64-pc-linux-gnu platform2017.11.06 08:55:43 LOG5[23133:140344155465536]: Compiled with OpenSSL 1.0.1e 11 Feb 20132017.11.06 08:55:43 LOG5[23133:140344155465536]: Running  with OpenSSL 1.0.1f 6 Jan 20142017.11.06 08:55:43 LOG5[23133:140344155465536]: Update OpenSSL shared libraries or rebuild stunnel2017.11.06 08:55:43 LOG5[23133:140344155465536]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv62017.11.06 08:55:43 LOG5[23133:140344155465536]: Reading configuration from file /etc/stunnel/stunnel.conf2017.11.06 08:55:43 LOG7[23133:140344155465536]: Compression not enabled2017.11.06 08:55:43 LOG7[23133:140344155465536]: Snagged 64 random bytes from /root/.rnd2017.11.06 08:55:43 LOG7[23133:140344155465536]: Wrote 1024 new random bytes to /root/.rnd2017.11.06 08:55:43 LOG7[23133:140344155465536]: PRNG seeded successfully2017.11.06 08:55:43 LOG6[23133:140344155465536]: Initializing service section [https]2017.11.06 08:55:43 LOG4[23133:140344155465536]: Insecure file permissions on /etc/stunnel/stunnel.pem2017.11.06 08:55:43 LOG7[23133:140344155465536]: Certificate: /etc/stunnel/stunnel.pem2017.11.06 08:55:43 LOG7[23133:140344155465536]: Certificate loaded2017.11.06 08:55:43 LOG7[23133:140344155465536]: Key file: /etc/stunnel/stunnel.pem2017.11.06 08:55:43 LOG7[23133:140344155465536]: Private key loaded2017.11.06 08:55:43 LOG7[23133:140344155465536]: Loaded verify certificates from /etc/stunnel/stunnel.pem2017.11.06 08:55:43 LOG7[23133:140344155465536]: Loaded /etc/stunnel/stunnel.pem revocation lookup file2017.11.06 08:55:43 LOG7[23133:140344155465536]: Verify directory set to /var/lib/stunnel4/certs2017.11.06 08:55:43 LOG7[23133:140344155465536]: Added /var/lib/stunnel4/certs revocation lookup directory2017.11.06 08:55:43 LOG6[23133:140344155465536]: Peer certificate location /var/lib/stunnel4/certs2017.11.06 08:55:43 LOG7[23133:140344155465536]: Using DH parameters from /etc/stunnel/stunnel.pem2017.11.06 08:55:43 LOG7[23133:140344155465536]: DH initialized with 2048-bit key2017.11.06 08:55:43 LOG7[23133:140344155465536]: ECDH initialized with curve prime256v12017.11.06 08:55:43 LOG7[23133:140344155465536]: SSL options set: 0x010000042017.11.06 08:55:43 LOG5[23133:140344155465536]: Configuration successful2017.11.06 08:55:43 LOG7[23133:140344155465536]: Service [https] (FD=12) bound to 0.0.0.0:89902017.11.06 08:55:43 LOG7[23133:140344155465536]: Created pid file /stunnel4.pid

客户端配置，以ubuntu14.04为例

安装 stunnel

$ sudo apt-get install stunnel4

添加默认配置文件

$ sudo cp /usr/share/doc/stunnel4/examples/stunnel.conf-sample /etc/stunnel/stunnel.conf

开启stunnel调试模式,参考上面stunnel服务器端配置

配置证书
把上面stunnel服务器端生成的证书,复制一份到本地

$ scp 你的用户名@服务器地址:/etc/stunnel/stunnel.pem /etc/stunnel/stunnel.pem

编辑本地/etc/stunnel/stunnel.conf

设置证书路径，cert = /etc/stunnel/mail.pem修改成:cert = /etc/stunnel/stunnel.pem

找到; **************************************************************************
; * Service definitions (remove all services for inetd mode) *
; **************************************************************************
一直到文件结尾全部删除,添加如下内容:

client = yes[https]accept = 127.0.0.1:8080cert = /etc/stunnel/stunnel.pemconnect = 108.61.218.216:8990

简单解释:

client = yes表示stunnel是运行的是客户端模式,默认没有代表服务器模式

accept = 127.0.0.1:8080当然就是浏览器需要设置的http代理端口了
connect = stunnel要连接到的服务器地址，参考上面服务器端配置

重启stunnel客户端:

$ sudo killall stunnel4  $ sudo /etc/init.d/stunnel4 start

出现如下表示成功：

Starting SSL tunnels: 2017.11.06 15:24:03 LOG7[15481:140718428088128]: Clients allowed=5002017.11.06 15:24:03 LOG5[15481:140718428088128]: stunnel 4.53 on x86_64-pc-linux-gnu platform2017.11.06 15:24:03 LOG5[15481:140718428088128]: Compiled with OpenSSL 1.0.1e 11 Feb 20132017.11.06 15:24:03 LOG5[15481:140718428088128]: Running  with OpenSSL 1.0.1f 6 Jan 20142017.11.06 15:24:03 LOG5[15481:140718428088128]: Update OpenSSL shared libraries or rebuild stunnel2017.11.06 15:24:03 LOG5[15481:140718428088128]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv62017.11.06 15:24:03 LOG5[15481:140718428088128]: Reading configuration from file /etc/stunnel/stunnel.conf2017.11.06 15:24:03 LOG7[15481:140718428088128]: Compression not enabled2017.11.06 15:24:03 LOG7[15481:140718428088128]: PRNG seeded successfully2017.11.06 15:24:03 LOG6[15481:140718428088128]: Initializing service section [https]2017.11.06 15:24:03 LOG4[15481:140718428088128]: Insecure file permissions on /etc/stunnel/stunnel.pem2017.11.06 15:24:03 LOG7[15481:140718428088128]: Certificate: /etc/stunnel/stunnel.pem2017.11.06 15:24:03 LOG7[15481:140718428088128]: Certificate loaded2017.11.06 15:24:03 LOG7[15481:140718428088128]: Key file: /etc/stunnel/stunnel.pem2017.11.06 15:24:03 LOG7[15481:140718428088128]: Private key loaded2017.11.06 15:24:03 LOG7[15481:140718428088128]: SSL options set: 0x010000042017.11.06 15:24:03 LOG5[15481:140718428088128]: Configuration successful2017.11.06 15:24:03 LOG7[15481:140718428088128]: Service [https] (FD=12) bound to 127.0.0.1:80802017.11.06 15:24:03 LOG7[15481:140718428088128]: Created pid file /stunnel4.pid^C2017.11.06 15:26:51 LOG7[15481:140718428088128]: Dispatching signals from the signal pipe2017.11.06 15:26:51 LOG7[15481:140718428088128]: Processing SIGCHLD2017.11.06 15:26:51 LOG6[15481:140718428088128]: Child process 15482 terminated on signal 22017.11.06 15:26:51 LOG6[15481:140718428088128]: Child process 15483 terminated on signal 22017.11.06 15:26:51 LOG6[15481:140718428088128]: Child process 15484 terminated on signal 22017.11.06 15:26:51 LOG6[15481:140718428088128]: Child process 15485 terminated on signal 22017.11.06 15:26:51 LOG6[15481:140718428088128]: Child process 15486 terminated on signal 22017.11.06 15:26:51 LOG3[15481:140718428088128]: Received signal 2; terminating2017.11.06 15:26:51 LOG7[15481:140718428088128]: Service [https] closed (FD=12)2017.11.06 15:26:51 LOG7[15481:140718428088128]: str_stats: 12 block(s), 1061 data byte(s), 696 control byte(s)2017.11.06 15:26:51 LOG7[15481:140718428088128]: removing pid file /stunnel4.pid

假如所有一切运行正常,然后可以关闭调试模式.注释 foreground = yes 一行

代理测试，Ubuntu上很简单

$ export http_proxy='127.0.0.1:8080'  $ wget www.bing.com

参考：vps的ubuntu linux下轻松搭建stunnel通过https代理上外网

How To Set Up an SSL Tunnel Using Stunnel on Ubuntu

阅读全文

0 0

漩涡知乎

原创粉丝点击

热门问题 老师的惩罚人脸识别我在镇武司摸鱼那些年重生之率土为王我在大康的咸鱼生活盘龙之生命进化天生仙种凡人之先天五行春回大明朝姑娘不必设防，我是瞎子透水混凝土多少钱一方打混凝土多少钱一方混泥土价格加气混泥土砌块砖透水混泥土价格混泥土预制板砼路面混泥土设备钢筋砼是什么彩色混泥土价格混泥土纤维价格什么是混泥土砼搅拌站水泥路面钢筋砼混泥土构件清水混泥土混泥土速凝剂混动车混动车需要充电吗混动车上绿牌混动车可以上绿牌吗 2018年混动车上蓝牌还是绿牌二手混动车混合云混合制混合器通道混合器蒸汽混合加热器比例混合器混合器图片涡旋混合器油水混合器漩涡混合器价格化工搅拌器多管漩涡混合器漩涡混合器生产厂家汽水混合器原理蛋糕搅拌器锥形搅拌机混合痔内扎外剥术