HAVP Teamwork with other Proxys e.g. squid
Teamwork with another proxy (e.g. squid):
HAVP is Parent Proxy:
Use Havp with squid to benefit of squid ACLs (filter only some files e.g. exe, bat …). You can use havp as parent cache for squid so cached request don’t have to be scanned again. But this dos not improve performance all the time! Only if squid has the file already in cache it will be faster. Otherwise performance can drop because the file has to pass havp and squid. You should use a fast CPU if you use both.The disadvantage is that infected cached is no longer scanned by Havp.
You can create ACL lists with squid to control which traffic is scanned by squid. Please refer to the squid homepage to figure out the nice features of squid.
This is an easy configuration to use havp as parent cache. All traffic will scanned by havp.
/etc/squid/squid.conf
acl all src 0.0.0.0/0.0.0.0
cache_peer 127.0.0.1 parent 8000 0 no-query no-digest no-netdb-exchange default
cache_peer_access 127.0.0.1 allow all
#Only http traffic can be scanned
acl Scan_HTTP proto HTTP
never_direct allow Scan_HTTP
Squid is parent Proxy:
You can also use squid as parent proxy for squid. Please check put the default.hand change.:
//Parent Proxy (Name)
#define PARENTPROXY “192.168.1.1”
#define PARENTPORT 3128
Havp between Squid:
I got a mail Claer discussing havp between squid:
| > —–Original Message—– > From: Claer [mailto:claer@rax.homeunix.com] > Sent: Tuesday, August 23, 2005 4:51 PM > To: christian@hilgers.ag > Subject: HAVP and Squid > > Hello, > > I used to install Antivirus scanners (namely Trendmicro ISVW) with > Squid. > > When I saw the 2 solution you showed to install HAVP with Squid, it > remids me the same reflexion some time ago. > > Here is the solution I found to be the best : > > Users -> Squid -> AV -> Squid -> Web Server > > Explanations : > – If you build the configuration with Users -> AV -> Squid -> Web > Server, you will have problems to create statistics based > on Squid log > analysis. > you spotted that ACL based on IP cannot be used anymore. It means > also that control filter such as SquidGuard become unusable. > > – If you build the configuration with Users -> Squid -> AV -> Web > Server, you will have 2 problems. > * First, you will have a load problem. With this configuration, you > will have to maintain yourself all HTTP timeouts. You > cannot rely on > the system TCP timeout. (I got the problem on Solaris, default TCP > timeout is 7200 seconds. Wayyyy too much for Web traffic). Just > check Squid timeout options, it’s surprising the number of options > in this field. Havp has timeouts so you don’t need the TCP timeouts but I guess squid is more comfortable. > * Then, you’ll have the cache problem. If a user download a Passing the traffic twice throught squid cost more CPU but in most cases this is ok. Here is the Patch and the squid config file. sample-squid.conf
I got a email from Dirk Nehring. He told me that the squid patch is not needed. ################################################## # http_port 3128 # scanning through HAVP # Memory usage values # 4 GB store on disk # no store log # Passive FTP off # no X-Forwarded-For header # Speed up logging # no logfile entry stripping # Speed, speed, speed # don’t query neighbour at all # And now: define caching parameters # # XXX local networks acl SSL_ports port 443 # Do not scan the following domains # We do not want traffic to these sites: # # For sandwich configuration we have to disable the “Via” header or we # Do not cache requests from localhost, SSL-encrypted or dynamic content. # Do not forward parent requests from localhost (loop-prevention) or never_direct deny localhost Don’t forget (Disable Forwarding-Loop): header_access Via deny all * Mandatory locks: Use Loop-Devices instead of ramdisk: %post |