Setting up an FTP proxy on Squid

Question

I haven't used squid in a while so I wouldn't be surprised if I am off on the configuration. But essentially, I am trying to set up a proxy server with Squid so that I can do this:

Client (my local PC) -> Squid proxy server -> FTP server (foo.bar.net)

I followed a few tutorials online and things seemed pretty straightforward. I have part of my configuration here:

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl ftp proto FTP
acl ftp_port port 21
acl SSL_ports port 443 21
acl Safe_ports port 20      # ftp port
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 280     # http-mgmt
acl CONNECT method CONNECT
acl ftp_port port 21
http_access allow ftp ftp_port
http_access allow ftp_port CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access deny all
http_port 3128
http_port 21
acl local-servers dstdomain foo.bar.net
always_direct allow local-servers
acl FTP proto FTP
always_direct allow FTP

When I reload the service, I see that it binds to the configured ports. But when I go on my local PC and use CyberDuck to connect, nothing is logged in squid's access_log. This does not give me a whole lot of confidence that this is configured correctly since it is not logging any kind of attempted access to the FTP server. Is there something I am doing wrong?

Answer 1

From the Squid Frequently Asked Questions:

Can I make my regular FTP clients use a Squid cache?

Nope, its not possible. Squid only accepts HTTP requests. It speaks FTP on the server-side, but not on the client-side.

The very cool wget will download FTP URLs via Squid (and probably any other proxy cache).

Although the word "proxy" is most often mentioned in context of HTTP, and many other protocols can be passed through a HTTP proxy that allows the use of the HTTP CONNECT method, a HTTP proxy is still not an "everything proxy".

For use with actual FTP clients like Cyberduck, you will need a dedicated FTP proxy, like one available in Debian's ftp-proxy package (if you want to protect/provide access to a limited number of FTP servers), or a SOCKS proxy (if your FTP client is SOCKS aware and you want the client to be able to connect to any FTP server in the world).

SSH can actually provide a SOCKS proxy, but the primary purpose of this is to tunnel the connection of the proxied application through the SSH connection.

First you must make a SSH connection with SOCKS proxying enabled, tell a SOCKS-aware client application to use localhost and a SOCKS port specified in the SSH client configuration as a SOCKS proxy, and then you can just use the application normally as long as the SSH connection is active. The connections of the client application will be tunneled from the SSH client to the SSH server, and from there to the destination specified by the application. From the viewpoint of the application server, the origination point of your connection will be the SSH server, not the host where the application (or the SSH client) actually is.

Answer 2

I have not configured squid before, so someone more versed will be able to help you.

In your .ssh/config, do you have a ProxyCommand line? I also recall at one point needing to have netcat installed.

My line in .ssh/config looked like this:

Host sftp.example.com
        ProxyCommand ssh [email protected] nc %h %p