Install the Frontier Squid HTTP Caching Proxy¶
Frontier Squid is a distribution of the well-known squid HTTP caching proxy software that is optimized for use with applications on the Worldwide LHC Computing Grid (WLCG). It has many advantages over regular squid for common grid applications, especially Frontier and CVMFS. The OSG distribution of frontier-squid is a straight rebuild of the upstream frontier-squid package for the convenience of OSG users.
This document is intended for System Administrators who are installing
frontier-squid, the OSG distribution of the Frontier Squid software.
The applicable software versions for this document are OSG Version >= 3.4.0. The version of frontier-squid installed should be >= 3.5.24-3.1. When using an OSG Version < 3.4.0 and a frontier-squid version in the 2.7STABLE9 series, refer to the old upstream install documentation instead of the current links included below. There are some incompatibilities between the two versions, so if you are upgrading from a 2.7STABLE9 version to a 3.5 version, see the upstream documentation on upgrading.
Frontier Squid is Recommended¶
OSG recommends that all sites run a caching proxy for HTTP and HTTPS to help reduce bandwidth and improve throughput. To that end, Compute Element (CE) installations include Frontier Squid automatically. We encourage all sites to configure and use this service, as described below.
For large sites that expect heavy load on the proxy, it may be best to run the proxy on its own host. In that case, the Frontier Squid software still will be installed on the CE, but it need not be enabled. Instead, install your proxy service on the separate host and then configure the CE host to refer to the proxy on that host.
osg-configure configuration tool (version 1.0.45 and later)
warns users who have not added the proxy location to their CE
configuration. In the future, a proxy will be required and
osg-configure will fail if the proxy location is not set.
Before starting the installation process, consider the following points (consulting the Reference section below as needed):
- User IDs: If it does not exist already, the installation will create the
- Network ports: Frontier squid communicates on ports 3128 (TCP) and 3401 (UDP)
- Host choice: If you will be supporting the Frontier application at your site, review the upstream documentation to determine how to size your equipment.
As with all OSG software installations, there are some one-time (per host) steps to prepare in advance:
- Ensure the host has a supported operating system
- Obtain root access to the host
- Prepare the required Yum repositories
Installing Frontier Squid¶
To install Frontier Squid, make sure that your host is up to date before installing the required packages:
Clean yum cache:
[email protected] # yum clean all --enablerepo=*
[email protected] # yum update
This command will update all packages
Install Frontier Squid:
[email protected] # yum install frontier-squid
Configuring Frontier Squid¶
Configuring the Frontier Squid Service¶
To configure the Frontier Squid service itself:
- Follow the Configuration section of the upstream Frontier Squid documentation.
- Enable, start, and test the service (as described below).
- Enable WLCG monitoring as described in the upstream documentation on enabling monitoring and register the squid in OIM.
An important difference between the standard Squid software and
the Frontier Squid variant is that Frontier Squid changes are in
/etc/squid/customize.sh instead of
Configuring the OSG CE¶
To configure the OSG Compute Element (CE) to know about your Frontier Squid service:
On your CE host, edit
- Make sure that
enabledis set to
locationto the hostname and port of your Frontier Squid service (e.g.,
- Leave the other settings at
DEFAULTunless you have specific reasons to change them
- Make sure that
osg-configureto propagate the changes on your CE.
You may want to finish other CE configuration tasks before running
osg-configure. Just be sure to run it once before starting CE
Start the frontier-squid service and enable it to start at boot time. As a reminder, here are common service commands (all run as
|To...||On EL6, run the command...||On EL7, run the command...|
|Start a service||
|Stop a service||
|Enable a service to start on boot||
|Disable a service from starting on boot||
Validating Frontier Squid¶
As any user on another computer, do the following (where
yoursquid.your.domain is the fully qualified domain name of your
[email protected] $ export http_proxy=http://yoursquid.your.domain:3128 [email protected] $ wget -qdO/dev/null http://frontier.cern.ch 2>&1|grep X-Cache X-Cache: MISS from yoursquid.your.domain [email protected] $ wget -qdO/dev/null http://frontier.cern.ch 2>&1|grep X-Cache X-Cache: HIT from yoursquid.your.domain
If the grep doesn't print anything, try removing it from the pipeline to see if errors are obvious. If the second try says MISS again, something is probably wrong with the squid cache writes. Look at the squid access.log file to try to see what's wrong.
If your squid will be supporting the Frontier application, it is also good to do the test in the upstream documentation Testing the installation section.
The frontier-squid installation will create one user account unless it already exists.
||Reduced privilege user that the squid process runs under. Set the default gid of the "squid" user to be a group that is also called "squid".|
The package can instead use another user name of your choice if you create a configuration file before installation. Details are in the upstream documentation Preparation section.
|Service Name||Protocol||Port Number||Inbound||Outbound||Comment|
|Squid||tcp||3128||✓||✓||Also limited in squid ACLs. Both in and outbound must not be wide open to internet simultaneously|
|Squid monitor||udp||3401||✓||Also limited in squid ACLs. Should be limited to monitoring server addresses|
The addresses of the WLCG monitoring servers for use in firewalls are listed in the upstream documentation Enabling monitoring section.
Frontier Squid Log Files¶
Log file contents are explained in the upstream documentation Log file contents section.