squid.sh

#!/bin/bash

apt update -y && apt upgrade -y
apt install -y curl tar

apt install -y build-essential \
  autoconf \
  automake \
  make \
  libtool \
  libtool-bin \
  pkg-config \
  libssl-dev \
  libcppunit-dev \
  libkrb5-dev \
  libsasl2-dev \
  libxml2-dev \
  libcap-dev \
  g++ \
  perl

apt install -y init-system-helpers \
  adduser \
  libc6 \
  libcap2 \
  libcom-err2 \
  libcrypt1 \
  libecap3 \
  libecap3-dev \
  libexpat1 \
  libgcc-s1 \
  libgnutls30t64 \
  libgssapi-krb5-2 \
  libkrb5-3 \
  libldap2 \
  libltdl7 \
  libnetfilter-conntrack3 \
  libnettle8t64 \
  libpam0g \
  libsasl2-2 \
  libstdc++6 \
  libsystemd0 \
  libsystemd-dev \
  libtdb1 \
  libxml2 \
  netbase \
  logrotate \
  squid-common \
  lsb-base \
  sysvinit-utils \
  libdbi-perl \
  ssl-cert \
  libcap2-bin \
  ca-certificates \
  squidclient \
  squid-cgi \
  squid-purge \
  smbclient \
  ufw \
  winbind \
  apparmor

apt-get install -y clamav-daemon \
  libicapapi-dev \
  apache2

#Change urls based on version
curl -o squid.tar.gz https://codeload.github.com/squid-cache/squid/tar.gz/refs/tags/SQUID_7_0_2
curl -o c-icap.tar.gz https://codeload.github.com/c-icap/c-icap-server/tar.gz/refs/tags/C_ICAP_0.6.4
curl -o c-icap-modules.tar.gz https://codeload.github.com/c-icap/c-icap-modules/tar.gz/refs/tags/C_ICAP_MODULES_0.5.7
curl -o squidclamav.tar.gz https://codeload.github.com/darold/squidclamav/tar.gz/refs/tags/v7.4

rm -rf ./squid
rm -rf ./c-icap
rm -rf ./c-icap-modules
rm -rf ./squidclamav

mkdir ./squid && tar xvf squid.tar.gz -C ./squid --strip-components 1
mkdir ./squidclamav && tar xvf squidclamav.tar.gz -C ./squidclamav --strip-components 1
mkdir ./c-icap && tar xvf c-icap.tar.gz -C ./c-icap --strip-components 1
mkdir ./c-icap-modules && tar xvf c-icap-modules.tar.gz -C ./c-icap-modules --strip-components 1

cd ./c-icap
autoreconf -ifv .
./configure --prefix=/usr/local/c-icap
make
make install
cd ..

cd ./c-icap-modules
autoreconf -ifv .
./configure --with-c-icap=/usr/local/c-icap --prefix=/usr/local/c-icap
make
make install
cd ..

cd ./squidclamav
./configure --with-c-icap=/usr/local/c-icap/
make -j 2
make install
cd ..

cd ./squid
./bootstrap.sh
./configure --prefix=/usr \
  --localstatedir=/var \
  --libexecdir=/usr/lib/squid \
  --datadir=/usr/share/squid \
  --sysconfdir=/etc/squid \
  --with-default-user=proxy \
  --with-logdir=/var/log/squid \
  --with-pidfile=/run/squid.pid \
  --enable-ssl \
  --enable-ssl-crtd \
  --enable-security-file-certgen \
  --enable-icap-client \
  --enable-ecap \
  --enable-http-violations \
  --with-openssl \
  --enable-linux-netfilter \
  --enable-icmp \
  --enable-storeio=ufs,aufs,diskd,rock \
  --build=x86_64-linux-gnu \
  --includedir=${prefix}/include \
  --mandir=${prefix}/share/man \
  --infodir=${prefix}/share/info \
  --disable-arch-native \
  --enable-eui \
  --enable-esi \
  --runstatedir=/run \
  --with-systemd \
  --enable-follow-x-forwarded-for \
  BUILDCXX=g++

make
make install

chmod 4755 /usr/lib/squid/pinger
chown -R proxy:proxy /var/log/squid

mkdir -p /var/spool/squid
chown proxy:proxy /var/spool/squid
chown -R proxy:proxy /var/log/squid

mkdir -p /etc/squid/conf.d
touch /etc/squid/conf.d/debian.conf

mkdir -p /etc/squid/cert/
chown proxy:proxy /etc/squid/cert
openssl req -new -newkey rsa:4096 -sha256 -days 365 -nodes -x509 \
  -keyout /etc/squid/cert/squidCA.pem \
  -out /etc/squid/cert/squidCA.pem \
  -subj "/C=IL/ST=IL/L=Home/O=Home/OU=Home"
chmod 0400 /etc/squid/cert/squidCA.pem
mkdir -p /usr/local/share/ca-certificates
openssl x509 -inform PEM -in /etc/squid/cert/squidCA.pem -out /usr/local/share/ca-certificates/squidCA.crt
update-ca-certificates

/usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
chown -R proxy:proxy /var/spool/squid

##### squid conf settings
sed -i 's/\/var\/cache\/squid/\/var\/spool\/squid/g' /etc/squid/squid.conf
sed -i '/cache_dir/s/^#//g' /etc/squid/squid.conf

echo "" >>/etc/squid/squid.conf
echo "include /etc/squid/conf.d/*.conf" >>/etc/squid/squid.conf

sed -i 's/http_port 3128$/http_port 3128 ssl-bump cert=\/etc\/squid\/cert\/squidCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB/g' /etc/squid/squid.conf
sed -i 's/http_access deny all$//' /etc/squid/squid.conf
sed -i '/http_port 3128/assl_bump bump all' /etc/squid/squid.conf
sed -i '/http_port 3128/assl_bump peek step1' /etc/squid/squid.conf
sed -i '/http_port 3128/aacl step1 at_step SslBump1' /etc/squid/squid.conf

sed -i '/http_port 3128/asslcrtd_program \/usr\/lib\/squid\/security_file_certgen -s \/var\/spool\/squid\/ssl_db -M 4MB' /etc/squid/squid.conf
sed -i '/http_port 3128/asslcrtd_children 4 startup=2 idle=2' /etc/squid/squid.conf

sed -i '/ssl_bump bump all/aicap_preview_size 1024' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aicap_preview_enable on' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aicap_service_failure_limit -1' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aadaptation_access service_avi_req allow all' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aadaptation_access service_avi_resp allow all' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aicap_service service_avi_req reqmod_precache icap:\/\/localhost:1344\/squidclam bypass=on' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aicap_service service_avi_resp respmod_precache icap:\/\/localhost:1344\/squidclam bypass=off' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aicap_client_username_header X-Authenticated-User' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aadaptation_send_client_ip on' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aadaptation_send_username on' /etc/squid/squid.conf
sed -i '/ssl_bump bump all/aicap_enable on' /etc/squid/squid.conf
##### squid conf settings

cd ..

sed -i 's/MaxMemObject 131072/MaxMemObject 1048576/' /usr/local/c-icap/etc/c-icap.conf
sed -i 's/ServerName YourServerName/ServerName squid-icap/' /usr/local/c-icap/etc/c-icap.conf
sed -i 's/\/var\/run\/clamav\/clamd.ctl/\/run\/clamav\/clamd.ctl/' /usr/local/c-icap/etc/squidclamav.conf
sed -i 's/maxsize 5M/maxsize 5000000/' /usr/local/c-icap/etc/squidclamav.conf
sed -i 's/banmaxsize 2M//' /usr/local/c-icap/etc/squidclamav.conf
sed -i 's/enable_libarchive 0//' /usr/local/c-icap/etc/squidclamav.conf

cp ./usr.sbin.squid /etc/apparmor.d/
touch /etc/apparmor.d/local/usr.sbin.squid
apparmor_parser -r /etc/apparmor.d/usr.sbin.squid

cp ./squid-init /etc/init.d/squid
update-rc.d squid defaults

if id "c-icap" >/dev/null 2>&1; then
  echo 'user already exists'
else
  adduser c-icap --group --system --shell /usr/sbin/nologin
fi

cp ./squid.service /etc/systemd/system/
cp ./ssl-cert.service /etc/systemd/system/
cp ./c-icap.service /usr/lib/systemd/system/
systemctl daemon-reload

systemctl enable clamav-daemon
systemctl start clamav-daemon

systemctl enable c-icap
systemctl start c-icap

systemctl enable squid
systemctl start squid

echo ""
echo ""
echo ""
echo "CA cert: /etc/squid/cert/squidCA.pem "
echo ""
echo "squid working directories:"
echo "    /usr"
echo "    /var"
echo "    /usr/lib/squid"
echo "    /usr/share/squid"
echo "    /etc/squid"
echo "    /var/log/squid"
echo "    /run/squid.pid"
echo "    /usr/include"
echo "    /usr/share/man"
echo "    /share/info"
echo "c-icap working directories:"
echo "    /usr/loca/c-icap"