-
Notifications
You must be signed in to change notification settings - Fork 25
/
Copy pathindex.html
226 lines (187 loc) · 18.2 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
<!DOCTYPE html>
<html>
<head>
<meta charset='utf-8'>
<meta http-equiv="X-UA-Compatible" content="chrome=1">
<meta name="description" content="Tinyproxy : lightweight http(s) proxy daemon">
<link rel="stylesheet" type="text/css" media="screen" href="stylesheets/stylesheet.css">
<title>Tinyproxy</title>
</head>
<body>
<!-- HEADER -->
<div id="header_wrap" class="outer">
<header class="inner">
<a id="forkme_banner" href="https://github.com/tinyproxy">View on GitHub</a>
<h1 id="project_title">Tinyproxy</h1>
<h2 id="project_tagline">lightweight http(s) proxy daemon</h2>
</header>
</div>
<!-- MAIN CONTENT -->
<div id="main_content_wrap" class="outer">
<section id="main_content" class="inner">
<h1>
<a id="tinyproxy" class="anchor" href="#tinyproxy" aria-hidden="true"><span class="octicon octicon-link"></span></a>Tinyproxy</h1>
<p>Tinyproxy is a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems. Designed from the ground up to be fast and yet small, it is an ideal solution for use cases such as embedded deployments where a full featured HTTP proxy is required, but the system resources for a larger proxy are unavailable.</p>
<p>Tinyproxy is distributed using the GNU GPL license (version 2 or above).</p>
<h2>
<a id="features" class="anchor" href="#features" aria-hidden="true"><span class="octicon octicon-link"></span></a>Features</h2>
<p>Tinyproxy has a <strong>small footprint</strong> and requires very little in the way of system resources. The memory footprint tends to be around 2 MB with glibc, and the CPU load increases linearly with the number of simultaneous connections (depending on the speed of the connection). Thus, Tinyproxy can be run on an older machine, or on a network appliance such as a Linux-based broadband router, without any noticeable impact on performance.</p>
<p>Tinyproxy requires only a <strong>minimal POSIX environment</strong> to build and operate. It can use additional libraries to add functionality though.</p>
<p>Tinyproxy allows forwarding of <strong>HTTPS connections</strong> without modifying traffic in any way through the <code>CONNECT</code> method (see the <code>ConnectPort</code> directive).</p>
<p>Tinyproxy supports being configured as a <strong>transparent proxy</strong>, so that a proxy can be used without requiring any client-side configuration. You can also use it as a <strong>reverse proxy</strong> front-end to your websites.</p>
<p>Using the <code>AddHeader</code> directive, you can <strong>add/insert HTTP headers</strong> to outgoing traffic.</p>
<p>If you're looking to build a custom web proxy, Tinyproxy is <strong>easy to modify</strong> to your custom needs. The source is straightforward, adhering to the KISS principle. As such, it can be used as a foundation for anything you may need a web proxy to do.</p>
<p>Tinyproxy has <strong>privacy features</strong> which can let you configure which HTTP headers should be allowed through, and which should be blocked. This allows you to restrict both what data comes to your web browser from the HTTP server (e.g., cookies), and to restrict what data is allowed through from your web browser to the HTTP server (e.g., version information).</p>
<p>Using the <strong>remote monitoring</strong> facility, you can access proxy statistics from afar, letting you know exactly how busy the proxy is.</p>
<p>You can configure Tinyproxy to <strong>control access</strong> by only allowing requests from a certain subnet, or from a certain interface, thus ensuring that random, unauthorized people will not be using your proxy.</p>
<p>With a bit of configuration (specifically, making Tinyproxy created files owned by a non-root user and running it on a port greater than 1024), Tinyproxy can be made to run without any special privileges, thus minimizing the chance of system compromise. Furthermore, it was designed with an eye towards preventing buffer overflows. The simplicity of the code ensures it remains easy to spot such bugs.</p>
<h2>
<a id="downloads" class="anchor" href="#downloads" aria-hidden="true"><span class="octicon octicon-link"></span></a>Downloads</h2>
<ul>
<li>On Red Hat Enterprise Linux, or its derivatives such as CentOS, install Tinyproxy from the EPEL repository by running <code>yum install tinyproxy</code>.</li>
<li>On Fedora, install Tinyproxy by running <code>yum install tinyproxy</code>.</li>
<li>On Debian and derived distributions, run <code>apt-get install tinyproxy</code> to install Tinyproxy.</li>
<li>For openSUSE run: <code>zypper in tinyproxy</code></li>
<li>Arch users can install the Tinyproxy package from the community repository. Run <code>pacman -S tinyproxy</code> to install it.</li>
<li>FreeBSD, OpenBSD or NetBSD users can use the <code>pkg_add</code> utility to install the tinyproxy package.</li>
<li>Mac OS X users can use <a href="https://brew.sh/">Homebrew</a>: <code>brew install tinyproxy</code>.</li>
</ul>
<p>If you feel that the Tinyproxy binary package in your operating system is not recent, please contact the package maintainer for that particular operating system. If this fails, you can always compile the latest stable version from source code.</p>
<p>We distribute Tinyproxy in source code form, and it has to be compiled in order to be used on your system. Please see the INSTALL file in the source code tree for build instructions. The current stable version of Tinyproxy is available as tinyproxy-1.8.4.tar.bz2. It was released on January 1, 2016. The Tinyproxy 1.8.4 NEWS file contains the release notes. You can verify the tarball using its PGP signature. You can also browse the older releases of Tinyproxy.</p>
<p>We use Git as the version control system for the Tinyproxy source code repository. To get a copy of the Tinyproxy repository, use the command:</p>
<p>git clone <a href="https://github.com/tinyproxy/tinyproxy.git">https://github.com/tinyproxy/tinyproxy.git</a></p>
<h2>
<a id="documentation" class="anchor" href="#documentation" aria-hidden="true"><span class="octicon octicon-link"></span></a>Documentation</h2>
<h4>Name</h4>
tinyproxy.conf - Tinyproxy HTTP proxy daemon configuration file
<h4>Description</h4>
<p>tinyproxy(8) reads its configuration file, typically stored in /etc/tinyproxy/tinyproxy.conf (or passed to Tinyproxy with -c on the command line). This manpage describes the syntax and contents of the configuration file.
The Tinyproxy configuration file contains key-value pairs, one per line. Lines starting with # and empty lines are comments and are ignored. Keywords are case-insensitive, whereas values are case-sensitive. Values may be enclosed in double-quotes (") if they contain spaces.
The possible keywords and their descriptions are as follows:</p>
<ul>
<li><b>User</b><br />
The user which the Tinyproxy process should run as, after the initial port-binding has been done as the root user. Either the user name or the UID may be specified.</li>
<li><b>Group</b><br />
The group which the Tinyproxy process should run as, after the initial port-binding has been done as the root user. Either the group name or the GID may be specified.</li>
<li><b>Port</b><br />
The port which the Tinyproxy service will listen on. If the port is less than 1024, you will need to start the Tinyproxy process as the root user.</li>
<li><b>Listen</b><br />
By default, Tinyproxy listens for connections on all available interfaces (i.e. it listens on the wildcard address 0.0.0.0). With this configuration parameter, Tinyproxy can be told to listen only on one specific address.</pi>
<li><b>Bind</b><br />
This allows you to specify which address Tinyproxy will bind to for outgoing connections to web servers or upstream proxies.</li>
<li><b>BindSame</b><br />
If this boolean parameter is set to yes, then Tinyproxy will bind the outgoing connection to the IP address of the incoming connection that triggered the outgoing request.</li>
<li><b>Timeout</b><br />
The maximum number of seconds of inactivity a connection is allowed to have before it is closed by Tinyproxy.<br />
<li><b>ErrorFile</b><br />
This parameter controls which HTML file Tinyproxy returns when a given HTTP error occurs. It takes two arguments, the error number and the location of the HTML error file.</li>
<li><b>DefaultErrorFile</b><br />
This parameter controls the HTML template file returned when an error occurs for which no specific error file has been set.</li>
<li><b>StatHost</b><br />
This configures the host name or IP address that is treated as the stat host: Whenever a request for this host is received, Tinyproxy will return an internal statistics page instead of forwarding the request to that host. The template for this page can be configured with the StatFile configuration option. The default value of StatHost is tinyproxy.stats.</li>
<li><b>StatFile</b><br />
This configures the HTML file that Tinyproxy sends when a request for the stathost is received. If this parameter is not set, Tinyproxy returns a hard-coded basic statistics page. See the STATHOST section in the tinyproxy(8) manual page for details.
Note that the StatFile and the error files configured with ErrorFile and DefaultErrorFile are template files that can contain a few template variables that Tinyproxy expands prior to delivery. Examples are "{cause}" for an abbreviated error description and "{detail}" for a detailed error message. The tinyproxy(8) manual page contains a description of all template variables.</li>
<li><b>LogFile</b><br />
This controls the location of the file to which Tinyproxy writes its debug output. Alternatively, Tinyproxy can log to syslog - see the Syslog option.</li>
<li><b>Syslog</b><br />
When set to On, this option tells Tinyproxy to write its debug messages to syslog instead of to a log file configured with LogFile. These two options are mutually exclusive.</li>
<li><b>LogLevel</b><br />
Sets the log level. Messages from the set level and above are logged. For example, if the LogLevel was set to Warning, then all log messages from Warning to Critical would be output, but Notice and below would be suppressed. Allowed values are:
<ul>
<li>Critical (least verbose)</li>
<li>Error</li>
<li>Warning</li>
<li>Notice</li>
<li>Connect (log connections without Info's noise)</li>
<li>Info (most verbose)</li>
</ul></li>
<li><b>PidFile</b><br />
This option controls the location of the file where the main Tinyproxy process stores its process ID for signaling purposes.</li>
<li><b>XTinyproxy</b><br />
Setting this option to Yes tells Tinyproxy to add a header X-Tinyproxy containing the client's IP address to the request.</li>
<li><b>Upstream, No Upstream</b><br />
This option allows you to set up a set of rules for deciding whether an upstream proxy server is to be used, based on the host or domain of the site being accessed. The rules are stored in the order encountered in the configuration file and the LAST matching rule wins. There are three possible forms for specifying upstream rules:
<ul>
<li>upstream host:port turns proxy upstream support on generally.</li>
<li>upstream host:port "site_spec" turns on the upstream proxy for the sites matching site_spec.</li>
<li>no upstream "site_spec" turns off upstream support for sites matching site_spec.</li></ul>
The site can be specified in various forms as a hostname, domain
name or as an IP range:
<ul>
<li>name matches host exactly</li>
<li>.name matches any host in domain "name"</li>
<li>. matches any host with no domain (in empty domain)</li>
<li>IP/bits matches network/mask</li>
<li>IP/mask matches network/mask</li>
</ul>
</li>
<li><b>MaxClients</b><br />
Tinyproxy creates one child process for each connected client. This options specifies the absolute highest number processes that will be created. With other words, only MaxClients clients can be connected to Tinyproxy simultaneously.</li>
<li><b>MinSpareServers, MaxSpareServers</b><br />
Tinyproxy always keeps a certain number of idle child processes so that it can handle new incoming client requests quickly. MinSpareServer and MaxSpareServers control the lower and upper limits for the number of spare processes. I.e. when the number of spare servers drops below MinSpareServers then Tinyproxy will start forking new spare processes in the background and when the number of spare processes exceeds MaxSpareServers then Tinyproxy will kill off extra processes.</li>
<li><b>StartServers</b><br />
The number of servers to start initially. This should usually be set to a value between MinSpareServers and MaxSpareServers.</li>
<li><b>MaxRequestsPerChild</b><br />
This limits the number of connections that a child process will handle before it is killed. The default value is 0 which disables this feature. This option is meant as an emergency measure in the case of problems with memory leakage. In that case, setting MaxRequestsPerChild to a value of e.g. 1000, or 10000 can be useful.</li>
<li><b>Allow, Deny</b><br />
The Allow and Deny options provide a means to customize which clients are allowed to access Tinyproxy. Allow and Deny lines can be specified multiple times to build the access control list for Tinyproxy. The order in the config file is important. If there are no Allow or Deny lines, then all clients are allowed. Otherwise, the default action is to deny access. The argument to Allow or Deny can be a single IP address of a client host, like 127.0.0.1, an IP address range, like 192.168.0.1/24 or a string that will be matched against the end of the client host name, i.e, this can be a full host name like host.example.com or a domain name like .example.com or even a top level domain name like .com.</li>
<li><b>AddHeader</b><br />
Configure one or more HTTP request headers to be added to outgoing HTTP requests that Tinyproxy makes. Note that this option will not work for HTTPS traffic, as Tinyproxy has no control over what headers are exchanged.
<pre>
AddHeader "X-My-Header" "Powered by Tinyproxy"</li>
</pre>
<li><b>ViaProxyName</b><br />
RFC 2616 requires proxies to add a Via header to the HTTP requests, but using the real host name can be a security concern. If the ViaProxyname option is present, then its string value will be used as the host name in the Via header. Otherwise, the server's host name will be used.</li>
<li><b>DisableViaHeader</b><br />
When this is set to yes, Tinyproxy does NOT add the Via header to the requests. This virtually puts Tinyproxy into stealth mode. Note that RFC 2616 requires proxies to set the Via header, so by enabling this option, you break compliance. Don't disable the Via header unless you know what you are doing...</li>
<li><b>Filter</b><br />
Tinyproxy supports filtering of web sites based on URLs or domains. This option specifies the location of the file containing the filter rules, one rule per line.</li>
<li><b>FilterURLs</b><br />
If this boolean option is set to Yes or On, filtering is performed for URLs rather than for domains. The default is to filter based on domains.</li>
<li><b>FilterExtended</b><br />
If this boolean option is set to Yes, then extended POSIX regular expressions are used for matching the filter rules. The default is to use basic POSIX regular expressions.</li>
<li><b>FilterCaseSensitive</b><br />
If this boolean option is set to Yes, then the filter rules are matched in a case sensitive manner. The default is to match case-insensitively.</li>
<li><b>FilterDefaultDeny</b><br />
The default filtering policy is to allow everything that is not matched by a filtering rule. Setting FilterDefaultDeny to Yes changes the policy do deny everything but the domains or URLs matched by the filtering rules.</li>
<li><b>Anonymous</b><br />
If an Anonymous keyword is present, then anonymous proxying is enabled. The headers listed with Anonymous are allowed through, while all others are denied. If no Anonymous keyword is present, then all headers are allowed through. You must include quotes around the headers.<br />
Most sites require cookies to be enabled for them to work correctly, so you will need to allow cookies through if you access those sites.<br />
Example:<br />
<pre>
Anonymous "Host"
Anonymous "Authorization"
Anonymous "Cookie"</li>
</pre>
<li><b>ConnectPort</b><br />
This option can be used to specify the ports allowed for the CONNECT method. If no ConnectPort line is found, then all ports are allowed. To disable CONNECT altogether, include a single ConnectPort line with a value of 0.</li>
<li><b>ReversePath</b><br />
Configure one or more ReversePath directives to enable reverse proxy support. With reverse proxying it's possible to make a number of sites appear as if they were part of a single site.<br />
If you uncomment the following two directives and run Tinyproxy on your own computer at port 8888, you can access example.com, using http://localhost:8888/example/.<br />
<pre>
ReversePath "/example/" "http://www.example.com/"</li>
</pre>
<li><b>ReverseOnly</b><br />
When using Tinyproxy as a reverse proxy, it is STRONGLY recommended that the normal proxy is turned off by setting this boolean option to Yes.</li>
<li><b>ReverseMagic</b><br />
Setting this option to Yes, makes Tinyproxy use a cookie to track reverse proxy mappings. If you need to reverse proxy sites which have absolute links you must use this option.</li>
<li><b>ReverseBaseURL</b><br />
The URL that is used to access this reverse proxy. The URL is used to rewrite HTTP redirects so that they won't escape the proxy. If you have a chain of reverse proxies, you'll need to put the outermost URL here (the address which the end user types into his/her browser). If this option is not set then no rewriting of redirects occurs.</li>
</ul>
<h2>
<a id="support" class="anchor" href="#support" aria-hidden="true"><span class="octicon octicon-link"></span></a>Support</h2>
<ul>
<li>Feel free to report a new bug or suggest features via github issues.</li>
<li>Tinyproxy developers hang out in #tinyproxy on irc.freenode.net.</li>
</ul>
</section>
</div>
<!-- FOOTER -->
<div id="footer_wrap" class="outer">
<footer class="inner">
<p>Published with <a href="https://pages.github.com">GitHub Pages</a></p>
</footer>
</div>
</body>
</html>