I was having some squidguard problems too and tracked down a different issue than what I've seen in this thread.

I am attempting to run the shallalist rules and after a lot of troubleshooting I finally noticed in the squidguard log that it couldn't find blk_BL_politics

I noticed that there's a blk_BL_politcs (notice no i) but not one with the proper spelling.  So I just symlinked the proper spelling to the improper spelling and after that it seems to work fine.

Thanks to the package maintainer for providing this software.

I just got mine working. Here's a link to my post:

http://forum.pfsense.org/index.php/topic,10084.0.html

I just got mine working. Here's a link to my post:

http://forum.pfsense.org/index.php/topic,10084.0.html

Snort has some kind of problem that it uninstalls itself at reboot, I'm not sure if it's a problem with the package system or the snort package itself, one or the other has some sort of bug.

It will retain the configuration.

Sure, I doubt anyone here is going to turn away someone willing to contribute.  I suspect you'd get a lot of interest if you make a plug-in for Thunderbird as well.

@submicron:

Please read the rest of the thread before complaining about things not working.  The button issue has been addressed in this thread, it does work, just not the way that you are expecting.

The blacklist/whitelist count is currently broken and this has been reported to the developer as well.

Finally, please do some reading to understand what spamd is and isn't.  It doesn't feature a way to blacklist or whitelist by domain.  That's not its intent.  Blacklists and whitelists are IP addresses only.  It also isn't meant to be the end-all, be-all of spam filtering.  It's meant to help stem the tide of spam and cut down the most obvious stuff.  It should be used in conjunction with a virus scanner on your mail server (at the very least).

I did read and understand the entire thread, but since threads were aging and revision numbers weren't listed I was just making sure it hadn't been fixed and I was doing something wrong.  The whitelist button does /not/ work on my install, i understand that the page doesn't reload after the buttons are clicked- it's stated several times throughout the entire thread. I also understand how and what spamd does i was simply asking for an interface to the spamd.alloweddomains file, but since i'm not part of the bounty and this isn't the thread for that, forget about it.  The last question was about other peoples setups, i was simply curious if most were now running 3 boxes (PFsense  |  Clam/Razor | Mailserver). I thought I saw someone ask for configurations to be posted to help others out, and I figured that fell within the realm.  Here are my configs:

system.inc …

pfSense isn't gentoo.  Ricing it up isn't necessary or even a particularly good idea.

Thanks submicron!
Yes, I plan on testing the SpamD package. (we might have a site to try soon)

We like the feature set and configuration options of ASSP. (Email/Domain/Ip white list, Active Directory email validation of real email users. Not to mention the building/feeding, and whit listing of spam/not spam by users. But it also lacks some features) This is why I wanted to find out more of the history and where the old files could be. Wanted to try and see what i could do.

It is a shame that it was not maintained…IMO...it is a good product.

Maybe spamD has theses features and I just do not have my facts straight….will look more. (I do see IP white/black list)
Thanks again

You're correct, the zabbix agent package doesn't start.  I modified it for my own purposes and got it working, but zabbix is a piece of crap and I scrapped it shortly thereafter.  Zabbix doesn't monitor FreeBSD properly so the Zabbix client, even if you get it working, will suck with a whole mouthful of teeth.

@submicron:

Then follow the instructions that hoba provided.

I had another issue that a fan was broken and the device wouldn't restart because of this failing fan after placing the changed XML back, I directly moved my other backup FW into the vlan and had everything working in seconds… the same day I fixed it as I did before by removing the part from the XML as mentioned :)

Thanks !

Then I do not understand the question.  :P  My translator frightened.

Read the forum thread on the subject, several people have already discussed their setup.

@jan:

Hi Guys,

I've installed Squid and LightSquid respectively, I've also tried installing squidguard but don't have to luck to make it work, just used OpenDNS instead ;D  anyways back to the real issue, LightSquid seems to be acting quite odd. Although there are reports on the LightSquid Report page but when I looked at it the results are quite odd, e.g., for this day the total bytes is only 4MB. I have more than two hundred users and I can't believe they will only consume that much. Another thing is when I looked at the individual ip's report and compared them, all of them browsed the same three sites which is not true.

I think Squid stopped for some reason that is why there the LightSquid report is odd and pfSense gui is still saying that it's running.

Has anybody encountered this issue? How did you resolved it?

Many thanks in advance.

Jan

Helo, jan,

Be careful, as submicron - Global Moderator - Sr. Member, said on: http://forum.pfsense.org/index.php/topic,5729.msg54580.html#msg54580

"In fact, … installation of many packages, some of which are problematic."

You can be triyng to install many packages (5 or more), and/or tryng to use a "problematic" package, or using it in conjuction with a "problematic" package.

I sugest you, to try the same, but installing less packages.

Regards.

@Rom:

Hello,
it is possible to automate update of blacklist on squidguard?

In this version not relised.

I have tried both fixes (curl and ini_set - seperatley) but finding that it takes forever to download the rules files no matter what I use.
If I download the exact same URL that /usr/local/www/snort_download_rules.php is using at the same time but on a desktop that is on the LAN net behind pfSense, it downloads in a couple of minutes. (no caches involved)

Multiple attempts on the pfSense box return the same results.
Traffic shaper is turned off and pfSense is 1.2 prod.

ls on the temp dir (eg /tmp/snortRulesJ0rIr3/) show it downloading, but very slow ..
-rw-r–r--  1 root  wheel  167363 Jun 14 20:02 snortrules-snapshot-CURRENT.tar.gz
-rw-r--r--  1 root  wheel  6637801 Jun 14 20:26 snortrules-snapshot-CURRENT.tar.gz

Once done, the rules file is a complete file, but Snort downloading seems to hang and does not download the md5 hash.

Is there any other additional hacking needs to be done to the snort_download_rules.php file to allow it to progress ?
Does anybody have the above fixes to consistently work ?

Thanks.

hello jose,

i'm not a portugeese.. :) since mhab tell me bout the link, i followed that and its solved my probs.

yes, i'll follow ur suggestion :) thanks for that…

There's a problem with the snort package (or maybe the web configurator?). Sometimes it does not put the full startup command in the snort startup config (/usr/local/etc/rc.d/snort.sh). If you look in that config, it should point to the snort binary, but sometimes after you make a configuration change that entry gets removed.

I've also noticed that the web configurator's service page often does not show the correct status for whether snort is running (or not). The only way to know for sure is to login via ssh and look at the "top" status, or type "ps auxw | grep snort" to see if the process is running.

Also… some of the rulesets do not work at all (snort will not startup). Additionally, if you run too many rules, snort will not start.

It takes a bit of work to get the snort package to work reliably on pfsense.