Anyone can help?
thanks

Some progress.  I had to create each group, save it, then hit save again under the Groups tab, wait for it to populate under the Users tab (manually running dansguardian_ldap.php did NOT populate the group immediately), hit save, then repeat for every group.  I now have what I'm told is the complete list of users.  I also had to restore the "Default" group from backup.

I have now set the default group to deny access, and have set up all the other grous for thier appropriate access.  Now when a user configures the proxy, they are simply denied, never taken to a page to verify credentials.  I can't add this firewall to the domain I'm working on as per https://forum.pfsense.org/index.php/topic,58700.0.html .  if I set the default back to allowed the person can get through.  Is there someplace I need to turn on the ability to have the thing ASK for credentials if none are presented?

Jun 25 09:59:00 check_reload_status: Syncing firewall
Jun 25 09:58:58 php: rc.bootup: Beginning package installation for Lightsquid .
Jun 25 09:58:58 php: rc.bootup: Reinstalling package Lightsquid
Jun 25 09:58:58 kernel:
Jun 25 09:58:58 php: rc.bootup: Finished uninstalling package Lightsquid
Jun 25 09:58:58 check_reload_status: Syncing firewall
Jun 25 09:58:57 check_reload_status: Syncing firewall
Jun 25 09:58:46 php: rc.bootup: Uninstalling package Lightsquid
Jun 25 09:58:46 php: rc.bootup: Finished installing package squid
Jun 25 09:58:46 php: rc.bootup: Successfully installed package: squid.
Jun 25 09:58:46 check_reload_status: Syncing firewall
Jun 25 09:58:46 php: rc.bootup: The command '/usr/pbi/squid-amd64/sbin/squid -k reconfigure' returned exit code '1', the output was 'squid: ERROR: No running copy'
Jun 25 09:58:46 php: rc.bootup: Reloading Squid for configuration sync
Jun 25 09:58:45 php: rc.bootup: The command '/usr/pbi/squid-amd64/sbin/squid -k reconfigure' returned exit code '1', the output was 'squid: ERROR: No running copy'
Jun 25 09:58:45 php: rc.bootup: Reloading Squid for configuration sync
Jun 25 09:58:45 squid[86450]: Squid Parent: child process 86588 started
Jun 25 09:58:45 kernel: Reconfiguring filter… One moment please...
Jun 25 09:58:45 php: rc.bootup: Starting a proxy monitor script
Jun 25 09:58:45 kernel: Checking cache... One moment please...Starting... One moment please...
Jun 25 09:58:45 php: rc.bootup: Starting Squid
Jun 25 09:58:44 php: rc.bootup: Stopping any running proxy monitors
Jun 25 09:58:44 kernel: chmod: /usr/pbi/squid-amd64/libexec/squid/dnsserver: No such file or directory
Jun 25 09:58:44 check_reload_status: Syncing firewall

I much prefer using a wpad, dealing with https in transparent mode has many issues.

The wiki for a wpad
https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

My process of setting it up
https://forum.pfsense.org/index.php?topic=93060.0

Good luck

I also had trouble starting Icap for the antivirus when I was playing with it a little while ago, could be something in the Proxy server: Antivirus config page.

If your ISP is proxying HTTPS then it's time to find a new ISP.  Are you getting browser warnings when going to HTTPS sites?

I have been trying to fix this - have removed DG package and reinstalled again but of course it recreates all the config from config.xml, which has a LOT of DG stuff in there.
So it still falls over in a heap.

How can I remove all the DG stuff from config.xml, or alternatively load DG with all default settings?
Had a quick look in viconfig but there isn't a simple <dansguardian></dansguardian>section I can just remove.

ta

End up removing the whole package,  the only reason to use it at home was the Anti-Virus, but it keeps wriite intensive activities to HDD, not worth it.

Use WPAD

This is a short-cut.  ;)
You have to notice that WPAD has no impact on HTTPS filtering.

What makes difference here is use of explicit proxy instead of transparent proxy.

Purpose, with WPAD, is to ease proxy discovery (WPAD stands for Web Proxy Auto Discovery) in order to use explicit proxy because manual configuration can be painful in case you have a lot of clients (or in case your proxy moves or… whatever that would require to change such setting).

For reasonably small group of clients, configuring manually proxy at browser level can be the easiest solution.

so I had to configure manually on every desktop.

WPAD might have saved you a lot of time.

@doktornotor:

OMG. You really just have no clue… I was telling you that you should NOT use http:// (plaintext) for logins. There is no "allow paintext auth in squid" and that's NOT your problem either. Your problem is that the site is incompatible with your proxy. As soon as you have managed to produce the stupid HTTPS/MITM filtering, you will NOT be able to login to that site at all. You do NOT want to proxy financial services sites, HTTP or HTTPS. It's just damn stupid and dangerous!!! Exclude that site from any proxying and move on.

but it work on pfsense 2.1.5

Hi,

I can not find the problem (finally I wonder if this is a SNI problem I change the configuration and no longer uses the tcp.

Everything works perfectly now!

Thank you for your help
have a good day

laurent

woah

after 6 months of using SQUID i got used to it…

I got fed up with the reverse proxy thing and I deleted squid3 package all at once

The internetz is sooooooooo FAST now it's incredible !!!

I was under the impresssion that squid was speeding up our interwebz connection but it was NOT

I'm enjoying high speed internet for real now !

I don't know about that, but squid 2 was marked as obsolete 3 years ago by the Squid group.  Today they recommend that you not use it.  The pfSense Squid2 package may have been updated for the security vulns but I don't know for sure.

http://wiki.squid-cache.org/RoadMap/Squid2

How to make Antivirus works on HTTPS link?