Dansguardian package for 2.0

marcelloc

Just published some fixes and changed version to 0.1.1

features not finished yet:

blacklist update frequency
ssl man in the middle feature

Cino

figured I would give this a try this morning. first thing i noticed, there is no menu option and I dont see it under status:services. But i'm able to access it by typing https://…../pkg_edit.php?xml=dansguardian.xml. and able to see it running via cmdline

allowed 127.0.0.1 access in the squid3 config and was able to use it... enabled the porn filter for testing and worked as designed! Great job man!!! I haven't used dansguardian in years and forgot how complicate the config can be...

how does clamav update its virus def file?

marcelloc

@Cino:

figured I would give this a try this morning. first thing i noticed, there is no menu option and I dont see it under status:services. But i'm able to access it by typing https://…../pkg_edit.php?xml=dansguardian.xml. and able to see it running via cmdline

Isn't there on second menu option? ???

If tested on both amd64 and i386 but only on 2.0.1

@Cino:

I haven't used dansguardian in years and forgot how complicate the config can be…

I know that. Almost 40 config files :P
I've created almost 80% of default config files during first apply/install process.

dansguardian_menu.png_thumb

Cino

i am using 2.1-dev so it could because of that.. i did reboot the box and it took 2-3 minutes for it to get past the starting package… it started tho.

i'll mess with it some more but if other users arn't having the same issue... then its my setup.

marcelloc

@Cino:

i am using 2.1-dev so it could because of that.. i did reboot the box and it took 2-3 minutes for it to get past the starting package… it started tho.

I think It's calling sync process for every XML file during boot.

I'm trying to workaround it.

Cino

i was able to get it to display in the services menu… i ended up re-installing just the gui items. cosmetic, but i would add it to the status: services menu down the road to know its running or not.

should i run a cron job to update the virus db for clamav (freshclam)? or is it built-in somehow?

marcelloc

The first update from clamav is automatic when package detects that there is no database.

I will be an option on gui until I finish schedulle updates( blacklist and clamav)

Cino

thanks again and great work!! You have added some nice add-ons to pfsense over the last couple of months

no issue, but here are the processes on my box.. this is how i know its running:


: ps -aux | grep dan
clamav 13281  0.0  0.4 18036 14028  ??  INs   3:00PM   0:00.08 /usr/local/sbin/dansguardian
clamav 13525  0.0  0.2  7796  4692  ??  IN    3:00PM   0:00.03 /usr/local/sbin/dansguardian
clamav 13655  0.0  0.1  7796  4672  ??  IN    3:00PM   0:00.02 /usr/local/sbin/dansguardian
clamav 13759  0.0  0.5 19060 14840  ??  IN    3:00PM   0:00.43 /usr/local/sbin/dansguardian
clamav 14008  0.0  0.5 18036 14172  ??  IN    3:00PM   0:00.35 /usr/local/sbin/dansguardian
clamav 14105  0.0  0.5 18036 14120  ??  IN    3:00PM   0:00.02 /usr/local/sbin/dansguardian
clamav 14199  0.0  0.5 18036 14120  ??  IN    3:00PM   0:00.02 /usr/local/sbin/dansguardian
clamav 14385  0.0  0.5 18036 14264  ??  IN    3:00PM   0:00.87 /usr/local/sbin/dansguardian
clamav 14451  0.0  0.4 18036 13988  ??  IN    3:00PM   0:00.01 /usr/local/sbin/dansguardian
clamav 14466  0.0  0.4 18036 13988  ??  IN    3:00PM   0:00.01 /usr/local/sbin/dansguardian
clamav 14472  0.0  0.4 18036 13988  ??  IN    3:00PM   0:00.01 /usr/local/sbin/dansguardian
clamav 16150  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.00 /usr/local/sbin/dansguardian
clamav 16221  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.00 /usr/local/sbin/dansguardian
clamav 16515  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.00 /usr/local/sbin/dansguardian
clamav 16582  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.00 /usr/local/sbin/dansguardian
clamav 16676  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.00 /usr/local/sbin/dansguardian
clamav 16741  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.00 /usr/local/sbin/dansguardian
clamav 16763  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.01 /usr/local/sbin/dansguardian
clamav 16828  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.01 /usr/local/sbin/dansguardian
clamav 16843  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.01 /usr/local/sbin/dansguardian
clamav 17095  0.0  0.4 18036 14052  ??  IN    3:40PM   0:00.00 /usr/local/sbin/dansguardian
root   13272  0.0  0.0  3524  1252   0  S+    3:47PM   0:00.00 grep dan

marcelloc

It's running very well.

I'll include service option too. Maybe tomorrow.

marcelloc

version 0.1.2 is out with some fixes and improvements

improve blacklist import and category assign
include dansguardian on service
include log, daemon and config default xml options
fix some typos
Maybe a faster boot process (01:00 on virtualbox)

still working on…

SSL men in the middle feature
Blacklist and clamav update frequency

To avoid double dansguardian link on service menu(dansguardian and Dansguardian), remove 0.1.1 package before install 0.1.2

Cino

thanks for the update.. I've give it a try in a bit

burton78

Thanks for all your hard work marcelloc! This is a great addition to pfsense! Was wondering if adding a "transparent proxy mode" could be an option as well?

Also I caught a typo for ya too under Daemon -> Parent proxy Settings -> Proxy Port: Sets port number "fro" proxy server.

marcelloc

@burton78:

Thanks for all your hard work marcelloc! This is a great addition to pfsense! Was wondering if adding a "transparent proxy mode" could be an option as well?

I'll include PAC configuration to dansguardian package first.

When you enable trasparente proxy, you are not able to authenticate or filter ssl.

I'ts not that good for security at all.

Search for WPAD, PAC proxy.js or proxy.pac to see how auto detecproxy works.

Also I caught a typo for ya too under Daemon -> Parent proxy Settings -> Proxy Port: Sets port number "fro" proxy server.

Thanks.

Cino

here is example of mine that i've been using with squid.


function FindProxyForURL(url, host) {

// If IP address is internal or hostname resolves to internal IP, send direct.

	if (
          isInNet(host, "10.0.0.0", "255.0.0.0") ||
          isInNet(host, "172.16.0.0", "255.240.0.0") ||
          isInNet(host, "192.168.0.0", "255.255.0.0") ||
		  isInNet(host, "127.0.0.0", "255.255.255.0") ||
		  isInNet(host, "192.168.0.100", "255.255.255.255") ||
		  isPlainHostName(host) ||
		  localHostOrDomainIs(host, "127.0.0.1") ||
		  dnsDomainIs(host, ".xxxx.net")
		)

		return "DIRECT";

return "PROXY 192.168.0.1:3128; DIRECT";
}

this is probably more to do with squid then danguardian. i've enabled forwardfor and/or xforwardfor but it always seem to get the IP address of the squid interface in the squid logs… Any ideas? I read there was a patch for squid but this patch is pretty old and you would think it was already built into squid2 and squid3..... i am using squid3 so it could be that...

Any ideas?

marcelloc

@Cino:

return "PROXY 192.168.0.1:3128; DIRECT";

Change this to dansguardian port and enable Auth Plugin on dansguardian general tab, this will log users.

to log x-forwarded ips you need to inlcude this x-forwarder no squid.conf log directive.

I did not found what to change but as you are using version 3.x, this doc can help
http://www.squid-cache.org/Doc/config/follow_x_forwarded_for/

EDIT
Try ip address authentication mode on dansguardian general tab.
This may log ip as a user on your squid.

You can also disable squid log and change dansguardian style to squid.

itoxygen

PfSense 2.0.1 install Dansguardian v.0.1.2
error code
php: /pkg_edit.php: The command '/usr/local/etc/rc.d/dansguardian stop' returned exit code '1', the output was 'dansguardian not running? (check /var/run/dansguardian.pid).'
Jan 30 22:13:19 dansguardian[38774]: Error reading custom image file.

where is problem?

marcelloc

@itoxygen:

PfSense 2.0.1 install Dansguardian v.0.1.2
error code
php: /pkg_edit.php: The command '/usr/local/etc/rc.d/dansguardian stop' returned exit code '1', the output was 'dansguardian not running? (check /var/run/dansguardian.pid).'
Jan 30 22:13:19 dansguardian[38774]: Error reading custom image file.

where is problem?

try to start on console:
/usr/local/etc/rc.d/dansguardian start

itoxygen

Dansguardian service status is running, but system logs error message

Jan 30 22:36:57 php: /pkg_edit.php: The command '/usr/local/etc/rc.d/dansguardian stop' returned exit code '1', the output was 'dansguardian not running? (check /var/run/dansguardian.pid).'
Jan 30 22:36:57 dansguardian[50366]: Error reading custom image file.

Content filter not working

marcelloc

Are you configuring client browser to use squid port or dansguardian port?

Can you paste return from:
ps ax | grep -i dansguardian

itoxygen

Squid transparent proxy mode port number 3128, I add the adress to the black list of squid, it works without problem

$ ps ax | grep -i dansguardian
130 ?? I 0:00.00 /usr/local/sbin/dansguardian
366 ?? I 0:00.00 /usr/local/sbin/dansguardian
527 ?? I 0:00.00 /usr/local/sbin/dansguardian
557 ?? I 0:00.00 /usr/local/sbin/dansguardian
895 ?? I 0:00.00 /usr/local/sbin/dansguardian
1176 ?? I 0:00.00 /usr/local/sbin/dansguardian
1288 ?? I 0:00.00 /usr/local/sbin/dansguardian
1464 ?? I 0:00.00 /usr/local/sbin/dansguardian
1530 ?? I 0:00.00 /usr/local/sbin/dansguardian
48666 ?? S 0:00.00 sh -c ps ax | grep -i dansguardian
48931 ?? S 0:00.00 grep -i dansguardian
63558 ?? Is 0:00.02 /usr/local/sbin/dansguardian
63861 ?? I 0:00.01 /usr/local/sbin/dansguardian