Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Dansguardian package for 2.0

    Scheduled Pinned Locked Moved pfSense Packages
    492 Posts 51 Posters 531.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      @wheelz:

      I just came across this and this is great news!  I've been hoping for this to be added so I can give pfsense a full try.  Is this compatible with squid-reverse?  If so, would I load squid-reverse first or vice versa?

      I'ts compatible with any squid version on pfsense.

      Install squid package first and then dansguardian.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • W
        wheelz
        last edited by

        I originally got a little install-happy when I saw it and just started loading stuff.  For some reason the dansguardian menu never showed up so I removed all packages and started again - this time slower.  So I installed the squid-reverse package and made sure I could use the proxy first.  That was working after I added the firewall rule to allow 3128.  Then I loaded the dansguardian package (menu showed up this time) and added firewall rule to allow 8080 (I removed the 3128 rule).  I can telnet into port 8080 but it isn't passing web pages back.  Is there another firewall rule I am missing or something else I need to get basic default functionality up?

        Also, how do you donate towards a package?

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          Did you configured squid ip and port on dansguardian daemon settings?

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • W
            wheelz
            last edited by

            yea, 127.0.0.1 and port 3128.  I tried to keep a lot of defaults just to get it working and then I'll tweak the things I want afterwards.  Still no go though.

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              try to run it on console/ssh

              /usr/local/etc/rc.d/dansguardian start

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • W
                wheelz
                last edited by

                I think it is already started.  Both squid and dansguardian services show as being started.  I can open a connection to port 8080 so I know it is listening.  Perhaps dansguardian and squid just aren't talking yet?  I have squid listening on loopback.  Do I need a firewall rule to allow loopback traffic?

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  No, loopback traffic is Allowed by default.

                  What do you see in dansguardian logs?

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • W
                    wheelz
                    last edited by

                    Hmm… I restarted the services and now squid won't start.  This is actually what I had happening the first time I set it up.  I get the following when I try to start it from the command line:

                    2012/03/26 20:52:00| parseConfigFile: squid.conf:18 unrecognized: 'sslcrtd_children'
                    2012/03/26 20:52:00| ACL name 'all' not defined!
                    FATAL: Bungled (null) line 182: http_reply_access allow all
                    Squid Cache (Version 2.7.STABLE9): Terminated abnormally.

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      Dansguardian package does not force a squid install if you have squid already installed. Try to reinstall squid package.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • W
                        wheelz
                        last edited by

                        I fixed it!  ;D  I guess somehow a line got removed from the squid conf.  I just added

                        acl all src 0.0.0.0/0.0.0.0

                        to the custom options and now both squid and dans is working.

                        1 Reply Last reply Reply Quote 0
                        • W
                          wheelz
                          last edited by

                          Is it possible to have Active Directory pass-through authentication so that users don't have to enter a user name and password to browse through squid/dans?

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            I did it last week with squid + samba + Kerberos but dansguardian ntlm plugin could not detect squid ntlm responses.

                            The way I got it working was squid with ntlm or negociate then dansguardian then another squid in cache mode.

                            I did a smal post in portugueses forum with steps I did. Try to google translate it  :)

                            http://forum.pfsense.org/index.php/topic,47532.msg250366.html#msg250366

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • W
                              wheelz
                              last edited by

                              So I am following your posts on what you did for the samba authentication.  Everything went ok and I ran the kinit command ok but the domain join returns the following:

                              net ads join -U MyAdminAccount@MYDOMAIN.LOCAL
                              Host is not configured as a member server.
                              Invalid configuration.  Exiting….
                              Failed to join domain: This operation is only allowed for the PDC of the domain.

                              Perhaps it is just easier if I post my files.  If you assume the following:

                              AD Domain is mydomain.local
                              PDC Emulator DC is mydc.mydomain.local
                              Admin Account for domain join is MyAdminAccount
                              pfsense host name is pfsense

                              Is this configuration correct?

                              /etc/krb5.conf

                              [logging]
                              default = FILE:/var/log/krb5libs.log
                              kdc = FILE:/var/log/krb5kdc.log
                              admin_server = FILE:/var/log/ksadmind.log
                              [libdefaults]
                              default_realm = MYDOMAIN.LOCAL.
                              dns_lookup_realm = false
                              dns_lookup_kdc = false
                              ticket_lifetime = 24h
                              forwardable = yes
                              default_tgs_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
                              default_tkt_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
                              preferred_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
                              [realms]
                              PRIVATE.V.VNET = {
                              kdc = mydc.mydomain.local.:88
                              admin_server = mydc.mydomain.local.:749
                              default_domain = domain.
                              }
                              [domain_realm]
                              .domain. = MYDOMAIN.LOCAL.
                              domain. = MYDOMAIN.LOCAL.
                              [kdc]
                              profile = /var/kerberos/krb5kdc/kdc.conf
                              [appdefaults]
                              pam = {
                              debug = false
                              ticket_lifetime = 36000
                              renew_lifetime = 36000
                              forwardable = true
                              krb4_convert = false
                              }
                              

                              /etc/samba.smb.conf

                              [global]
                              netbios name = MYDC
                              workgroup = MYDOMAIN
                              realm = MYDOMAIN.LOCAL
                              server string = Domain Proxy Server
                              encrypt passwords = yes
                              security = ADS
                              password server = mydc.mydomain.local
                              log level = 3
                              log file = /var/log/samba/%m.log
                              max log size = 50
                              socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
                              printcap name = /etc/printcap
                              preferred master = No
                              dns proxy = No
                              ldap ssl = no
                              idmap uid = 10000-20000
                              idmap gid = 10000-20000
                              winbind use default domain = yes
                              cups options = raw
                              

                              /var/heimdal/kdc.conf

                              [kdcdfefaults]
                              acl_file = /var/heimdal/kadm5.acl
                              dict_file = /usr/share/dict/words
                              admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
                              v4_mode = noreauth
                              [libdefaults]
                              default_realm = MYDOMAIN.
                              [realms]
                              MYDOMAIN. = {
                              master_key_type = des-cbc-crc
                              supported_enctypes = des3-hmac-sha1:normal arcfourhmac:
                              normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
                              des-cbc-crc:v4 des-cbc-crc:afs3
                              }
                              

                              /var/heimdal/kadm5.acl

                              */admin@MYDOMAIN.LOCAL *
                              

                              Additional Squid parameters (I added the acl all src 0.0.0.0/0.0.0.0 to fix my previous issue)

                              acl all src 0.0.0.0/0.0.0.0;auth_param ntlm program /usr/local/bin/ntlm_auth -use-cached-creds -helper-protocol=squid-2.5-ntlmssp;auth_param ntlm children 30;on auth_param ntlm keep_alive;proxy_auth REQUIRED acl password;http_access allow password
                              

                              I wasn't completely sure about the pathing in the config files as they weren't changed in the other guy's posts that you were helping.  Also I wasn't sure which NETBIOS name to use in the samba config and exactly what is supposed to be in the kadm5.acl file.  I did a copy/paste of the Proxy parameters but it didn't paste right so that's why I wanted to confirm those as well.

                              Also for when you specify the PDC, does this have to be the DC with the PDC emulator role or can it be any DC?

                              Thanks in advance!

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                wheelz,

                                some checks:

                                • Make sure pfsense machine name isn't the same name as any user on your active directory

                                • perform a kinit/klist to make sure you have kerberos comunication do active directory before net ads join

                                • Pay attention on . and UPPERCASES of kerberos config files, follow exactly what is on squid howto.

                                att,
                                Marcello Coutinho

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  Version 1.5.2 is out with some bug fixes including startup script exclusion on package reinstalls.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jigpe
                                    last edited by

                                    Cant do it on x86 :(

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      @jigpe:

                                      Cant do it on x86 :(

                                      What error did you got?

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        Cino
                                        last edited by

                                        strange, dansguardian wont start when I reboot the box.. But i can manually start it. I looked around in my log and I see reloads itself a few times on startup… I can confirm it started during the boot process but then it dies... When I manually start it, it stays running.

                                        1 Reply Last reply Reply Quote 0
                                        • F
                                          FiscoKid
                                          last edited by

                                          I am trying to install Dansguardian into PFsense It says on boot up that it started, however in services it reported it has stopped. When I go into the webgui for the settings it has the icapserver address in the contentscannertimeout field. Below is the log. I corrected the dansguardian configuation file to read the default of 60 seconds, however the web gui field will not reflect the change. On reboot the icapserver address is back in the .conf file.

                                          Mar 29 13:54:10 root: /usr/local/etc/rc.d/dansguardian: WARNING: failed to start dansguardian
                                          Mar 29 13:54:10 dansguardian[666]: Error parsing the dansguardian.conf file or other DansGuardian configuration files
                                          Mar 29 13:54:10 dansguardian[666]: Config problem; check allowed values for contentscannertimeout
                                          Mar 29 13:47:06 root: /usr/local/etc/rc.d/dansguardian: WARNING: failed to start dansguardian
                                          Mar 29 13:47:06 dansguardian[15796]: Error parsing the dansguardian.conf file or other DansGuardian configuration files
                                          Mar 29 13:47:06 dansguardian[15796]: Config problem; check allowed values for contentscannertimeout

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            FiscoKid,

                                            What field gui and config options are wrong?

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.