Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Dansguardian package for 2.0

    Scheduled Pinned Locked Moved pfSense Packages
    492 Posts 51 Posters 530.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      try to run it on console/ssh

      /usr/local/etc/rc.d/dansguardian start

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • W
        wheelz
        last edited by

        I think it is already started.  Both squid and dansguardian services show as being started.  I can open a connection to port 8080 so I know it is listening.  Perhaps dansguardian and squid just aren't talking yet?  I have squid listening on loopback.  Do I need a firewall rule to allow loopback traffic?

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          No, loopback traffic is Allowed by default.

          What do you see in dansguardian logs?

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • W
            wheelz
            last edited by

            Hmm… I restarted the services and now squid won't start.  This is actually what I had happening the first time I set it up.  I get the following when I try to start it from the command line:

            2012/03/26 20:52:00| parseConfigFile: squid.conf:18 unrecognized: 'sslcrtd_children'
            2012/03/26 20:52:00| ACL name 'all' not defined!
            FATAL: Bungled (null) line 182: http_reply_access allow all
            Squid Cache (Version 2.7.STABLE9): Terminated abnormally.

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              Dansguardian package does not force a squid install if you have squid already installed. Try to reinstall squid package.

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • W
                wheelz
                last edited by

                I fixed it!  ;D  I guess somehow a line got removed from the squid conf.  I just added

                acl all src 0.0.0.0/0.0.0.0

                to the custom options and now both squid and dans is working.

                1 Reply Last reply Reply Quote 0
                • W
                  wheelz
                  last edited by

                  Is it possible to have Active Directory pass-through authentication so that users don't have to enter a user name and password to browse through squid/dans?

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    I did it last week with squid + samba + Kerberos but dansguardian ntlm plugin could not detect squid ntlm responses.

                    The way I got it working was squid with ntlm or negociate then dansguardian then another squid in cache mode.

                    I did a smal post in portugueses forum with steps I did. Try to google translate it  :)

                    http://forum.pfsense.org/index.php/topic,47532.msg250366.html#msg250366

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • W
                      wheelz
                      last edited by

                      So I am following your posts on what you did for the samba authentication.  Everything went ok and I ran the kinit command ok but the domain join returns the following:

                      net ads join -U MyAdminAccount@MYDOMAIN.LOCAL
                      Host is not configured as a member server.
                      Invalid configuration.  Exiting….
                      Failed to join domain: This operation is only allowed for the PDC of the domain.

                      Perhaps it is just easier if I post my files.  If you assume the following:

                      AD Domain is mydomain.local
                      PDC Emulator DC is mydc.mydomain.local
                      Admin Account for domain join is MyAdminAccount
                      pfsense host name is pfsense

                      Is this configuration correct?

                      /etc/krb5.conf

                      [logging]
                      default = FILE:/var/log/krb5libs.log
                      kdc = FILE:/var/log/krb5kdc.log
                      admin_server = FILE:/var/log/ksadmind.log
                      [libdefaults]
                      default_realm = MYDOMAIN.LOCAL.
                      dns_lookup_realm = false
                      dns_lookup_kdc = false
                      ticket_lifetime = 24h
                      forwardable = yes
                      default_tgs_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
                      default_tkt_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
                      preferred_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
                      [realms]
                      PRIVATE.V.VNET = {
                      kdc = mydc.mydomain.local.:88
                      admin_server = mydc.mydomain.local.:749
                      default_domain = domain.
                      }
                      [domain_realm]
                      .domain. = MYDOMAIN.LOCAL.
                      domain. = MYDOMAIN.LOCAL.
                      [kdc]
                      profile = /var/kerberos/krb5kdc/kdc.conf
                      [appdefaults]
                      pam = {
                      debug = false
                      ticket_lifetime = 36000
                      renew_lifetime = 36000
                      forwardable = true
                      krb4_convert = false
                      }
                      

                      /etc/samba.smb.conf

                      [global]
                      netbios name = MYDC
                      workgroup = MYDOMAIN
                      realm = MYDOMAIN.LOCAL
                      server string = Domain Proxy Server
                      encrypt passwords = yes
                      security = ADS
                      password server = mydc.mydomain.local
                      log level = 3
                      log file = /var/log/samba/%m.log
                      max log size = 50
                      socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
                      printcap name = /etc/printcap
                      preferred master = No
                      dns proxy = No
                      ldap ssl = no
                      idmap uid = 10000-20000
                      idmap gid = 10000-20000
                      winbind use default domain = yes
                      cups options = raw
                      

                      /var/heimdal/kdc.conf

                      [kdcdfefaults]
                      acl_file = /var/heimdal/kadm5.acl
                      dict_file = /usr/share/dict/words
                      admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
                      v4_mode = noreauth
                      [libdefaults]
                      default_realm = MYDOMAIN.
                      [realms]
                      MYDOMAIN. = {
                      master_key_type = des-cbc-crc
                      supported_enctypes = des3-hmac-sha1:normal arcfourhmac:
                      normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
                      des-cbc-crc:v4 des-cbc-crc:afs3
                      }
                      

                      /var/heimdal/kadm5.acl

                      */admin@MYDOMAIN.LOCAL *
                      

                      Additional Squid parameters (I added the acl all src 0.0.0.0/0.0.0.0 to fix my previous issue)

                      acl all src 0.0.0.0/0.0.0.0;auth_param ntlm program /usr/local/bin/ntlm_auth -use-cached-creds -helper-protocol=squid-2.5-ntlmssp;auth_param ntlm children 30;on auth_param ntlm keep_alive;proxy_auth REQUIRED acl password;http_access allow password
                      

                      I wasn't completely sure about the pathing in the config files as they weren't changed in the other guy's posts that you were helping.  Also I wasn't sure which NETBIOS name to use in the samba config and exactly what is supposed to be in the kadm5.acl file.  I did a copy/paste of the Proxy parameters but it didn't paste right so that's why I wanted to confirm those as well.

                      Also for when you specify the PDC, does this have to be the DC with the PDC emulator role or can it be any DC?

                      Thanks in advance!

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        wheelz,

                        some checks:

                        • Make sure pfsense machine name isn't the same name as any user on your active directory

                        • perform a kinit/klist to make sure you have kerberos comunication do active directory before net ads join

                        • Pay attention on . and UPPERCASES of kerberos config files, follow exactly what is on squid howto.

                        att,
                        Marcello Coutinho

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          Version 1.5.2 is out with some bug fixes including startup script exclusion on package reinstalls.

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • J
                            jigpe
                            last edited by

                            Cant do it on x86 :(

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              @jigpe:

                              Cant do it on x86 :(

                              What error did you got?

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • C
                                Cino
                                last edited by

                                strange, dansguardian wont start when I reboot the box.. But i can manually start it. I looked around in my log and I see reloads itself a few times on startup… I can confirm it started during the boot process but then it dies... When I manually start it, it stays running.

                                1 Reply Last reply Reply Quote 0
                                • F
                                  FiscoKid
                                  last edited by

                                  I am trying to install Dansguardian into PFsense It says on boot up that it started, however in services it reported it has stopped. When I go into the webgui for the settings it has the icapserver address in the contentscannertimeout field. Below is the log. I corrected the dansguardian configuation file to read the default of 60 seconds, however the web gui field will not reflect the change. On reboot the icapserver address is back in the .conf file.

                                  Mar 29 13:54:10 root: /usr/local/etc/rc.d/dansguardian: WARNING: failed to start dansguardian
                                  Mar 29 13:54:10 dansguardian[666]: Error parsing the dansguardian.conf file or other DansGuardian configuration files
                                  Mar 29 13:54:10 dansguardian[666]: Config problem; check allowed values for contentscannertimeout
                                  Mar 29 13:47:06 root: /usr/local/etc/rc.d/dansguardian: WARNING: failed to start dansguardian
                                  Mar 29 13:47:06 dansguardian[15796]: Error parsing the dansguardian.conf file or other DansGuardian configuration files
                                  Mar 29 13:47:06 dansguardian[15796]: Config problem; check allowed values for contentscannertimeout

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    FiscoKid,

                                    What field gui and config options are wrong?

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cino
                                      last edited by

                                      @Cino:

                                      strange, dansguardian wont start when I reboot the box.. But i can manually start it. I looked around in my log and I see reloads itself a few times on startup… I can confirm it started during the boot process but then it dies... When I manually start it, it stays running.

                                      i made a quick rc.d script to start dansguardian on startup..

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Macom2007
                                        last edited by

                                        I get this error if i want to use Dansguardian :

                                        dansguardian[723]: Error connecting to proxy

                                        Squid is installed and running … Any help ?

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          @Macom2007:

                                          dansguardian[723]: Error connecting to proxy

                                          Are you listening squid on loopback and configured dansguardian with 127.0.0.1 on port 3128?

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @Cino:

                                            i made a quick rc.d script to start dansguardian on startup..

                                            You did a second startup or changed current script?

                                            Can you check if dansguardian default rc script is on the same folder and what permission it has?

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.