Dansguardian package for 2.0

wheelz · Apr 3, 2012, 4:29 PM

wheelz,

some checks:

Make sure pfsense machine name isn't the same name as any user on your active directory

perform a kinit/klist to make sure you have kerberos comunication do active directory before net ads join

Pay attention on . and UPPERCASES of kerberos config files, follow exactly what is on squid howto.

att,
Marcello Coutinho

OK, so now I am getting closer. After much trial and error I was able to get it to join the domain. Also now I have wbinfo showing the trust is successful and it can pull users and groups from the domain. I did the chgrp command, set up the group policy setting for NTLM on Win 7 etc, and added:

acl all src 0.0.0.0/0.0.0.0;auth_param ntlm program /usr/local/bin/ntlm_auth –use-cached-creds --helper-protocol=squid-2.5-ntlmssp;auth_param ntlm children 30;auth_param ntlm keep_alive on;acl AuthorizedUsers proxy_auth REQUIRED;http_access allow AuthorizedUsers

to the custom options. Now it mentions removing the "cache_effective_group" setting is squid.conf but how do you do that properly? I did it manually, but I imagine that will get overridden on the next boot. Even with that and restarting the services I don't get the user names showing in the access.log. What am I missing or what should my next steps be?

wheelz · Apr 3, 2012, 4:55 PM

One more note… It does look like the user name is showing up in the squid access log. So it is the dansguardian that isn't picking it up. Any ideas on that? Thanks!

Cino · Apr 3, 2012, 4:57 PM

@wheelz:

to the custom options. Now it mentions removing the "cache_effective_group" setting is squid.conf but how do you do that properly? I did it manually, but I imagine that will get overridden on the next boot. Even with that and restarting the services I don't get the user names showing in the access.log. What am I missing or what should my next steps be?

if you dont mind hand editing files… edit /usr/local/pkg/squid.inc. Search for 'cache_effective_group' then either remove that line or add comment it out, by adding '# ' in front. Without the quotes tho... They will create the squid.conf file without 'cache_effective_group' on reboots/and restarts

marcelloc · Apr 3, 2012, 7:23 PM

@wheelz:

One more note… It does look like the user name is showing up in the squid access log. So it is the dansguardian that isn't picking it up. Any ideas on that? Thanks!

Did you selected ntlm_auth on dansguardian conf?

wheelz · Apr 3, 2012, 7:49 PM

Yep, that is enabled. I even found your comment on the bug log: http://sourceforge.net/support/tracker.php?aid=3462549 in my research as I was looking at multiple authplugins (would be good to be able to enable/disable multiple and order them in the package GUI once the bug is fixed - is this bug fixed?).

For now though just trying to get ntlm working. You were able to get this working correct? Seems as I have everything working up until dansguardian tries to "sniff" the user information… and I'm kind of stuck. :(

marcelloc · Apr 3, 2012, 8:07 PM

I have sucessfull reports with squid on a Linux machine. This is the first feedback with samba on pfsense.

I'm having issues with multiplugin patch but I'm not sure if It's a squid3 issue or just the patch. I'm still working on it.

wheelz · Apr 3, 2012, 9:19 PM

If I get it working I'll share the whole process I did to get everything working. Perhaps some day it could be integrated into this package (or an additional package).

I did see this:

DansGuardian (but not recent versions of Squid) does not support encrypted Kerberos auth. Even if you correctly configure Squid, Samba, and IE to exchange and validate encrypted Kerberos credentials, DansGuardian will not be able to extract usernames.

This restriction does not apply to the Squid “LDAP” helper, as it handles un-encrypted Kerberos credentials in such a way that the exchange between the Broswer and Squid appears to be BASIC authentication.

on http://contentfilter.futuragts.com/wiki/doku.php?id=using_ntlm_for_user_identification

Could this be the cause of it not working? I know there was some kerberos configs in the steps I followed. If so, any ideas on work arounds?

marcelloc · Apr 3, 2012, 10:33 PM

you may want to try just the samba config options and no kerberos.

wheelz · Apr 4, 2012, 12:10 AM

Hmm…. I see a few other articles about this kind of setup (like http://www.petespcs.co.uk/petespcs/2011/10/dans-guardian-and-ntlm-from-active-directory/ - debian, but still…) and they mention using kerberos. This seems to indicate that other have this working. I'm wondering if it has to do with that multiple authplugin bug... I'll see what I can dig up.

abnz · Apr 4, 2012, 8:23 AM

@Cino:

@marcelloc:

@Cino:

i made a quick rc.d script to start dansguardian on startup..

You did a second startup or changed current script?

Can you check if dansguardian default rc script is on the same folder and what permission it has?

I didn't change the 'dansguardian' script, permissions are 755. I created 'dansguardian.sh' which basically run's '/usr/local/sbin/dansguardian -Q'

I am having the same error, dansguardian[25631]: Error connecting to proxy.

/usr/local/etc/rc.d/dansguardian

-rwxr-xr-x 1 root wheel 895 Apr 4 19:31 dansguardian

The service appears to be running but just not working.

run's '/usr/local/sbin/dansguardian -Q' makes no difference, neither a reboot.

Proxy address is 127.0.0.1 port is 3128.

squid works fine, dansguardian just doesn't seem to bind.

I tried uninstalling both squid and dansguardian, deleting conf files, reinstalling squid and testing it.

I then installed dansguardian and still doesnt work.

I suspect its because I installed dansguardian before squid and some config got screwed. I have not deleted this file before reinstalling?

Appreciate any suggestions.

Cino · Apr 4, 2012, 11:32 AM

its not the same error as I was having… I wasn't getting an error at all... Nothing in my logs.

What port did you setup dansguardian on?

Is squid setup to run on loopback or LAN interface?

marcelloc · Apr 4, 2012, 12:40 PM

@wheelz:

This seems to indicate that other have this working. I'm wondering if it has to do with that multiple authplugin bug… I'll see what I can dig up.

Try to run dansguardian on console to see if there is any running time/config erros

/usr/local/etc/rc.d/dansguardian start

wheelz · Apr 5, 2012, 7:41 PM

So it looks like the dansguardian package is forcing 2.7.STABLE9 of squid. I had installed squid-reverse and that loads 3.1.19. After Dansguardian it reverts it to the older version. Is there a way to make it not override existing squid versions or does the dansguardian package have to be updated with the newer squid version?

marcelloc · Apr 5, 2012, 7:43 PM

I could not make this on package, dansguardian force squid install.

What I'm trying to do is compile dansguardian using squid3 as a dependence.

For now, reinstall squid-reverse after you install dansguardian.

wheelz · Apr 5, 2012, 8:22 PM

Even after a reinstall it still has the version 2.7.STABLE9. I'm guessing both versions are installed but the older version is in the path so it gets started (maybe)? ???

Macom2007 · Apr 6, 2012, 3:46 PM

Since i have Dansguardian running, i cant access iTunes anymore. I read i other places that Apples URIs are invalid because they end with a dot (.) Is there a way to allow this URIs ?

/usr/local/etc/rc.d/dansguardian start

kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 4096 -> 4096
dansguardian already running? (pid=6485).

There is no problem with it running, it seems stable, just not working.

marcelloc · Apr 9, 2012, 1:11 PM

The way I use is squid on loopback interface port 3128 and dansguardian on 8080 sending to 127.0.0.1 port 3128.

Check squid cache log to see if there's errors or warnings.

Cino · Apr 9, 2012, 1:27 PM

@abnz:

@Cino:

its not the same error as I was having… I wasn't getting an error at all... Nothing in my logs.

What port did you setup dansguardian on?

Is squid setup to run on loopback or LAN interface?

Dansguardian is on 8080 and squid on LAN interface 3128 default port.

I think the problem I have, dansguardian is starting before squid. I have squid listening to LAN(IPv4 and IPv6) and loopback. Dansguardian is on LAN 8080 and directs its traffic to squid loopback 3128