Dansguardian package for 2.0

Cino

to the custom options. Now it mentions removing the "cache_effective_group" setting is squid.conf but how do you do that properly? I did it manually, but I imagine that will get overridden on the next boot. Even with that and restarting the services I don't get the user names showing in the access.log. What am I missing or what should my next steps be?

if you dont mind hand editing files… edit /usr/local/pkg/squid.inc. Search for 'cache_effective_group' then either remove that line or add comment it out, by adding '# ' in front. Without the quotes tho... They will create the squid.conf file without 'cache_effective_group' on reboots/and restarts

marcelloc

@wheelz:

One more note… It does look like the user name is showing up in the squid access log. So it is the dansguardian that isn't picking it up. Any ideas on that? Thanks!

Did you selected ntlm_auth on dansguardian conf?

wheelz

Yep, that is enabled. I even found your comment on the bug log: http://sourceforge.net/support/tracker.php?aid=3462549 in my research as I was looking at multiple authplugins (would be good to be able to enable/disable multiple and order them in the package GUI once the bug is fixed - is this bug fixed?).

For now though just trying to get ntlm working. You were able to get this working correct? Seems as I have everything working up until dansguardian tries to "sniff" the user information… and I'm kind of stuck. :(

marcelloc

I have sucessfull reports with squid on a Linux machine. This is the first feedback with samba on pfsense.

I'm having issues with multiplugin patch but I'm not sure if It's a squid3 issue or just the patch. I'm still working on it.

wheelz

If I get it working I'll share the whole process I did to get everything working. Perhaps some day it could be integrated into this package (or an additional package).

I did see this:

DansGuardian (but not recent versions of Squid) does not support encrypted Kerberos auth. Even if you correctly configure Squid, Samba, and IE to exchange and validate encrypted Kerberos credentials, DansGuardian will not be able to extract usernames.

This restriction does not apply to the Squid “LDAP” helper, as it handles un-encrypted Kerberos credentials in such a way that the exchange between the Broswer and Squid appears to be BASIC authentication.

on http://contentfilter.futuragts.com/wiki/doku.php?id=using_ntlm_for_user_identification

Could this be the cause of it not working? I know there was some kerberos configs in the steps I followed. If so, any ideas on work arounds?

marcelloc

you may want to try just the samba config options and no kerberos.

wheelz

Hmm…. I see a few other articles about this kind of setup (like http://www.petespcs.co.uk/petespcs/2011/10/dans-guardian-and-ntlm-from-active-directory/ - debian, but still…) and they mention using kerberos. This seems to indicate that other have this working. I'm wondering if it has to do with that multiple authplugin bug... I'll see what I can dig up.

abnz

@Cino:

@marcelloc:

@Cino:

i made a quick rc.d script to start dansguardian on startup..

You did a second startup or changed current script?

Can you check if dansguardian default rc script is on the same folder and what permission it has?

I didn't change the 'dansguardian' script, permissions are 755. I created 'dansguardian.sh' which basically run's '/usr/local/sbin/dansguardian -Q'

I am having the same error, dansguardian[25631]: Error connecting to proxy.

/usr/local/etc/rc.d/dansguardian

-rwxr-xr-x 1 root wheel 895 Apr 4 19:31 dansguardian

The service appears to be running but just not working.

run's '/usr/local/sbin/dansguardian -Q' makes no difference, neither a reboot.

Proxy address is 127.0.0.1 port is 3128.

squid works fine, dansguardian just doesn't seem to bind.

I tried uninstalling both squid and dansguardian, deleting conf files, reinstalling squid and testing it.

I then installed dansguardian and still doesnt work.

I suspect its because I installed dansguardian before squid and some config got screwed. I have not deleted this file before reinstalling?

Appreciate any suggestions.

Cino

its not the same error as I was having… I wasn't getting an error at all... Nothing in my logs.

What port did you setup dansguardian on?

Is squid setup to run on loopback or LAN interface?

marcelloc

@wheelz:

This seems to indicate that other have this working. I'm wondering if it has to do with that multiple authplugin bug… I'll see what I can dig up.

Try to run dansguardian on console to see if there is any running time/config erros

/usr/local/etc/rc.d/dansguardian start

wheelz

So it looks like the dansguardian package is forcing 2.7.STABLE9 of squid. I had installed squid-reverse and that loads 3.1.19. After Dansguardian it reverts it to the older version. Is there a way to make it not override existing squid versions or does the dansguardian package have to be updated with the newer squid version?

marcelloc

I could not make this on package, dansguardian force squid install.

What I'm trying to do is compile dansguardian using squid3 as a dependence.

For now, reinstall squid-reverse after you install dansguardian.

wheelz

Even after a reinstall it still has the version 2.7.STABLE9. I'm guessing both versions are installed but the older version is in the path so it gets started (maybe)? ???

Macom2007

Since i have Dansguardian running, i cant access iTunes anymore. I read i other places that Apples URIs are invalid because they end with a dot (.) Is there a way to allow this URIs ?

/usr/local/etc/rc.d/dansguardian start

kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 4096 -> 4096
dansguardian already running? (pid=6485).

There is no problem with it running, it seems stable, just not working.

marcelloc

The way I use is squid on loopback interface port 3128 and dansguardian on 8080 sending to 127.0.0.1 port 3128.

Check squid cache log to see if there's errors or warnings.

Cino

@abnz:

@Cino:

its not the same error as I was having… I wasn't getting an error at all... Nothing in my logs.

What port did you setup dansguardian on?

Is squid setup to run on loopback or LAN interface?

Dansguardian is on 8080 and squid on LAN interface 3128 default port.

I think the problem I have, dansguardian is starting before squid. I have squid listening to LAN(IPv4 and IPv6) and loopback. Dansguardian is on LAN 8080 and directs its traffic to squid loopback 3128

wheelz

SUCCESS!! ;D After much trial and error I now have SSO ntlm authentication working with squid and dansguardian on pfsense (kerberos wasn't the issue). User names are now showing up in the access.log (for both). Once I can sort through the process again and document it I will post it for everyone's benefit.

Before I do that though I would like to have it resolving AD groups to map users to filtering groups working. Right now I have an ldap configuration defined as such (the names have been changed to protect the innocent):

Hostname: dc1.domain.local
Domain: dc=domain,dc=local
Username: cn=pfsense01ldap,ou=Services,ou=myOU
Password: **********
mask: USER

I also created a test filtering group named "pfsenseUsers" which is the same name as a group in AD and pointed it to the ldap configuration above with a 2m update frequency. However a user in the pfsenseUsers group still get the "Default" filter group in the logs. Do I have the mask wrong (I wasn't sure what I needed there)? or is there something else I missed?

marcelloc

Great news wheelz! :D

Do I have the mask wrong (I wasn't sure what I needed there)? or is there something else I missed?

check how users are listed on dansguardian log and try to set it on groups.