Dansguardian package for 2.0

[abnz]

@marcelloc:

@wheelz:

This seems to indicate that other have this working.  I'm wondering if it has to do with that multiple authplugin bug… I'll see what I can dig up.

Try to run dansguardian on console to see if there is any running time/config erros

/usr/local/etc/rc.d/dansguardian start

/usr/local/etc/rc.d/dansguardian start

kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 4096 -> 4096
dansguardian already running? (pid=6485).

There is no problem with it running, it seems stable, just not working.

[marcelloc]

The way I use is squid on loopback interface port 3128 and dansguardian on 8080 sending to 127.0.0.1 port 3128.

Check squid cache log to see if there's errors or warnings.

[Cino]

@abnz:

@Cino:

its not the same error as I was having… I wasn't getting an error at all... Nothing in my logs.

What port did you setup dansguardian on?

Is squid setup to run on loopback or LAN interface?

Dansguardian is on 8080 and squid on LAN interface 3128 default port.

I think the problem I have, dansguardian is starting before squid. I have squid listening to LAN(IPv4 and IPv6) and loopback. Dansguardian is on LAN 8080 and directs its traffic to squid loopback 3128

[wheelz]

SUCCESS!!  ;D  After much trial and error I now have SSO ntlm authentication working with squid and dansguardian on pfsense (kerberos wasn't the issue).  User names are now showing up in the access.log (for both).  Once I can sort through the process again and document it I will post it for everyone's benefit.

Before I do that though I would like to have it resolving AD groups to map users to filtering groups working.  Right now I have an ldap configuration defined as such (the names have been changed to protect the innocent):

Hostname:  dc1.domain.local
Domain:  dc=domain,dc=local
Username:  cn=pfsense01ldap,ou=Services,ou=myOU
Password:  **********
mask:  USER

I also created a test filtering group named "pfsenseUsers" which is the same name as a group in AD and pointed it to the ldap configuration above with a 2m update frequency.  However a user in the pfsenseUsers group still get the "Default" filter group in the logs.  Do I have the mask wrong (I wasn't sure what I needed there)?  or is there something else I missed?

[marcelloc]

Great news wheelz! :D

Do I have the mask wrong (I wasn't sure what I needed there)?  or is there something else I missed?

check how users are listed on dansguardian log and try to set it on groups.

[wheelz]

@marcelloc:

Great news wheelz! :D

Do I have the mask wrong (I wasn't sure what I needed there)?  or is there something else I missed?

check how users are listed on dansguardian log and try to set it on groups.

It just shows the user name and that's it.  What config files contain the ldap connection settings and the mapping of the filter groups to ldap connections?  I can see them in the GUI but couldn't find them in the backend files like dansguardian.conf…

[marcelloc]

The ldap fetch is done by dansguardian_ldap.PHP

It's not from dansguardian configuration.

How users are listed on dansguardian user tab?

[abnz]

@marcelloc:

The way I use is squid on loopback interface port 3128 and dansguardian on 8080 sending to 127.0.0.1 port 3128.

Check squid cache log to see if there's errors or warnings.

feel like a dufus, I was sending dansguardian to loopback, but squid was listening on LAN NIC.
FYI, default config finds this innapropriate ;D
Thanks guys, really helpful forum here.

[wheelz]

@marcelloc:

The ldap fetch is done by dansguardian_ldap.PHP

It's not from dansguardian configuration.

How users are listed on dansguardian user tab?

That tab just has the user name as well.  Interestingly enough there is a user there that I did not put in.  In my AD group I have two users.  The one I was testing with and another one.  The other one is listed.  I'm guessing that maybe it was working at one point and now is not updating since I think I added the second user (the one I was testing with) to it later…  Is there a log for the ldap fetch?

[marcelloc]

@wheelz:

Is there a log for the ldap fetch?

No but you can run it on console/ssh and see the output.

php /usr/local/www/dansguardian_ldap.php

[wheelz]

Here is my output:

Content-type: text/html

Group : pfsenseUsers

Warning: ldap_search(): Search: Bad search filter in /usr/local/www/dansguardian_ldap.php on line 77

Warning: ldap_get_entries(): supplied argument is not a valid ldap result resource in /usr/local/www/dansguardian_ldap.php on line 78

[marcelloc]

Clean your pfsenseUsers list on dansguardian config and run it again.

When script find new config it show a message.

[wheelz]

I've done some testing and it seems like there might be a couple bugs…  It works for the most part, however for some reason it never adds one user account (the one I was testing with).  However, the total number of users (in the dansguardian group title over the user list, in parenthesis) does add one to the total count even though it doesn't show up in the list (except when no other users are in the group).  But if I remove the problem account from the AD group, the total user account for for that group doesn't go down in pfsense.  I have no idea what is different about this one account that would cause it to have a problem with it.  Also the warnings only show up when the problem account is in the AD group.

Now all other accounts I have tried adding and removing works except if you remove all users from the AD group.  As soon as the AD group is empty, the user list in dansguardian is frozen as it was before the AD group was empty (never removes them).  In this case the command line never returns this message like it usually would with a change:

user list from LDAP is different from current group, applying new configuration…done

So sounds like 2 bugs possibly?  One that only shows up for an account if there is a yet unknown specific circumstance.  And another on that doesn't make the change if all users have been removed from the AD group.

[wheelz]

I just figured out what was different on that one account.  Apparently the script can't handle () characters in the distinguished name.  After renaming without the () characters, it is working.  Ideally all characters that AD supports should be handled but that could be MS diverging from LDAP standards too… so depending on if it is in the LDAP standards it may or may not make sense to fix that (of if you just want to avoid possible AD issues).

The other issue of not updating after the AD group is empty still happens though.  Easy enough to work around (delete it from pfsense) but something to put on the list to fix.

[marcelloc]

@wheelz:

I just figured out what was different on that one account.  Apparently the script can't handle () characters in the distinguished name.  After renaming without the () characters, it is working.  Ideally all characters that AD supports should be handled but that could be MS diverging from LDAP standards too… so depending on if it is in the LDAP standards it may or may not make sense to fix that (of if you just want to avoid possible AD issues).

This script running for squidguard breaks xml with special characters. On dansguardian, the config filed for users are base64 encoded, so you can fetch it but will not apply correctly. My suggestion is to work around this limitation by do no use characters other then [a-z,A-Z,0-9].

@wheelz:

The other issue of not updating after the AD group is empty still happens though.  Easy enough to work around (delete it from pfsense) but something to put on the list to fix.

It makes sense. if there is no users on groups, then there is no loop to do. :P

[wheelz]

It makes sense. if there is no users on groups, then there is no loop to do. Tongue

I don't think you got what I meant.  So I add a user to the AD group; it adds a user in pfsense/dansguardian.  I then remove that user from the AD group; it does nothing so the user still exists in pfsense/dansguardian.  If I add 10 users, it adds 10.  If I then remove all 10 users at once, all 10 users remain in pfsense/dansguardian.  So you can never remove access for all users via an AD group.  At best you can remove 9 first, but then you will always have that 1 left that won't get removed (unless you do it in the pfsense gui).

Like I said, easy work around but still a bug.  ;)

[marcelloc]

I understood you, I was just explaining why there was no update on empty groups  :)

[wheelz]

So I was able to get the newer version of squid by loading the squid-reverse package after dansguardian however there are issues with this.  For some reason squid then can't start on its own after boot up.  I have to run /usr/local/etc/rc.d/squid.sh start and then it will start (doesn't work from the GUI).  Also sarg can't find the dansguardian log (could before).  Since there are issues with this way, it sounds like I'll have to wait until that is updated before I use this setup.

Also how is the dansguardian patch coming?  That is the other thing I think I need to wait on as I will have both ntlm and IP authenticated users and can't use both authplugins at the moment.  What are you running into with the patch?  Perhaps I could help figure something out?

Thanks marcelloc for all the great work you are doing!

[marcelloc]

@wheelz:

So I was able to get the newer version of squid by loading the squid-reverse package after dansguardian however there are issues with this.  For some reason squid then can't start on its own after boot up.  I have to run /usr/local/etc/rc.d/squid.sh start and then it will start (doesn't work from the GUI).  Also sarg can't find the dansguardian log (could before).  Since there are issues with this way, it sounds like I'll have to wait until that is updated before I use this setup.

It's working for me.
I did dansguardian install and then squid-reverse install.
something I've added was a cron job to check squid status. when offline, script runs /usr/local/sbin/squid

@wheelz:

Also how is the dansguardian patch coming?  That is the other thing I think I need to wait on as I will have both ntlm and IP authenticated users and can't use both authplugins at the moment.  What are you running into with the patch?  Perhaps I could help figure something out?

I'm still getting alloc erros on dansguardian while trying to compile it with squid3 and multi plugin patch.

[elemay]

SSL filtering working now?