Dansguardian package for 2.0

wheelz

Here is my output:

Content-type: text/html

Group : pfsenseUsers

Warning: ldap_search(): Search: Bad search filter in /usr/local/www/dansguardian_ldap.php on line 77

Warning: ldap_get_entries(): supplied argument is not a valid ldap result resource in /usr/local/www/dansguardian_ldap.php on line 78

marcelloc

Clean your pfsenseUsers list on dansguardian config and run it again.

When script find new config it show a message.

wheelz

I've done some testing and it seems like there might be a couple bugs… It works for the most part, however for some reason it never adds one user account (the one I was testing with). However, the total number of users (in the dansguardian group title over the user list, in parenthesis) does add one to the total count even though it doesn't show up in the list (except when no other users are in the group). But if I remove the problem account from the AD group, the total user account for for that group doesn't go down in pfsense. I have no idea what is different about this one account that would cause it to have a problem with it. Also the warnings only show up when the problem account is in the AD group.

Now all other accounts I have tried adding and removing works except if you remove all users from the AD group. As soon as the AD group is empty, the user list in dansguardian is frozen as it was before the AD group was empty (never removes them). In this case the command line never returns this message like it usually would with a change:

user list from LDAP is different from current group, applying new configuration…done

So sounds like 2 bugs possibly? One that only shows up for an account if there is a yet unknown specific circumstance. And another on that doesn't make the change if all users have been removed from the AD group.

wheelz

I just figured out what was different on that one account. Apparently the script can't handle () characters in the distinguished name. After renaming without the () characters, it is working. Ideally all characters that AD supports should be handled but that could be MS diverging from LDAP standards too… so depending on if it is in the LDAP standards it may or may not make sense to fix that (of if you just want to avoid possible AD issues).

The other issue of not updating after the AD group is empty still happens though. Easy enough to work around (delete it from pfsense) but something to put on the list to fix.

marcelloc

@wheelz:

I just figured out what was different on that one account. Apparently the script can't handle () characters in the distinguished name. After renaming without the () characters, it is working. Ideally all characters that AD supports should be handled but that could be MS diverging from LDAP standards too… so depending on if it is in the LDAP standards it may or may not make sense to fix that (of if you just want to avoid possible AD issues).

This script running for squidguard breaks xml with special characters. On dansguardian, the config filed for users are base64 encoded, so you can fetch it but will not apply correctly. My suggestion is to work around this limitation by do no use characters other then [a-z,A-Z,0-9].

@wheelz:

The other issue of not updating after the AD group is empty still happens though. Easy enough to work around (delete it from pfsense) but something to put on the list to fix.

It makes sense. if there is no users on groups, then there is no loop to do. :P

wheelz

It makes sense. if there is no users on groups, then there is no loop to do. Tongue

I don't think you got what I meant. So I add a user to the AD group; it adds a user in pfsense/dansguardian. I then remove that user from the AD group; it does nothing so the user still exists in pfsense/dansguardian. If I add 10 users, it adds 10. If I then remove all 10 users at once, all 10 users remain in pfsense/dansguardian. So you can never remove access for all users via an AD group. At best you can remove 9 first, but then you will always have that 1 left that won't get removed (unless you do it in the pfsense gui).

Like I said, easy work around but still a bug. ;)

marcelloc

I understood you, I was just explaining why there was no update on empty groups :)

wheelz

So I was able to get the newer version of squid by loading the squid-reverse package after dansguardian however there are issues with this. For some reason squid then can't start on its own after boot up. I have to run /usr/local/etc/rc.d/squid.sh start and then it will start (doesn't work from the GUI). Also sarg can't find the dansguardian log (could before). Since there are issues with this way, it sounds like I'll have to wait until that is updated before I use this setup.

Also how is the dansguardian patch coming? That is the other thing I think I need to wait on as I will have both ntlm and IP authenticated users and can't use both authplugins at the moment. What are you running into with the patch? Perhaps I could help figure something out?

Thanks marcelloc for all the great work you are doing!

marcelloc

@wheelz:

So I was able to get the newer version of squid by loading the squid-reverse package after dansguardian however there are issues with this. For some reason squid then can't start on its own after boot up. I have to run /usr/local/etc/rc.d/squid.sh start and then it will start (doesn't work from the GUI). Also sarg can't find the dansguardian log (could before). Since there are issues with this way, it sounds like I'll have to wait until that is updated before I use this setup.

It's working for me.
I did dansguardian install and then squid-reverse install.
something I've added was a cron job to check squid status. when offline, script runs /usr/local/sbin/squid

@wheelz:

Also how is the dansguardian patch coming? That is the other thing I think I need to wait on as I will have both ntlm and IP authenticated users and can't use both authplugins at the moment. What are you running into with the patch? Perhaps I could help figure something out?

I'm still getting alloc erros on dansguardian while trying to compile it with squid3 and multi plugin patch.

elemay

SSL filtering working now?

marcelloc

@elemay:

SSL filtering working now?

Not yet. Same invalid cert issue.

dig1234

@elemay:

SSL filtering working now?

I am able to get past the Invalid Server Certificate error message by dropping all the recognized public CA certs in the /etc/ssl folder (along with the appropriate symlinks named with the hash value of each cert) but I'm stuck on a missing cgi script called mitm.cgi.
Daniel Barron over on the dansguardian-dev list informed me that this script has not been open sourced by smoothwall and that we would have to reverse engineer/rewrite it based on the dansguardian mitm source code.

If you want more details on how to install those certs let me know.

marcelloc

@dig1234:

If you want more details on how to install those certs let me know.

dig1234,

I've already included the ca-root package as well links to ca folder, can you test on a virtual machine if this patch results on the same point you got?

dig1234

@marcelloc:

dig1234,

I've already included the ca-root package as well links to ca folder, can you test on a virtual machine if this patch results on the same point you got?

Hi I tried this, fresh pfsense install on vmware, installed dans and squid, turned on cert check & mitm. Now I just get connection refused when trying https sites. Also in the logs I see dansguardian[17654]: error opening new certificate. So, no I am not at the same place.

One thing I noticed is that you have added the 150 public certs to /etc/ssl but they are all in one file called cert.pem. Dans wants each one to be in a separate. Also they need to be named with the hash value of the cert (or symlinks by that name). They should look something like this:
ef2f636c.0
f060240e.0
f081611a.0
f15719eb.0
f3377b1b.0

UPDATE:
I turned off mitm and left cert checking turned on and didn't get any errors so maybe it is finding the certs. The problem now is with creation of the 'forged' certs.. Is there a way to get more verbose logging from dansguardian?

abnz

I had issues and uninstalled DG, Squid, HAVP, reinstalled Dansguardian –--> HAVP ----> WWW, so no more squid.

I now get in the system logs: Dans Guardian [xxxx} "Error connecting via IPC socket to log: No such file or directory"

After a reboot Dansguardian doesnt start, it starts from web configurator fine, workd fine, just using ram I think and get this in the log quite frequently. Any one seen this?

dig1234

@abnz:

After a reboot Dansguardian doesnt start, it starts from web configurator fine, workd fine, just using ram I think and get this in the log quite frequently. Any one seen this?

I experienced the same, dans not starting on reboot but starts fine from webgui later. I attributed it to squid taking a longer time to start, but I could be wrong…

marcelloc

@dig1234:

I experienced the same, dans not starting on reboot but starts fine from webgui later. I attributed it to squid taking a longer time to start, but I could be wrong…

I've just installed a clean 2.0.1 install with dansguardian and squid3 package and I still had no luck on reproducing this issue.

Can you check what happens during your boot process?

debug_dansguardian_01.png_thumb

rjcrowder

@dig1234:

@abnz:

After a reboot Dansguardian doesnt start, it starts from web configurator fine, workd fine, just using ram I think and get this in the log quite frequently. Any one seen this?

I experienced the same, dans not starting on reboot but starts fine from webgui later. I attributed it to squid taking a longer time to start, but I could be wrong…

Same issue here and I tend to thing dig1234 is correct… has to be a timing issue - which would be different depending on the machine. That said, doesn't it make sense that DG should start after Squid anyway? DG is dependent on Squid to proxy...

Also, haven't been able to find anywhere that DG gives an error message as to why it won't start. Let me know if you have any idea where I should look.

marcelloc

@rjcrowder:

Also, haven't been able to find anywhere that DG gives an error message as to why it won't start. Let me know if you have any idea where I should look.

Can you check boot process just like I've posted?

rjcrowder

@marcelloc:

@rjcrowder:

Also, haven't been able to find anywhere that DG gives an error message as to why it won't start. Let me know if you have any idea where I should look.

Can you check boot process just like I've posted?

I couldn't figure out how you got VirtualBox bigger - so I couldn't take a screenshot showing everything… However, the boot looks the exact same as the one you posted with the exception of dansguardian not running... in other words, the ps grepping for dans does not show anything.

BTW. I noted that if you install the old version of squid, it starts before dans.