Dansguardian package for 2.0

[rjcrowder]

@namek:

@marcello,

I had a question - What is the significance/use of the "Anti-virus" TAB on the access lists in Dansguardian?
What does it do?
And the other - found a typo that you can fix the next time you update the package (Services->Dansguardian -> Access Lists -> "Phase", which I suppose should be Phrase..

UPDATE - I believe this only needs to be fixed at /usr/local/pkg/dansguardian_antivirus_acl.xml, rest of the xml files have the correct spelling.

Dans will do virus scanning using clamav. This tab makes changes to the files that control what it scans.

[emjhay]

We just had a problem with our setup, we have pfsense 2.0.1, multi-wan and dansguardian (including all per-requisite like squid). The problem is if the listening interface is on LAN all client computers will go to the gateway1 (WAN1). What we want is to be able to shift between gateway1 (WAN1) and gateway2 (WAN2/OPT1) on selected computers without interrupting the site filtering or blocking. Is there any possible solution for this problem? Just correct me if I posted it in the wrong thread…

[marcelloc]

@emjhay:

What we want is to be able to shift between gateway1 (WAN1) and gateway2 (WAN2/OPT1) on selected computers without interrupting the site filtering or blocking. Is there any possible solution for this ?

You will need one proxy for each LAN and another pfsense to balance/failover proxy access.

[emjhay]

@marcelloc:

@emjhay:

What we want is to be able to shift between gateway1 (WAN1) and gateway2 (WAN2/OPT1) on selected computers without interrupting the site filtering or blocking. Is there any possible solution for this ?

You will need one proxy for each LAN and another pfsense to balance/failover proxy access.

Is it possible in just one pfsense server, because each computers are added on the LAN rules so we could change gateway for each computers. We only have one LAN network and proxy caching is not needed on our end, the only we need on dansguardian is the filtering / blocking feature.

[marcelloc]

After forwarding it to dansguardian, all requests will be from 127.0.0.1 instead of client IP.

You can create balance/fail over rules for all requests but not based on client IP.

[emjhay]

@marcelloc:

After forwarding it to dansguardian, all requests will be from 127.0.0.1 instead of client IP.

You can create balance/fail over rules for all requests but not based on client IP.

What did you mean by that? Our WAN1 is solely for all computers in our office and WAN2 is dedicated for our servers, so we do not want to use load balancing for all computers.

[marcelloc]

I mean that you can create rules for all proxy(squid,dansguardian,etc,…) requests at floating rules tab but not based on client IP as it will have 127.0.0.1 as source address.

[emjhay]

@marcelloc:

I mean that you can create rules for all proxy(squid,dansguardian,etc,…) requests at floating rules tab but not based on client IP as it will have 127.0.0.1 as source address.

Is it on source address and port or destination address and port for floating rule? Do I need to set the gateway for the floating rule?

[emjhay]

I still have problem with the gateway configuration on dansguardian, we really want to use two gateways at the same time based on the gateway rules set for specific client computers and servers…

[marcelloc]

@emjhay:

I still have problem with the gateway configuration on dansguardian, we really want to use two gateways at the same time based on the gateway rules set for specific client computers and servers…

This is not a dansguardian/pfsense problem, it's a project conception problem/mistake. Any proxy you configure on gateway/firewall will do the same way.

[emjhay]

@marcelloc:

@emjhay:

I still have problem with the gateway configuration on dansguardian, we really want to use two gateways at the same time based on the gateway rules set for specific client computers and servers…

This is not a dansguardian/pfsense problem, it's a project conception problem/mistake. Any proxy you configure on gateway/firewall will do the same way.

So, you mean that our plan to use both gateways (dual wan) at the same time with dansguardian will not work? We do not have intention to use the proxy, the only we need is the blocking feature of dansguardian on one pfsense server only.

[wheelz]

This came back on my topic list recently.  I just did an install with Dansguardian using SSO for NTLM authentication and made a bunch of notes (hopefully in the next week).  Once I make them generic and presentable I will post them for everyone's benefit.  I wanted to check back on the multiple authentication methods patch to see if there has been any progress on that.  I know with all the tablets that it would be good to use both NTLM and IP address depending on if it is a windows box or something that is not logged into with a user name like a tablet.

Also for analysis of the logs is SARG the best tool for Dansguardian logs?  Also is there anything that might be able to send reports out via email (not sure if this is built into SARG or not).

[rjcrowder]

I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…

@wheelz:

This came back on my topic list recently.  I just did an install with Dansguardian using SSO for NTLM authentication and made a bunch of notes (hopefully in the next week).  Once I make them generic and presentable I will post them for everyone's benefit.  I wanted to check back on the multiple authentication methods patch to see if there has been any progress on that.  I know with all the tablets that it would be good to use both NTLM and IP address depending on if it is a windows box or something that is not logged into with a user name like a tablet.

Also for analysis of the logs is SARG the best tool for Dansguardian logs?  Also is there anything that might be able to send reports out via email (not sure if this is built into SARG or not).

[wheelz]

@rjcrowder:

I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…

I don't suppose you have a how to or list of steps?  If so, I'd give it a whirl because I am also a little underwhelmed with SARG.

[marcelloc]

@emjhay:

So, you mean that our plan to use both gateways (dual wan) at the same time with dansguardian will not work?

Will work, all traffic can go with loadbalance/failover but not based on source address.

[marcelloc]

@wheelz:

Also for analysis of the logs is SARG the best tool for Dansguardian logs?built into SARG or not).

yes, I' guess lightsquid does not looks for dansguardian logs.

@wheelz:

Also is there anything that might be able to send reports out via email (not sure if this is

Not yet. :(

[rjcrowder]

Actually, it was pretty easy. I just downloaded the webmin minimal install version, uncompressed it to /usr/local and ran the setup script. You will need to adjust some of the directories that it prompts you for when the script is executing. It created a startup shell script automatically and started listening on port 10000. Then just manually download the dansguardian webmin module and add it via the webmin screen. You'll also need to go in and adjust the dansguardian directories under the dansguardian webmin config.

@wheelz:

@rjcrowder:

I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…

I don't suppose you have a how to or list of steps?  If so, I'd give it a whirl because I am also a little underwhelmed with SARG.

[wheelz]

I have my how to for the SSO almost done.  I was trying to get it working on a CARP pair when I ran into an issue.  First the sync throws some errors (even though it does sync the settings).  Here is the messages:

Jan 5 19:29:48 php: : Filter sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:46 php: : XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:45 php: : Beginning XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 5 19:29:45 php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Include dansguardian config
Jan 5 19:29:43 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.
Jan 5 19:29:43 php: /pkg_edit.php: Reloading Dansguardian

Also everything works great when running off the master, but as soon as I force a failover to the slave, dansguardian doesn't work.  I checked the firewall rules and it is letting it through.  It is just as if dansguardian isn't listening (the NAT back to the loopback is there though and I even tried opening direct to the main IP and still no go on the slave).  Also if I configure just squid, both on the master and failed over to the slave works.  Any ideas?  I am at a bit of a loss because all the settings are syncing (though I get that sync error) so I'm not sure how one works and the other doesn't because they have the exact same settings.  Also I tried reinstalling everything from scratch on the slave again and it still did the exact same thing.  Any ideas?

[pfsenseuser3]

I also get the same error when i try to sync the dansguardian config

Jan 7 13:27:51	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 7 13:27:51	php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:51	php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443.
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Include dansguardian config
Jan 7 13:27:41	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.

As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.

[wheelz]

@pfsenseuser3:

I also get the same error when i try to sync the dansguardian config

Jan 7 13:27:51	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 7 13:27:51	php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:51	php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443.
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Include dansguardian config
Jan 7 13:27:41	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.

As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.

I see that same line 823 error as well sometimes.  I think that was the point where I tried to start over from scratch but doesn't seemed to have resolved it.