Problem with web uploads in new dansguardian 2.12.0.3

Phobia

Hi again,

So I'm still having trouble with the process from earlier in this thread that fetches the new executable via fetch.

Via SSH I did :

1. killall dansguardian
2. cd /usr/local/sbin
3. fetch http://e-sac.sitesguro.ws/pfsense/8/dansguardian

I noted Neil's earlier post, so I also:

4. chmod 555 dansguardian
5. cd /usr/local/etc/rc.d
6. ./dansguardian.sh start

I then restarted the process from the GUI (Status>Services>Dansguardian) Seeing no improvement, I also rebooted the firewall (pfSense) box.

I still see very slow browsing performance, and DG no longer seems to respond to the configuration changes I make in the pfSense GUI. I've tried clicking through each tab and clicking save thinking that there could be a new configuration version or something, but it still doesn't seem to want to work.

What is stranger, is that DG starts blocking things that couldn't possibly match what I've defined, which is essentially to only block pornography. It even started blocking sites I used to originally learn about the solution:

http://old.theninjageek.co.za/2013/07/02/pfsense-squid3-and-dansguardian-a-better-alternative-to-squidguard/

For now, I'm back to the "stock" package available through the pfSense GUI. I'm running:

2.1-RELEASE (i386)
built on Wed Sep 11 18:16:50 EDT 2013
FreeBSD 8.3-RELEASE-p11

Dansguardian Services 2.12.0.3 pkg v.0.1.8
squid3 Network 3.1.20 pkg 2.0.6

If anybody has some other tips to try, please let me know!

Thanks,

Phob

timthetortoise

It appears this is still an issue in the latest release. I've tried the new binary fix, and it seems to hose the DG install beyond repair, resulting in having to completely remove and reinstall the DG package.

rjcrowder

@timthetortoise:

It appears this is still an issue in the latest release. I've tried the new binary fix, and it seems to hose the DG install beyond repair, resulting in having to completely remove and reinstall the DG package.

Works fine if you do the following:
1.) download the fixed dansguardian file
2.) extract the dansguardian executable
3.) stop dansguardian
4.) copy the new executable over the old one
5.) start dansguardian

Make sure you download the proper fixed dg. I saw some posts where someone was installing the wrong binary (32 bit vs. 64 bit).

timthetortoise

Indeed that was what I did. It then complained that it couldn't find dansguardian.pbiopt, and couldn't load any of the filter files. I'm guessing the patched executable wants the /usr/local/blahblahblah instead of /usr/pbi/blahblahblah directory.

Edit: To be more precise, here is my log when I start DG after using the patched amd64 binary:


Oct  3 11:20:02 firewall php: dansguardian_ldap.php: Starting Dansguardian
Oct  3 11:20:02 firewall dansguardian[58327]: Error reading /usr/local/etc/dansguardian/dansguardianf3.conf
Oct  3 11:20:02 firewall dansguardian[58327]: Error opening filter group config: /usr/local/etc/dansguardian/dansguardianf3.conf
Oct  3 11:20:02 firewall dansguardian[58327]: Error reading filter group conf file(s).
Oct  3 11:20:02 firewall dansguardian[58327]: Error parsing the dansguardian.conf file or other DansGuardian configuration files
Oct  3 11:20:02 firewall root: /usr/local/etc/rc.d/dansguardian.sh: WARNING: failed to start dansguardian
Oct  3 11:20:02 firewall php: dansguardian_ldap.php: The command '/usr/local/etc/rc.d/dansguardian.sh start' returned exit code '1', the output was 'kern.ipc.somaxconn: 16384 -> 16384 kern.maxfiles: 131072 -> 131072 kern.maxfilesperproc: 104856 -> 104856 kern.threads.max_threads_per_proc: 4096 -> 4096 Starting dansguardian. Error reading: /usr/local/etc/dansguardian/dansguardianf3.conf Error opening filter group config: /usr/local/etc/dansguardian/dansguardianf3.conf Error reading filter group conf file(s). Error parsing the dansguardian.conf file or other DansGuardian configuration files /usr/local/etc/rc.d/dansguardian.sh: WARNING: failed to start dansguardian'

I will be testing this on a different VM to see if this is amd64-specific, but it does not happen on a test 386 box.

Edit2: not sure what the deal is on my production system, but it worked fine on my new amd64 install.
I ended up fixing it with this command-set:


rm -rf /usr/local/etc/dansguardian
ln -s /usr/pbi/dansguardian/etc/dansguardian /usr/local/etc/dansguardian
killall dansguardian
cd /usr/local/sbin
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/dansguardian
/usr/local/etc/rc.d/dansguardian.sh start

Now to test whether uploads are fixed or not!

Edit3: Test

Edit4: Hooray, it's fixed! Many thanks for the modified binary.

rjcrowder

Yea… I was just in the process of posting back about the sym links. Glad you got it working!

wheelz

I had to make a slight adjustment to what timthetortoise did for x64 on 2.1:

rm -rf /usr/local/etc/dansguardian
ln -s /usr/pbi/dansguardian-amd64/etc/dansguardian /usr/local/etc/dansguardian
killall dansguardian
cd /usr/local/sbin
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/dansguardian
chmod +x /usr/local/sbin/dansguardian
/usr/local/etc/rc.d/dansguardian.sh start

and now I am uploading this post via dansguardian. ;D

timthetortoise

Oops, forgot about chmod +x! Good call!

marcelloc

It will need to push a fix to freebsd ports before a new compile run.

To have more then 1024 clients it also needs some changes on freebsd too.

I'll try again to build a new pbi and put on my repo.

timthetortoise

As an addition to previous instructions, if you are doing automatic blacklist updates you will also want to overwrite /usr/pbi/dansguardian-xxx/sbin/dansguardian with this one, as that's what is used in the blacklist update script.

rjcrowder

@timthetortoise:

As an addition to previous instructions, if you are doing automatic blacklist updates you will also want to overwrite /usr/pbi/dansguardian-xxx/sbin/dansguardian with this one, as that's what is used in the blacklist update script.

OK… here's how my insall looks...

dansguardian executable is /usr/pbi/dansguardian-amd64/sbin/dansguardian

There is a "hard link"
/usr/pbi/dansguardian-amd64/.sbin/dansguardian --> /usr/pbi/dansguardian-amd64/sbin
There is a symbolic link
/usr/local/sbin/dansguardian --> /usr/pbi/dansguardian-amd64/.sbin/dansguardian

So... if I'm understanding this correctly, you really only need to replace one file...
/usr/pbi/dansguardian-amd64/sbin/dansguardian

rjcrowder

OK… it seems that I was wrong...

I have no idea what the file "/usr/pbi/dansguardian-amd64/.sbin/dansguardian" is... it is not a hard link. However it is a lot smaller than the dansguardian executable located in the "sbin" directory... AND, it seems to execute whatever you put in the "sbin" directory.

In other words... it acts like a hard link - but it isn't. Anyone know what it is?

Update: It appears that all installed packages have a ".sbin" directory and an executable in them that links back to the exe in the "sbin" directory. Squid has the same thing... and the squid executable in ".sbin" is the same size as the dansguardian executable in ".sbin". Is this some kind of dynamically linked exe or something?

rjcrowder

I was just wondering if the "web upload" problem has been fixed in the package that is available from the pfSense repository? Does anyone know? Or do we still need to overwrite it with the one directly from Marcello? Thanks!

cnd.fflv

Till last week (I did fresh installation on Jan 20th) it had the same problem - issue was not fixed so far… :(

dvosburg

Here is the fix for 32-bit, applied today (01/28/2014) and it worked beautifully:

rm -rf /usr/local/etc/dansguardian
ln -s /usr/pbi/dansguardian-i386/etc/dansguardian /usr/local/etc/dansguardian
killall dansguardian
cd /usr/local/sbin
fetch http://e-sac.siteseguro.ws/pfsense/8/dansguardian
chmod +x /usr/local/sbin/dansguardian
/usr/local/etc/rc.d/dansguardian.sh start

timthetortoise

Please note that you actually want the executable in the /usr/pbi/dansguardian-xxx/sbin folder and not /usr/local/sbin. It is only actually launched in scripts from the /usr/pbi folder (and /usr/local/sbin/dansguardian should be a symlink to the PBI executable).

cnd.fflv

Hi there.

Actually, it seems like you do not need to delete /usr/local/etc/dansguardian and make a soft link after that.

I just replaced /usr/pbi/dansguardian-i386/sbin/dansguardian with provided one (fetch http://e-sac.siteseguro.ws/pfsense/8/dansguardian), made it executable, restart DG and it works fine. I am uploading this post after above operations.

PS. but I still did killall dansguardian before…

cirkit

@marcelloc:

I've fixed the code. ;D

The patch 11 was malformed and broke up web upload check.

I did not pushed it to dansguardian devel or freebsd patch yet.

Test my dansguardian package and see if it works

I've also included the code to limit upload size(was not working on 2.12.0.2 AFAIK)

amd64
http://e-sac.siteseguro.ws/packages/amd64/8/All/dansguardian-2.12.0.3_1.tbz

i386
http://e-sac.siteseguro.ws/packages/8/All/dansguardian-2.12.0.3_1.tbz

Do not forget to kill dansguardian process before trying new packge binaries.

The above patched version worked perfect but since 9th april 2014 the available packages webpage within pfsense shows only 2.12.0.3_2 version which is partially broken and gives errors of contentscanner directories missing while booting…also start/ stop /restart of dansguardian from ssh via /usr/local/etc/rc.d/dansguardian.sh also reports errors..Pl restore the 2.12.0.3_1 link in the available packages so everything works fine again

Thanks

rjcrowder

It seems that the problem with /usr/local/etc/rc.d/dansguardian.sh is that it is looking for "/usr/local/sbin/dansguardian" in the process name. However, the process name is being created with "/usr/pbi/dansguardian-amd64/sbin"…

Not sure why... A temporary workaround would be to edit the file /usr/local/pkg/dansguardian_rc.template and change the path in the variable "command" (line number 29)

Change
command="/usr/local/sbin/${name}"
to
command="/usr/pbi/dansguardian-amd64/sbin/${name}"

Note that if you are running the 32 bit version or "i386" you would put that instead of "amd64"... Anyway - make the above change and reboot. Script should work now.

Not having much luck figuring out the other startup errors...

cirkit

Yes after the changes the script worked to start / stop /restart dansguardian.
Couple of issues still remain unresolved i.e

During startup the package complains about missing exceptionviruslist files in /usr/pbi/dansguardian-amd64/etc/dansguardian/lists
Its also complains about missing clamd.conf file
Webupload banned

Pl help
cirkit

rjcrowder

@cirkit:

During startup the package complains about missing exceptionviruslist files in /usr/pbi/dansguardian-amd64/etc/dansguardian/lists

Its also complains about missing clamd.conf file

I haven't figured these two out yet, but if I have time I will look over the weekend.

@cirkit:

Webupload banned

This can be fixed by overwriting the dansguardian executable with a different version… look through previos posts in this same thread.

Marcello - are you watching these posts? Any chance you could make changes quickly or simply roll back the version? Thanks!!!