E2guardian package for pfsense - $??

aGeekhere · Aug 19, 2015, 3:59 AM

"(^http://[0-9a-z]+.google.[a-z]+[-/%.0-9a-z]/images?)"->"\1safe=vss&"
"(^http://[0-9a-z]+.google.[a-z]+[-/%.0-9a-z]/search?)"->"\1safe=vss&"
"(^http://[0-9a-z]+.google.[a-z]+[-/%.0-9a-z]*/s?)"->"\1safe=vss&"

vss = very safe search

That could be a starting point, maybe even add youtube, yahoo, bing and other search engines (this would be a nice option in the E2guardian menu), will try out the manual way once E2guardian is out in the package.

~~I got it to work on youtube (it now shows restricted mode on at the bottom).~~
~~Spoke too soon, it stopped working.~~
Ok youtube working now, ~~however not google~~ working nows

however it did not work for google search (in search settings "turn on safe mode" is unticked).

Mobile_Bob · Aug 24, 2015, 4:42 PM

Not sure if this is known, but it seems that the SSLIMITM is not currently working. I had SSLIMITM setup on Squid and it was working fine, I added E2Guardian to the mix and turned on SSLIMITM and it stopped working. Maybe it was chaining the two together I don't know… I did notice that E2Guardian 3.2.0 was just released and in the notes was "SSLIMITM is now fully functional in explicit proxy mode". I'm not sure if that means that the current version is broken or.... I'm guessing it's going to be a little bit of time before E2Guardian update makes it's way over to FreeBSD...

Does anyone know the correct config for SSLIMITM? I'm using explicit so this isn't a transparent issue... My question is should I have problems with E2Guardian diong the SSL Man in the Middle AND Squid also doing the SSL Man in the Middle??? Should one be on and one be off? Or is there some other setting?

marcelloc · Aug 24, 2015, 4:49 PM

@Mobile_Bob:

Not sure if this is known, but it seems that the SSLIMITM is not currently working.

Current e2guardian version for Freebsd does not have SSLMITM code.

doktornotor · Aug 24, 2015, 4:56 PM

And that's a good thing. :P

Mobile_Bob · Aug 24, 2015, 5:07 PM

@doktornotor:

And that's a good thing. :P

So are you suggesting that there is a better way?? Or that you just don't like filtering HTTPS communication at all??? If it's the latter I totally get that stand and agree, but unfortunately at a school it's just not possible to ignore HTTPS traffic and not filter it… Not to mention the need for caching (Low bandwidth)....

Is there a way, for now, to pass SSL onto Squid and have Squid do the SSLIMITM so I can at least still cache???

doktornotor · Aug 24, 2015, 5:51 PM

MITM is evil. Period.

heper · Aug 24, 2015, 10:58 PM

caching is fairly useless for the majority of the popular sites. dynamic content is a pain to cache. perhaps after some tweaking you'll manage a 5% hitrate at a typical school.

mitm ssl is essentially destroying ssl altogether. you say it's impossible to ignore https in schools ? i know personally of +30 schools that don't mitm their pupils …. they have rights too, privacy is one of them.
what about the evil_x_url? you do have teachers present right?

Mobile_Bob · Aug 25, 2015, 12:44 AM

Look I get it… I'm a privacy advocate myself, but not in this case... First off Caching is way higher then 5% for my use case, because 90% of the sites they are visiting will have a ton of static images and the sites are visited by multiple classes because they are education related. Second these are kids under the age of 15 using school provided computers for school related activities. They get no privacy because the computers are not to be used for private use. Teachers are present, but no one teacher can watch all computers all the time. There are reasons for having to man in the middle ssl connections. MITM hacks are not good, I get that and I don't like it either. But until they come up with a standard that allows for voluntary interception of secured communication (such as an https proxy where the man in the middle is expected and requested), MITM "hacks" will have to do.

Oh and https://www.fcc.gov/guides/childrens-internet-protection-act

heper · Aug 26, 2015, 11:12 AM

have you considered ip blacklists? the paid subscriptions generally filter out most of the crap.

afaik squid3 can be made to work with ssl … once you get the falsified certs deployed to every client, it might work.
then you'll have to go around and install the certs on every cellphone/tablet/laptop of every student ... good luck with that.

governments are allways wrong.

Mobile_Bob · Aug 26, 2015, 1:02 PM

@heper:

have you considered ip blacklists? the paid subscriptions generally filter out most of the crap.

afaik squid3 can be made to work with ssl … once you get the falsified certs deployed to every client, it might work.
then you'll have to go around and install the certs on every cellphone/tablet/laptop of every student ... good luck with that.

governments are always wrong.

Governments are often wrong I agree :) The network is locked down to only authorized devices so no problems with the certs either… Google itself is another reason I have to do this, wish they had a better method... https://support.google.com/a/answer/1668854?hl=en

I have Squid working with SSL, but does anyone know if it will be an issue having the ssl traffic running encrypted through E2Guardian first? Not sure if squid will still be able to deal with the SSL traffic correctly if it's second in the chain (first E2guardian doing a basic URL filter, then Squid for caching)... I thought about pushing ssl traffic directly to squid through a PAC script, but then I lose URL filtering... I could add Squid guard for that, but that just sounds like a mess of stuff to go wrong...

aGeekhere · Aug 27, 2015, 12:27 AM

can't a wpad be used here? Not having an issue filtering https sites with it (only google/other search engines images is a pain to filter).

Mobile_Bob · Aug 27, 2015, 2:32 PM

@aGeekHere:

can't a wpad be used here? Not having an issue filtering https sites with it (only google/other search engines images is a pain to filter).

I was thinking along those lines, but I would be skipping the URL filter completely for any HTTPS sites… Such as Anonymous proxy https sites etc... I'll play some more with it, it's possible that I can go through E2Guardian encrypted then have Squid decrypt for caching... Unless i'm misunderstanding your intended use of wpad...

Google is taken care of by using the DNS redirect, and I registered our school's IP address with bing so both are locked to safe search. All other search engines are just blocked...

aGeekhere · Aug 28, 2015, 1:10 AM

Such as Anonymous proxy https sites etc

I block Anonymous proxy websites in squidguard to solve that.

Google is taken care of by using the DNS redirect

What method did you use to redirect all google domains? see https://forum.pfsense.org/index.php?topic=97948.0

and I registered our school's IP address with bing so both are locked to safe search

Home users are out of luck here :(

search engines are just blocked

How is this achieved? must be a big list as there are many search engines (each search engine could have many domains), what if new ones come up?

Mobile_Bob · Aug 28, 2015, 7:32 PM

@aGeekHere:

I block Anonymous proxy websites in squidguard to solve that.

Thats what i'm using E2Guardian for. But i'm worried I won't be able to use both SSL interception on Squid, and keep it running through E2Guardian first… I'll let you know how it goes.

What method did you use to redirect all google domains? see https://forum.pfsense.org/index.php?topic=97948.0

I used the method I described back a couple of pages on this thread. DNS override

How is this achieved? must be a big list as there are many search engines (each search engine could have many domains), what if new ones come up?

Again since i'm using E2Guardian, I just added search engines to the site block list. I made specific exceptions for google and bing since they are set to safe search.

bfrost · Sep 1, 2015, 6:22 PM

When/How does this package make it to the 'menu' of available packages?

aGeekhere · Sep 7, 2015, 11:26 AM

Will this still be E2guardian 2.2 or will it be a later version? as they are up to version 3.2.0 now

marcelloc · Sep 7, 2015, 7:33 PM

@aGeekHere:

Will this still be E2guardian 2.2 or will it be a later version? as they are up to version 3.2.0 now

For now, e2guardian 3.0.4

bfrost · Sep 9, 2015, 1:47 PM

@bfrost:

When/How does this package make it to the 'menu' of available packages?

Am I being dense? Do we wait for a new version of pfsense to be released before we see this on the menu of Install-able Apps?

aGeekhere · Sep 17, 2015, 3:37 AM

How is the performance of E2guardian vs dansguardian in pfsense?

doktornotor · Sep 17, 2015, 10:11 AM

How do you want to compare performance between two packages out of which one does not work any more (without tons of manual hack) and the other does not work yet (without tons of manual hacks)? Cannot see how's that even a factor here ATM. Not to mention, DG is dead code upstream.