Unofficial E2guardian package for pfSense
-
I've pushed to e2guardian repo a php version of the new template and updated the perl version of the report.
With new php report, fully report works on pfSense together with wpad package.
https://github.com/e2guardian/e2guardian/pull/236
To use report fully option before it get on e2guardian and on e2guardian pfSense package, you can download the file directly from git.
e2gerror.php
https://raw.githubusercontent.com/marcelloc/e2guardian/25d06e7416c5f77c859a96988b102e76a4f09bae/data/e2gerror.phpDo not forget to add the webhost with e2gerror.php on exception site list.
Won't the php version increase the load on the server? Or is it about the same as html as the place holders are still being changed?
Also report fully allows you to see the banned words right?
Furthermore, why was WPAD package conflicting with this? They're on different ports?
Sorry about the questions, still learning a lot. :p
So far I'm really enjoying E2 Guardian and am loving the team work and where it's going. However I feel the one thing that's missing is a way to quickly see what websites are being blocked.
For example in the pfsense GUI you created, it would be really nice to have a page where you can see what content is blocked, why it's blocked. What user is trying to access what content, and being able to apply filters such as "user with most blocked sites" or be able to type in the name of a category such as gambling. And being able to see who was trying to access gambling sites, from what internal IP, host name and what time they did to access it, and of course the URL.Let me know if this can be done, I know some log files can be created. But this is a much simpler overall better way, and I'm sure other commercial products have this. I am also trying to help a friend move to E2 Guardian for their school network, in that scenario some sort of reporting with a page to quickly filter and find data is necessary. I really don't want to start suggesting bad methods of doing this such as using GREP.
But anyways, keep up the amazing work Marcello!
-
Won't the php version increase the load on the server? Or is it about the same as html as the place holders are still being changed?
Also report fully allows you to see the banned words right?
Yes, the dynamic page says it shows more details of what was blocked and allow more control and tests. For example, you can show Bypass only for groups that has a bypass.
Furthermore, why was WPAD package conflicting with this? They're on different ports?
Wpad is the best place to host a php file as it will be in HTTP and will never shows certificate erros or ssl error page cannot be displayed on http sites. These are some problems that occurs with squidguar for example. So I'm trying to implement all features we know as good practices for proxy, wpad, ssl, etc..
Sorry about the questions, still learning a lot. :p
NO problem. :)
So far I'm really enjoying E2 Guardian and am loving the team work and where it's going. However I feel the one thing that's missing is a way to quickly see what websites are being blocked.
If you want a report tool with historical stats, try squidanalyzer package on my repo. The only pre requisite is change logs to squid format.
For example in the pfsense GUI you created, it would be really nice to have a page where you can see what content is blocked, why it's blocked. What user is trying to access what content, and being able to apply filters such as "user with most blocked sites" or be able to type in the name of a category such as gambling. And being able to see who was trying to access gambling sites, from what internal IP, host name and what time they did to access it, and of course the URL.
Let me know if this can be done, I know some log files can be created. But this is a much simpler overall better way, and I'm sure other commercial products have this. I am also trying to help a friend move to E2 Guardian for their school network, in that scenario some sort of reporting with a page to quickly filter and find data is necessary. I really don't want to start suggesting bad methods of doing this such as using GREP.
Sure, I'll import the real time tab when I have time. But with the upcoming changes to use squid transparent proxy and ssl splice all, you will be abe to see most of these information (blocked but not reason given) on squid Real Time tab. On 3.5 version, there was 3 more report type, one included squid log format with extra field containing block reason.
But anyways, keep up the amazing work Marcello!
Thanks! I want to improve this package as much as I can, so nobody will need squidguard anymore. And when e2guardian 4.x code get's stable, I'll push it to freebsd ports and then submit a pull request for this package to get merged on main repo.
-
Marcelloc
How different is your squidanalyser from SARG?
Can you add a thread for this with examples? -
How different is your squidanalyser from SARG?
Can you add a thread for this with examples?You mean a new topic?
There is a topic on forum with manual install. I've joined all contributions and added a php protection file to use pfSense authentication, just like I did with sarg.
The squidanalyzer has a modern gui and some graphs
-
How different is your squidanalyser from SARG?
Can you add a thread for this with examples?You mean a new topic?
There is a topic on forum with manual install. I've joined all contributions and added a php protection file to use pfSense authentication, just like I did with sarg.
The squidanalyzer has a modern gui and some graphs
Can you provide me the search term or the direct link?
I tried squidanalyser but did not return results. -
Can you provide me the search term or the direct link?
I tried squidanalyser but did not return results.Sure. I've update it right now to include some images
Re: Want package for squidanalyzer. INSTRUCTIONS AND FILES TO INSTALL
-
Can you provide me the search term or the direct link?
I tried squidanalyser but did not return results.Sure. I've update it right now to include some images
Re: Want package for squidanalyzer. INSTRUCTIONS AND FILES TO INSTALL
Is there a way to have two squidanalyzer instances running side by side?
One for e2guardian and the other for squid.I do not like Lightsquid (I do not know why pfsense decided to favor that instead of SARG), this does not report the blocked/denied sites only the permitted sites.
Maybe manually install SARG from Freebsd for Squid, and use your Squidanalyser for e2guardian.
-
Is there a way to have two squidanalyzer instances running side by side?
One for e2guardian and the other for squid.By command line yes. Using the package not on current version.
-
Is there a way to have two squidanalyzer instances running side by side?
One for e2guardian and the other for squid.By command line yes. Using the package not on current version.
Is it posible to install SARG in pfsense?
-
Is it posible to install SARG in pfsense?
Yes. Basically, enable freebsd repo and install using pkg add
did you tried squidanalyzer package with all features enables? I have user reports working
-
Is it posible to install SARG in pfsense?
ne
Yes. Basically, enable freebsd repo and install using pkg adddid you tried squidanalyzer package with all features enables? I have user reports working
I think it might be easyer to have only one instance of everything. SARG for Squid and SquidA for E2g.
The problem with SARG is that prefer apache. I dont know how to make it work in gnix. Do you know of a wiki or tutorial to doit?
-
Do you know of a wiki or tutorial to doit?
No. I didn't tried to convert sarg from 2.2 to 2.3 yet.
-
Do you know of a wiki or tutorial to doit?
No. I didn't tried to convert sarg from 2.2 to 2.3 yet.
It will be nice to have the package with gui and all but that is not what I mean. I can doit command mode. The problem is how to set up the pfsense web server to show the reports?
I know it has to be in a different port as it wont conflict with wpad.
-
I know it has to be in a different port as it wont conflict with wpad.
Just send reports to /usr/local/www/sarg. It will not have authentication, but will work.
-
Early in the thread is mentioned that e2g can generated the log in squid format with extended field including reason of blocked.
With SARG I could not used the squid format in extended mode.
Does the squidanalyser can read this format and provide the reason of block as part of the reports? -
I found an workaround util 4.1.1 gets fixed 8)
-
Configure squid to intercept SSL connections with splice all mode (this checks only remote certificate)
-
Configure e2guardian Parent proxy Settings with your squid ssl interface configured.
Testing with steps I know that crashes the daemon but it's still alive with and without MITM.
Does this still have to be done?
If yes, can you provide a screenshot of how to do it?
-
-
Does this still have to be done?
No. Just update the package to current version and select automatic on parent mode.
Sometime the udpate process on package manager does not update binaries. If it happens, just do a uninstall and then install.
-
I'm getting some false positives with it detecting normal websites as "Japanese pornography". For example on a housing website, nothing related to porn, no Japanese at all. I had it detecting some YouTube pages as Japanese pornography too.
The actual phrase lists, and content checking I think needs a little more improvement.
-
I'm getting some false positives with it detecting normal websites as "Japanese pornography". For example on a housing website, nothing related to porn, no Japanese at all. I had it detecting some YouTube pages as Japanese pornography too.
The actual phrase lists, and content checking I think needs a little more improvement.
In the past, pfsense forum was getting a portuguese pornography status :D
-
I'm getting some false positives with it detecting normal websites as "Japanese pornography". For example on a housing website, nothing related to porn, no Japanese at all. I had it detecting some YouTube pages as Japanese pornography too.
The actual phrase lists, and content checking I think needs a little more improvement.
In the past, pfsense forum was getting a portuguese pornography status :D
Maybe we should report this on Github? It is detecting things too easily. The annoying thing is. because the configuration needs to be messed around with so much its overwhelming and hard to understand where the problem is. Is it an issue in configuration? Or E2Guardian itself. But Japanese porn is one phrase list that I know has issues, even though its needed. That is something that maybe needing looking into.
EDIT: MITM seems to have stopped working for me for some reason. I haven't been using it for a while due to some issues with Windows updates, I tried enabling it now in order to test and it isn't forging certificates.
