Unofficial E2guardian package for pfSense

[jetberrocal]

Marcelloc

How different is your squidanalyser from SARG?
Can you add a thread for this with examples?

[marcelloc]

@jetberrocal:

How different is your squidanalyser from SARG?
Can you add a thread for this with examples?

You mean a new topic?

There is a topic on forum with manual install. I've joined all contributions and added a php protection file to use pfSense authentication, just like I did with sarg.

The squidanalyzer has a modern gui and some graphs

[jetberrocal]

@marcelloc:

@jetberrocal:

How different is your squidanalyser from SARG?
Can you add a thread for this with examples?

You mean a new topic?

There is a topic on forum with manual install. I've joined all contributions and added a php protection file to use pfSense authentication, just like I did with sarg.

The squidanalyzer has a modern gui and some graphs

Can you provide me the search term or the direct link?
I tried squidanalyser but did not return results.

[marcelloc]

@jetberrocal:

Can you provide me the search term or the direct link?
I tried squidanalyser but did not return results.

Sure. I've update it right now to include some images

Re: Want package for squidanalyzer. INSTRUCTIONS AND FILES TO INSTALL

[jetberrocal]

@marcelloc:

@jetberrocal:

Can you provide me the search term or the direct link?
I tried squidanalyser but did not return results.

Sure. I've update it right now to include some images

Re: Want package for squidanalyzer. INSTRUCTIONS AND FILES TO INSTALL

Is there a way to have two squidanalyzer instances running side by side?
One for e2guardian and the other for squid.

I do not like Lightsquid (I do not know why pfsense decided to favor that instead of SARG), this does not report the blocked/denied sites only the permitted sites.

Maybe manually install SARG from Freebsd for Squid, and use your Squidanalyser for e2guardian.

[marcelloc]

@jetberrocal:

Is there a way to have two squidanalyzer instances running side by side?
One for e2guardian and the other for squid.

By command line yes. Using the package not on current version.

[jetberrocal]

@marcelloc:

@jetberrocal:

Is there a way to have two squidanalyzer instances running side by side?
One for e2guardian and the other for squid.

By command line yes. Using the package not on current version.

Is it posible to install SARG in pfsense?

[marcelloc]

@jetberrocal:

Is it posible to install SARG in pfsense?

Yes. Basically, enable freebsd repo and install using pkg add

did you tried squidanalyzer package with all features enables? I have user reports working

[jetberrocal]

@marcelloc:

@jetberrocal:

Is it posible to install SARG in pfsense?

ne
Yes. Basically, enable freebsd repo and install using pkg add

did you tried squidanalyzer package with all features enables? I have user reports working

I think it might be easyer to have only one instance of everything.  SARG for Squid and SquidA for E2g.

The problem with SARG is that prefer apache. I dont know how to make it work in gnix.  Do you know of a wiki or tutorial to doit?

[marcelloc]

@jetberrocal:

Do you know of a wiki or tutorial to doit?

No. I didn't tried to convert sarg from 2.2 to 2.3 yet.

[jetberrocal]

@marcelloc:

@jetberrocal:

Do you know of a wiki or tutorial to doit?

No. I didn't tried to convert sarg from 2.2 to 2.3 yet.

It will be nice to have the package with gui and all but that is not what I mean.  I can doit command mode. The problem is how to set up the pfsense web server to show the reports?

I know it has to be in a different port as it wont conflict with wpad.

[marcelloc]

@jetberrocal:

I know it has to be in a different port as it wont conflict with wpad.

Just send reports to /usr/local/www/sarg. It will not have authentication, but will work.

[jetberrocal]

Early in the thread is mentioned that e2g can generated the log in squid format with extended field including reason of blocked.

With SARG I could not used the squid format in extended mode.
Does the squidanalyser can read this format and provide the reason of block as part of the reports?

[jetberrocal]

@marcelloc:

I found an workaround util 4.1.1 gets fixed 8)

• Configure squid to intercept SSL connections with splice all mode (this checks only remote certificate)

• Configure e2guardian Parent proxy Settings with your squid ssl interface configured.

Testing with steps I know that crashes the daemon but it's still alive with and without MITM.

Does this still have to be done?

If yes, can you provide a screenshot of how to do it?

[marcelloc]

@jetberrocal:

Does this still have to be done?

No. Just update the package to current version and select automatic on parent mode.

Sometime the udpate process on package manager does not update binaries. If it happens, just do a uninstall and then install.

[pfsensation]

I'm getting some false positives with it detecting normal websites as "Japanese pornography". For example on a housing website, nothing related to porn, no Japanese at all. I had it detecting some YouTube pages as Japanese pornography too.

The actual phrase lists, and content checking I think needs a little more improvement.

[marcelloc]

@pfsensation:

I'm getting some false positives with it detecting normal websites as "Japanese pornography". For example on a housing website, nothing related to porn, no Japanese at all. I had it detecting some YouTube pages as Japanese pornography too.

The actual phrase lists, and content checking I think needs a little more improvement.

In the past, pfsense forum was getting a portuguese pornography status  :D

[pfsensation]

@marcelloc:

@pfsensation:

I'm getting some false positives with it detecting normal websites as "Japanese pornography". For example on a housing website, nothing related to porn, no Japanese at all. I had it detecting some YouTube pages as Japanese pornography too.

The actual phrase lists, and content checking I think needs a little more improvement.

In the past, pfsense forum was getting a portuguese pornography status  :D

Maybe we should report this on Github? It is detecting things too easily. The annoying thing is. because the configuration needs to be messed around with so much its overwhelming and hard to understand where the problem is. Is it an issue in configuration? Or E2Guardian itself. But Japanese porn is one phrase list that I know has issues, even though its needed. That is something that maybe needing looking into.

EDIT: MITM seems to have stopped working for me for some reason. I haven't been using it for a while due to some issues with Windows updates, I tried enabling it now in order to test and it isn't forging certificates.

[marcelloc]

Using fully report returns what it identified as Japanese porn?

[pfsensation]

@marcelloc:

Using fully report returns what it identified as Japanese porn?

I haven't tried it yet, want me to try? Usually for kids etc, I don't want them to see what words are being detected. I was also hoping that since we have developed a group of enthusiasts via this thread, you Marcello, myself, Jetborrocal, and others, maybe those of us who have started using HTTPS, should make a list of exclusions.

What I mean is, when using HTTPS inspection (SSL certificate forging) a lot of services just won't work, because they check to see if its the authentic certificate. For example, Facebook app, Twitter App, Snapchat, mostly the apps it seems. However, a lot of desktop programs are moving to this too, its becoming quite an annoyance, and if we still want to use these services behind the proxy. We need to stop it being intercepted and touched by E2Guardian.

Also Marcello, I think you misunderstood me last time. I meant E2 Guardian misses a good reporting system where we can see who tried to access a block site, when, and why it was blocked. Not a graph showing overall blocked sites, which is what I guess your version of Squid analyzer will do?

Furthermore, I can't change or edit the block page anymore via the GUI. I guess it's due to your php updates?