Dansguardian package for 2.0

marcelloc

I have sucessfull reports with squid on a Linux machine. This is the first feedback with samba on pfsense.

I'm having issues with multiplugin patch but I'm not sure if It's a squid3 issue or just the patch. I'm still working on it.

wheelz

If I get it working I'll share the whole process I did to get everything working. Perhaps some day it could be integrated into this package (or an additional package).

I did see this:

DansGuardian (but not recent versions of Squid) does not support encrypted Kerberos auth. Even if you correctly configure Squid, Samba, and IE to exchange and validate encrypted Kerberos credentials, DansGuardian will not be able to extract usernames.

This restriction does not apply to the Squid “LDAP” helper, as it handles un-encrypted Kerberos credentials in such a way that the exchange between the Broswer and Squid appears to be BASIC authentication.

on http://contentfilter.futuragts.com/wiki/doku.php?id=using_ntlm_for_user_identification

Could this be the cause of it not working? I know there was some kerberos configs in the steps I followed. If so, any ideas on work arounds?

marcelloc

you may want to try just the samba config options and no kerberos.

wheelz

Hmm…. I see a few other articles about this kind of setup (like http://www.petespcs.co.uk/petespcs/2011/10/dans-guardian-and-ntlm-from-active-directory/ - debian, but still…) and they mention using kerberos. This seems to indicate that other have this working. I'm wondering if it has to do with that multiple authplugin bug... I'll see what I can dig up.

abnz

@Cino:

@marcelloc:

@Cino:

i made a quick rc.d script to start dansguardian on startup..

You did a second startup or changed current script?

Can you check if dansguardian default rc script is on the same folder and what permission it has?

I didn't change the 'dansguardian' script, permissions are 755. I created 'dansguardian.sh' which basically run's '/usr/local/sbin/dansguardian -Q'

I am having the same error, dansguardian[25631]: Error connecting to proxy.

/usr/local/etc/rc.d/dansguardian

-rwxr-xr-x 1 root wheel 895 Apr 4 19:31 dansguardian

The service appears to be running but just not working.

run's '/usr/local/sbin/dansguardian -Q' makes no difference, neither a reboot.

Proxy address is 127.0.0.1 port is 3128.

squid works fine, dansguardian just doesn't seem to bind.

I tried uninstalling both squid and dansguardian, deleting conf files, reinstalling squid and testing it.

I then installed dansguardian and still doesnt work.

I suspect its because I installed dansguardian before squid and some config got screwed. I have not deleted this file before reinstalling?

Appreciate any suggestions.

Cino

its not the same error as I was having… I wasn't getting an error at all... Nothing in my logs.

What port did you setup dansguardian on?

Is squid setup to run on loopback or LAN interface?

marcelloc

@wheelz:

This seems to indicate that other have this working. I'm wondering if it has to do with that multiple authplugin bug… I'll see what I can dig up.

Try to run dansguardian on console to see if there is any running time/config erros

/usr/local/etc/rc.d/dansguardian start

wheelz

So it looks like the dansguardian package is forcing 2.7.STABLE9 of squid. I had installed squid-reverse and that loads 3.1.19. After Dansguardian it reverts it to the older version. Is there a way to make it not override existing squid versions or does the dansguardian package have to be updated with the newer squid version?

marcelloc

I could not make this on package, dansguardian force squid install.

What I'm trying to do is compile dansguardian using squid3 as a dependence.

For now, reinstall squid-reverse after you install dansguardian.

wheelz

Even after a reinstall it still has the version 2.7.STABLE9. I'm guessing both versions are installed but the older version is in the path so it gets started (maybe)? ???

Macom2007

Since i have Dansguardian running, i cant access iTunes anymore. I read i other places that Apples URIs are invalid because they end with a dot (.) Is there a way to allow this URIs ?

/usr/local/etc/rc.d/dansguardian start

kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 4096 -> 4096
dansguardian already running? (pid=6485).

There is no problem with it running, it seems stable, just not working.

marcelloc

The way I use is squid on loopback interface port 3128 and dansguardian on 8080 sending to 127.0.0.1 port 3128.

Check squid cache log to see if there's errors or warnings.

Cino

@abnz:

@Cino:

its not the same error as I was having… I wasn't getting an error at all... Nothing in my logs.

What port did you setup dansguardian on?

Is squid setup to run on loopback or LAN interface?

Dansguardian is on 8080 and squid on LAN interface 3128 default port.

I think the problem I have, dansguardian is starting before squid. I have squid listening to LAN(IPv4 and IPv6) and loopback. Dansguardian is on LAN 8080 and directs its traffic to squid loopback 3128

wheelz

SUCCESS!! ;D After much trial and error I now have SSO ntlm authentication working with squid and dansguardian on pfsense (kerberos wasn't the issue). User names are now showing up in the access.log (for both). Once I can sort through the process again and document it I will post it for everyone's benefit.

Before I do that though I would like to have it resolving AD groups to map users to filtering groups working. Right now I have an ldap configuration defined as such (the names have been changed to protect the innocent):

Hostname: dc1.domain.local
Domain: dc=domain,dc=local
Username: cn=pfsense01ldap,ou=Services,ou=myOU
Password: **********
mask: USER

I also created a test filtering group named "pfsenseUsers" which is the same name as a group in AD and pointed it to the ldap configuration above with a 2m update frequency. However a user in the pfsenseUsers group still get the "Default" filter group in the logs. Do I have the mask wrong (I wasn't sure what I needed there)? or is there something else I missed?

marcelloc

Great news wheelz! :D

Do I have the mask wrong (I wasn't sure what I needed there)? or is there something else I missed?

check how users are listed on dansguardian log and try to set it on groups.

wheelz

@marcelloc:

Great news wheelz! :D

Do I have the mask wrong (I wasn't sure what I needed there)? or is there something else I missed?

check how users are listed on dansguardian log and try to set it on groups.

It just shows the user name and that's it. What config files contain the ldap connection settings and the mapping of the filter groups to ldap connections? I can see them in the GUI but couldn't find them in the backend files like dansguardian.conf…

marcelloc

The ldap fetch is done by dansguardian_ldap.PHP

It's not from dansguardian configuration.

How users are listed on dansguardian user tab?

abnz

@marcelloc:

The way I use is squid on loopback interface port 3128 and dansguardian on 8080 sending to 127.0.0.1 port 3128.

Check squid cache log to see if there's errors or warnings.

feel like a dufus, I was sending dansguardian to loopback, but squid was listening on LAN NIC.
FYI, default config finds this innapropriate ;D
Thanks guys, really helpful forum here.