Dansguardian package for 2.0
-
After forwarding it to dansguardian, all requests will be from 127.0.0.1 instead of client IP.
You can create balance/fail over rules for all requests but not based on client IP.
-
After forwarding it to dansguardian, all requests will be from 127.0.0.1 instead of client IP.
You can create balance/fail over rules for all requests but not based on client IP.
What did you mean by that? Our WAN1 is solely for all computers in our office and WAN2 is dedicated for our servers, so we do not want to use load balancing for all computers.
-
I mean that you can create rules for all proxy(squid,dansguardian,etc,…) requests at floating rules tab but not based on client IP as it will have 127.0.0.1 as source address.
-
I mean that you can create rules for all proxy(squid,dansguardian,etc,…) requests at floating rules tab but not based on client IP as it will have 127.0.0.1 as source address.
Is it on source address and port or destination address and port for floating rule? Do I need to set the gateway for the floating rule?
-
I still have problem with the gateway configuration on dansguardian, we really want to use two gateways at the same time based on the gateway rules set for specific client computers and servers…
-
I still have problem with the gateway configuration on dansguardian, we really want to use two gateways at the same time based on the gateway rules set for specific client computers and servers…
This is not a dansguardian/pfsense problem, it's a project conception problem/mistake. Any proxy you configure on gateway/firewall will do the same way.
-
I still have problem with the gateway configuration on dansguardian, we really want to use two gateways at the same time based on the gateway rules set for specific client computers and servers…
This is not a dansguardian/pfsense problem, it's a project conception problem/mistake. Any proxy you configure on gateway/firewall will do the same way.
So, you mean that our plan to use both gateways (dual wan) at the same time with dansguardian will not work? We do not have intention to use the proxy, the only we need is the blocking feature of dansguardian on one pfsense server only.
-
This came back on my topic list recently. I just did an install with Dansguardian using SSO for NTLM authentication and made a bunch of notes (hopefully in the next week). Once I make them generic and presentable I will post them for everyone's benefit. I wanted to check back on the multiple authentication methods patch to see if there has been any progress on that. I know with all the tablets that it would be good to use both NTLM and IP address depending on if it is a windows box or something that is not logged into with a user name like a tablet.
Also for analysis of the logs is SARG the best tool for Dansguardian logs? Also is there anything that might be able to send reports out via email (not sure if this is built into SARG or not).
-
I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…
This came back on my topic list recently. I just did an install with Dansguardian using SSO for NTLM authentication and made a bunch of notes (hopefully in the next week). Once I make them generic and presentable I will post them for everyone's benefit. I wanted to check back on the multiple authentication methods patch to see if there has been any progress on that. I know with all the tablets that it would be good to use both NTLM and IP address depending on if it is a windows box or something that is not logged into with a user name like a tablet.
Also for analysis of the logs is SARG the best tool for Dansguardian logs? Also is there anything that might be able to send reports out via email (not sure if this is built into SARG or not).
-
I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…
I don't suppose you have a how to or list of steps? If so, I'd give it a whirl because I am also a little underwhelmed with SARG.
-
So, you mean that our plan to use both gateways (dual wan) at the same time with dansguardian will not work?
Will work, all traffic can go with loadbalance/failover but not based on source address.
-
-
Actually, it was pretty easy. I just downloaded the webmin minimal install version, uncompressed it to /usr/local and ran the setup script. You will need to adjust some of the directories that it prompts you for when the script is executing. It created a startup shell script automatically and started listening on port 10000. Then just manually download the dansguardian webmin module and add it via the webmin screen. You'll also need to go in and adjust the dansguardian directories under the dansguardian webmin config.
I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…
I don't suppose you have a how to or list of steps? If so, I'd give it a whirl because I am also a little underwhelmed with SARG.
-
I have my how to for the SSO almost done. I was trying to get it working on a CARP pair when I ran into an issue. First the sync throws some errors (even though it does sync the settings). Here is the messages:
Jan 5 19:29:48 php: : Filter sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:46 php: : XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:45 php: : Beginning XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 5 19:29:45 php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Include dansguardian config
Jan 5 19:29:43 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.
Jan 5 19:29:43 php: /pkg_edit.php: Reloading DansguardianAlso everything works great when running off the master, but as soon as I force a failover to the slave, dansguardian doesn't work. I checked the firewall rules and it is letting it through. It is just as if dansguardian isn't listening (the NAT back to the loopback is there though and I even tried opening direct to the main IP and still no go on the slave). Also if I configure just squid, both on the master and failed over to the slave works. Any ideas? I am at a bit of a loss because all the settings are syncing (though I get that sync error) so I'm not sure how one works and the other doesn't because they have the exact same settings. Also I tried reinstalling everything from scratch on the slave again and it still did the exact same thing. Any ideas?
-
I also get the same error when i try to sync the dansguardian config
Jan 7 13:27:51 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending. Jan 7 13:27:51 php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload Jan 7 13:27:51 php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload Jan 7 13:27:47 php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443. Jan 7 13:27:47 php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443. Jan 7 13:27:41 php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443. Jan 7 13:27:41 php: /pkg_edit.php: Include dansguardian config Jan 7 13:27:41 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.
-
I also get the same error when i try to sync the dansguardian config
Jan 7 13:27:51 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending. Jan 7 13:27:51 php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload Jan 7 13:27:51 php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload Jan 7 13:27:47 php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443. Jan 7 13:27:47 php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443. Jan 7 13:27:41 php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443. Jan 7 13:27:41 php: /pkg_edit.php: Include dansguardian config Jan 7 13:27:41 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.
I see that same line 823 error as well sometimes. I think that was the point where I tried to start over from scratch but doesn't seemed to have resolved it.
-
Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…
-
Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…
Try to call sync function from a php on console, if it returns any text message, xml sync will fail.
-
Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…
Try to call sync function from a php on console, if it returns any text message, xml sync will fail.
I know I can run php at the command line but how do you call the sync function?
Also I completely wiped both servers and started over. I figured out that the dansguardian not working during failover is more a network issue for me. So the pfsync issue is completely separate. From what I can tell everything syncs fine, it just generates those errors.
-
It makes sense. if there is no users on groups, then there is no loop to do. Tongue
I don't think you got what I meant. So I add a user to the AD group; it adds a user in pfsense/dansguardian. I then remove that user from the AD group; it does nothing so the user still exists in pfsense/dansguardian. If I add 10 users, it adds 10. If I then remove all 10 users at once, all 10 users remain in pfsense/dansguardian. So you can never remove access for all users via an AD group. At best you can remove 9 first, but then you will always have that 1 left that won't get removed (unless you do it in the pfsense gui).
Like I said, easy work around but still a bug. ;)
marcelloc - I figured out the code for this and was able to get it to synchronize completely (even when the AD group is empty) by just adding a little bit of code to /usr/local/www/dansguardian_ldap.php. Here is the section (towards the end), my addition is in bold:
if (!empty($members)){
$import_users = explode("\n", $members);
asort($import_users);
$members=base64_encode(implode("\n", $import_users));
if($config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] != $members){
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = $members;
$apply_config++;
}
}
** else {
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = NULL;
$apply_config++;
}**
}
$id++;
}Is that a fix you'd be willing to add to the package? Also I noticed that there is a typo when configuring a group in the Values section. It says "Naughtiness limite" and should be "Naughtiness limit" without the 'e'. Really minor but thought I'd let you know.
