Dansguardian package for 2.0

emjhay

@emjhay:

I still have problem with the gateway configuration on dansguardian, we really want to use two gateways at the same time based on the gateway rules set for specific client computers and servers…

This is not a dansguardian/pfsense problem, it's a project conception problem/mistake. Any proxy you configure on gateway/firewall will do the same way.

So, you mean that our plan to use both gateways (dual wan) at the same time with dansguardian will not work? We do not have intention to use the proxy, the only we need is the blocking feature of dansguardian on one pfsense server only.

wheelz

This came back on my topic list recently. I just did an install with Dansguardian using SSO for NTLM authentication and made a bunch of notes (hopefully in the next week). Once I make them generic and presentable I will post them for everyone's benefit. I wanted to check back on the multiple authentication methods patch to see if there has been any progress on that. I know with all the tablets that it would be good to use both NTLM and IP address depending on if it is a windows box or something that is not logged into with a user name like a tablet.

Also for analysis of the logs is SARG the best tool for Dansguardian logs? Also is there anything that might be able to send reports out via email (not sure if this is built into SARG or not).

rjcrowder

I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…

@wheelz:

This came back on my topic list recently. I just did an install with Dansguardian using SSO for NTLM authentication and made a bunch of notes (hopefully in the next week). Once I make them generic and presentable I will post them for everyone's benefit. I wanted to check back on the multiple authentication methods patch to see if there has been any progress on that. I know with all the tablets that it would be good to use both NTLM and IP address depending on if it is a windows box or something that is not logged into with a user name like a tablet.

Also for analysis of the logs is SARG the best tool for Dansguardian logs? Also is there anything that might be able to send reports out via email (not sure if this is built into SARG or not).

wheelz

@rjcrowder:

I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…

I don't suppose you have a how to or list of steps? If so, I'd give it a whirl because I am also a little underwhelmed with SARG.

marcelloc

@emjhay:

So, you mean that our plan to use both gateways (dual wan) at the same time with dansguardian will not work?

Will work, all traffic can go with loadbalance/failover but not based on source address.

marcelloc

@wheelz:

Also for analysis of the logs is SARG the best tool for Dansguardian logs?built into SARG or not).

yes, I' guess lightsquid does not looks for dansguardian logs.

@wheelz:

Also is there anything that might be able to send reports out via email (not sure if this is

Not yet. :(

rjcrowder

Actually, it was pretty easy. I just downloaded the webmin minimal install version, uncompressed it to /usr/local and ran the setup script. You will need to adjust some of the directories that it prompts you for when the script is executing. It created a startup shell script automatically and started listening on port 10000. Then just manually download the dansguardian webmin module and add it via the webmin screen. You'll also need to go in and adjust the dansguardian directories under the dansguardian webmin config.

@wheelz:

@rjcrowder:

I tried Sarg and wasn't real happy with it. Ended up just installing a minimal version of webmin and the webmin dansguardian module…

I don't suppose you have a how to or list of steps? If so, I'd give it a whirl because I am also a little underwhelmed with SARG.

wheelz

I have my how to for the SSO almost done. I was trying to get it working on a CARP pair when I ran into an issue. First the sync throws some errors (even though it does sync the settings). Here is the messages:

Jan 5 19:29:48 php: : Filter sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:46 php: : XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:45 php: : Beginning XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 5 19:29:45 php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Include dansguardian config
Jan 5 19:29:43 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.
Jan 5 19:29:43 php: /pkg_edit.php: Reloading Dansguardian

Also everything works great when running off the master, but as soon as I force a failover to the slave, dansguardian doesn't work. I checked the firewall rules and it is letting it through. It is just as if dansguardian isn't listening (the NAT back to the loopback is there though and I even tried opening direct to the main IP and still no go on the slave). Also if I configure just squid, both on the master and failed over to the slave works. Any ideas? I am at a bit of a loss because all the settings are syncing (though I get that sync error) so I'm not sure how one works and the other doesn't because they have the exact same settings. Also I tried reinstalling everything from scratch on the slave again and it still did the exact same thing. Any ideas?

pfsenseuser3

I also get the same error when i try to sync the dansguardian config

Jan 7 13:27:51	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 7 13:27:51	php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:51	php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443.
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Include dansguardian config
Jan 7 13:27:41	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.

As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.

wheelz

@pfsenseuser3:

I also get the same error when i try to sync the dansguardian config

Jan 7 13:27:51	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 7 13:27:51	php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:51	php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443.
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Include dansguardian config
Jan 7 13:27:41	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.

As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.

I see that same line 823 error as well sometimes. I think that was the point where I tried to start over from scratch but doesn't seemed to have resolved it.

wheelz

Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…

marcelloc

@wheelz:

Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…

Try to call sync function from a php on console, if it returns any text message, xml sync will fail.

wheelz

@marcelloc:

@wheelz:

Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…

Try to call sync function from a php on console, if it returns any text message, xml sync will fail.

I know I can run php at the command line but how do you call the sync function?

Also I completely wiped both servers and started over. I figured out that the dansguardian not working during failover is more a network issue for me. So the pfsync issue is completely separate. From what I can tell everything syncs fine, it just generates those errors.

wheelz

@wheelz:

It makes sense. if there is no users on groups, then there is no loop to do. Tongue

I don't think you got what I meant. So I add a user to the AD group; it adds a user in pfsense/dansguardian. I then remove that user from the AD group; it does nothing so the user still exists in pfsense/dansguardian. If I add 10 users, it adds 10. If I then remove all 10 users at once, all 10 users remain in pfsense/dansguardian. So you can never remove access for all users via an AD group. At best you can remove 9 first, but then you will always have that 1 left that won't get removed (unless you do it in the pfsense gui).

Like I said, easy work around but still a bug. ;)

marcelloc - I figured out the code for this and was able to get it to synchronize completely (even when the AD group is empty) by just adding a little bit of code to /usr/local/www/dansguardian_ldap.php. Here is the section (towards the end), my addition is in bold:

if (!empty($members)){
$import_users = explode("\n", $members);
asort($import_users);
$members=base64_encode(implode("\n", $import_users));
if($config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] != $members){
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = $members;
$apply_config++;
}
}
** else {
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = NULL;
$apply_config++;
}**
}
$id++;
}

Is that a fix you'd be willing to add to the package? Also I noticed that there is a typo when configuring a group in the Values section. It says "Naughtiness limite" and should be "Naughtiness limit" without the 'e'. Really minor but thought I'd let you know.

marcelloc

@wheelz:

marcelloc - I figured out the code for this and was able to get it to synchronize completely (even when the AD group is empty) by just adding a little bit of code to /usr/local/www/dansguardian_ldap.php. Here is the section (towards the end), my addition is in bold:

if (!empty($members)){
$import_users = explode("\n", $members);
asort($import_users);
$members=base64_encode(implode("\n", $import_users));
if($config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] != $members){
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = $members;
$apply_config++;
}
}
** else {
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = NULL;
$apply_config++;
}**
}
$id++;
}

Is that a fix you'd be willing to add to the package? Also I noticed that there is a typo when configuring a group in the Values section. It says "Naughtiness limite" and should be "Naughtiness limit" without the 'e'. Really minor but thought I'd let you know.

Thank's for this contribution. limite is limit in portuguese :)

I'm testing dansguardian 2.12.0.2 that fixes pcre 8.3 issue and others.

I'll push it since freebsd ports core team apply my update request.

wheelz

@marcelloc:

Thank's for this contribution. limite is limit in portuguese :)

I'm testing dansguardian 2.12.0.2 that fixes pcre 8.3 issue and others.

I'll push it since freebsd ports core team apply my update request.

I see from your comments on your update request that 2.12.0.2 has memory leaks. Did they apply your update request to 2.12.0.3 instead?

marcelloc

@wheelz:

I see from your comments on your update request that 2.12.0.2 has memory leaks. Did they apply your update request to 2.12.0.3 instead?

both updates are still pending. I'll contact dansguardian maintainer to try to seep up the process. :)

wheelz

@marcelloc:

@wheelz:

I see from your comments on your update request that 2.12.0.2 has memory leaks. Did they apply your update request to 2.12.0.3 instead?

both updates are still pending. I'll contact dansguardian maintainer to try to seep up the process. :)

Sweet, it looks like they closed it out today, can't wait to test it out.

Also I can try to troubleshoot my sync issue but I still am unsure how to run it manually. I know I can run the "php" command and do a "-f /path/to/php/file" to run a file but I am not sure how to just run the sync function manually like this.

marcelloc

@wheelz:

Sweet, it looks like they closed it out today, can't wait to test it out.

I`ve sent a shar file, they asked for a diff file for 2.12.0.3

I can't confirm that 2.12.0.2 has memory leaks.

@wheelz:

Also I can try to troubleshoot my sync issue but

you will need a php that call pfsense inc files, dansguardian inc and then call sync function.

marcelloc

2.12.0.3 commited on freebsd ports :)

http://www.freebsd.org/cgi/query-pr.cgi?pr=175526