Dansguardian package for 2.0

wheelz

I have my how to for the SSO almost done. I was trying to get it working on a CARP pair when I ran into an issue. First the sync throws some errors (even though it does sync the settings). Here is the messages:

Jan 5 19:29:48 php: : Filter sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:46 php: : XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:45 php: : Beginning XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 5 19:29:45 php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.48.125:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.48.125:443.
Jan 5 19:29:45 php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.48.125:443.
Jan 5 19:29:43 php: /pkg_edit.php: Include dansguardian config
Jan 5 19:29:43 php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.
Jan 5 19:29:43 php: /pkg_edit.php: Reloading Dansguardian

Also everything works great when running off the master, but as soon as I force a failover to the slave, dansguardian doesn't work. I checked the firewall rules and it is letting it through. It is just as if dansguardian isn't listening (the NAT back to the loopback is there though and I even tried opening direct to the main IP and still no go on the slave). Also if I configure just squid, both on the master and failed over to the slave works. Any ideas? I am at a bit of a loss because all the settings are syncing (though I get that sync error) so I'm not sure how one works and the other doesn't because they have the exact same settings. Also I tried reinstalling everything from scratch on the slave again and it still did the exact same thing. Any ideas?

pfsenseuser3

I also get the same error when i try to sync the dansguardian config

Jan 7 13:27:51	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 7 13:27:51	php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:51	php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443.
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Include dansguardian config
Jan 7 13:27:41	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.

As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.

wheelz

@pfsenseuser3:

I also get the same error when i try to sync the dansguardian config

Jan 7 13:27:51	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is ending.
Jan 7 13:27:51	php: /pkg_edit.php: New alert found: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:51	php: /pkg_edit.php: An error code was received while attempting dansguardian XMLRPC sync with https://192.168.18.254:443 - Code 2: Invalid return payload: enable debugging to examine incoming payload
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC reload data https://192.168.18.254:443.
Jan 7 13:27:47	php: /pkg_edit.php: dansguardian XMLRPC sync successfully completed with https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Beginning dansguardian XMLRPC sync to https://192.168.18.254:443.
Jan 7 13:27:41	php: /pkg_edit.php: Include dansguardian config
Jan 7 13:27:41	php: /pkg_edit.php: [dansguardian] dansguardian_xmlrpc_sync.php is starting.

As you see in the log, the config is successfully synced to the slave. After that, i tried to click the dansguardian save button on the slave and i get this error: "Fatal error: Cannot use string offset as an array in /usr/local/pkg/dansguardian.inc on line 823". Also when i try to reboot or to restart the service, dansguardian isn´t starting up anymore.

I see that same line 823 error as well sometimes. I think that was the point where I tried to start over from scratch but doesn't seemed to have resolved it.

wheelz

Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…

marcelloc

@wheelz:

Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…

Try to call sync function from a php on console, if it returns any text message, xml sync will fail.

wheelz

@marcelloc:

@wheelz:

Does anyone know how to troubleshoot these kinds of XMLRPC sync errors? I could enable debugging if I knew how but I'm not sure if the debugging information would be helpful to me or only a programmer…

Try to call sync function from a php on console, if it returns any text message, xml sync will fail.

I know I can run php at the command line but how do you call the sync function?

Also I completely wiped both servers and started over. I figured out that the dansguardian not working during failover is more a network issue for me. So the pfsync issue is completely separate. From what I can tell everything syncs fine, it just generates those errors.

wheelz

@wheelz:

It makes sense. if there is no users on groups, then there is no loop to do. Tongue

I don't think you got what I meant. So I add a user to the AD group; it adds a user in pfsense/dansguardian. I then remove that user from the AD group; it does nothing so the user still exists in pfsense/dansguardian. If I add 10 users, it adds 10. If I then remove all 10 users at once, all 10 users remain in pfsense/dansguardian. So you can never remove access for all users via an AD group. At best you can remove 9 first, but then you will always have that 1 left that won't get removed (unless you do it in the pfsense gui).

Like I said, easy work around but still a bug. ;)

marcelloc - I figured out the code for this and was able to get it to synchronize completely (even when the AD group is empty) by just adding a little bit of code to /usr/local/www/dansguardian_ldap.php. Here is the section (towards the end), my addition is in bold:

if (!empty($members)){
$import_users = explode("\n", $members);
asort($import_users);
$members=base64_encode(implode("\n", $import_users));
if($config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] != $members){
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = $members;
$apply_config++;
}
}
** else {
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = NULL;
$apply_config++;
}**
}
$id++;
}

Is that a fix you'd be willing to add to the package? Also I noticed that there is a typo when configuring a group in the Values section. It says "Naughtiness limite" and should be "Naughtiness limit" without the 'e'. Really minor but thought I'd let you know.

marcelloc

@wheelz:

marcelloc - I figured out the code for this and was able to get it to synchronize completely (even when the AD group is empty) by just adding a little bit of code to /usr/local/www/dansguardian_ldap.php. Here is the section (towards the end), my addition is in bold:

if (!empty($members)){
$import_users = explode("\n", $members);
asort($import_users);
$members=base64_encode(implode("\n", $import_users));
if($config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] != $members){
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = $members;
$apply_config++;
}
}
** else {
$config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = NULL;
$apply_config++;
}**
}
$id++;
}

Is that a fix you'd be willing to add to the package? Also I noticed that there is a typo when configuring a group in the Values section. It says "Naughtiness limite" and should be "Naughtiness limit" without the 'e'. Really minor but thought I'd let you know.

Thank's for this contribution. limite is limit in portuguese :)

I'm testing dansguardian 2.12.0.2 that fixes pcre 8.3 issue and others.

I'll push it since freebsd ports core team apply my update request.

wheelz

@marcelloc:

Thank's for this contribution. limite is limit in portuguese :)

I'm testing dansguardian 2.12.0.2 that fixes pcre 8.3 issue and others.

I'll push it since freebsd ports core team apply my update request.

I see from your comments on your update request that 2.12.0.2 has memory leaks. Did they apply your update request to 2.12.0.3 instead?

marcelloc

@wheelz:

I see from your comments on your update request that 2.12.0.2 has memory leaks. Did they apply your update request to 2.12.0.3 instead?

both updates are still pending. I'll contact dansguardian maintainer to try to seep up the process. :)

wheelz

@marcelloc:

@wheelz:

I see from your comments on your update request that 2.12.0.2 has memory leaks. Did they apply your update request to 2.12.0.3 instead?

both updates are still pending. I'll contact dansguardian maintainer to try to seep up the process. :)

Sweet, it looks like they closed it out today, can't wait to test it out.

Also I can try to troubleshoot my sync issue but I still am unsure how to run it manually. I know I can run the "php" command and do a "-f /path/to/php/file" to run a file but I am not sure how to just run the sync function manually like this.

marcelloc

@wheelz:

Sweet, it looks like they closed it out today, can't wait to test it out.

I`ve sent a shar file, they asked for a diff file for 2.12.0.3

I can't confirm that 2.12.0.2 has memory leaks.

@wheelz:

Also I can try to troubleshoot my sync issue but

you will need a php that call pfsense inc files, dansguardian inc and then call sync function.

marcelloc

2.12.0.3 commited on freebsd ports :)

http://www.freebsd.org/cgi/query-pr.cgi?pr=175526

asterix

Can't wait for the package release. Wanna jump on 2.1 bandwagon ASAP. :)

Hopefully the snort/dansguardian issue with pcre on 2.1 is rectified in this version.

marcelloc

@asterix:

Hopefully the snort/dansguardian issue with pcre on 2.1 is rectified in this version.

pcre,clamav and acls are working fine on 2.0.x and 2.1.

I'll do some more tests before package release.

wheelz

@marcelloc:

@asterix:

Hopefully the snort/dansguardian issue with pcre on 2.1 is rectified in this version.

pcre,clamav and acls are working fine on 2.0.x and 2.1.

I'll do some more tests before package release.

You da man Marcelloc. Is this package going to have squid 3 already in it or is that more a matter of how the port was done?

marcelloc

@wheelz:

Is this package going to have squid 3 already in it or is that more a matter of how the port was done?

still with the same dependencies.

marcelloc

package version 0.1.7 with dansguardian 2.12.0.3 is finally out! :)

changes/fixes

fix pcre issue
update to dansguardian latest version (2.12.0.3)
included multi auth plugin
pfsense 2.1 support
few gui changes
better ldap user auth integration

asterix

Yaahoooo !!!

Thank you ! :D

asterix

Cant get it to work..

php: /pkg_edit.php: The command '/usr/local/etc/rc.d/dansguardian.sh start' returned exit code '1', the output was 'kern.ipc.somaxconn: 16384 -> 16384 kern.maxfiles: 131072 -> 131072 kern.maxfilesperproc: 104856 -> 104856 kern.threads.max_threads_per_proc: 4096 -> 4096 Starting dansguardian. Unable to getpwnam() - does the proxy user exist? Proxy user looking for is 'clamav' /usr/local/etc/rc.d/dansguardian.sh: WARNING: failed to start dansguardian'