Squidguard-squid3 systempatch for use with squid3-dev

Tikimotel · Mar 12, 2014, 6:45 PM

This tip will help people with squidguard problems.

The package "Squid3-dev" uses version 3.3.x of Squid.
Some of the "squid.conf" options have a new syntax because of this new version.
Squidguard was developed during Squid version 2.x and so the syntax for input into "squid.conf" is based of this version.
This is not optimal.

Installed already package "Squid3-dev"
Installed already package "SquidGuard-Squid3"
Install package "system patches"
add "squidguard-fix"
test "squidguard-fix"
apply "squidguard-fix"
remove default "squidguard" settings completely from "custom settings : integrations" in "proxy server" and restart squid. (without squidguard active)
save and apply via GUI the "squidguard" settings you want.
check the "squidguard" settings in "custom settings : integrations" in "proxy server" or "squid.conf".

On package re-install (after a snapshot install for instance) only perform steps 6,7,8,9.

Here is the "patch" code for copy&paste.
See PNG attachment for file location setting information. (namely the "Base Directory" it's important)


--- squidguard_configurator.inc.orig
+++ squidguard_configurator.inc
@@ -94,3 +94,3 @@
-define('REDIRECTOR_OPTIONS_REM',   '# squidGuard options');
-define('REDIRECTOR_PROGRAM_OPT',   'redirect_program');
-define('REDIRECT_BYPASS_OPT',      'redirector_bypass');
+define('REDIRECTOR_OPTIONS_REM',   '# squidGuard options');
+define('REDIRECTOR_PROGRAM_OPT',   'url_rewrite_program');
+define('REDIRECT_BYPASS_OPT',      'url_rewrite_bypass');
@@ -98,1 +98,1 @@
-define('REDIRECTOR_PROCESS_COUNT', '5'); # redirector processes count will started
+define('REDIRECTOR_PROCESS_COUNT', '16 startup=8 idle=4 concurrency=0'); # redirector processes count will started

This should be in the "custom settings : integrations" result of saving the squidguard settings:

url_rewrite_program /usr/pbi/squidguard-squid3-amd64/bin/squidGuard -c /usr/pbi/squidguard-squid3-amd64/etc/squidGuard/squidGuard.conf;url_rewrite_bypass off;url_rewrite_children 16 startup=8 idle=4 concurrency=0

p.s.
With transparant proxy the checkbox "Disable X-Forward" should generate this code into squid.conf:

forwarded_for transparent

For now I don't use this checkbox, but put this line into "custom setting: custom options" at the bottom of the proxy settings page.

marcelloc · Mar 12, 2014, 9:54 PM

Thanks for your contribution.

wcrowder · Mar 14, 2014, 7:54 PM

Worked perfectly…

bellera · Mar 15, 2014, 7:28 PM

Can't apply the patch!

2.1-RELEASE (i386)
built on Wed Sep 11 18:16:22 EDT 2013
FreeBSD 8.3-RELEASE-p11

squid3-dev 3.3.10 pkg 2.2.1 working in transparent mode for http & https

squidGuard-squid3 1.4_4 pkg v.1.9.5 installed

System Patches 1.0 installed

/usr/bin/patch --directory=/ -t -p1 -i /var/patches/5324a53baa02c.patch --check --forward --ignore-whitespace

Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- squidguard_configurator.inc.orig
|+++ squidguard_configurator.inc
--------------------------
No file to patch.  Skipping...
Hunk #1 ignored at 94.
Hunk #2 ignored at 98.
2 out of 2 hunks ignored--saving rejects to squidguard_configurator.inc.rej
done

Is the patch not yet necessary?

Enabling squidGuard I have:

redirect_program /usr/pbi/squidguard-squid3-i386/bin/squidGuard -c /usr/pbi/squidguard-squid3-i386/etc/squidGuard/squidGuard.conf;redirector_bypass off;url_rewrite_children 5

and this is squid2 syntax.

bellera · Mar 15, 2014, 7:36 PM

My fault… Missing base directory...

[2.1-RELEASE][admin@pfsense.localdomain]/root(1): find / -name squidguard_configurator.inc
/usr/local/pkg/squidguard_configurator.inc

I'm sorry! My first time for system patches!

bellera · Mar 15, 2014, 8:28 PM

I manually made the changes. Te patch didn't worked for me.

After manual changes:

[2.1-RELEASE][admin@pfsense.localdomain]/usr/local/pkg(15): diff -upN squidguard_configurator.inc squidguard_configurator.inc.orig
--- squidguard_configurator.inc	2014-03-15 21:17:02.000000000 +0100
+++ squidguard_configurator.inc.orig	2014-03-15 20:44:59.000000000 +0100
@@ -92,10 +92,10 @@ define('CONFIG_SG_HEADER', "
 # squid config options
 # ------------------------------------------------------------------------------
 define('REDIRECTOR_OPTIONS_REM',   '# squidGuard options');
-define('REDIRECTOR_PROGRAM_OPT',   'url_rewrite_program');
-define('REDIRECT_BYPASS_OPT',      'url_rewrite_bypass');
+define('REDIRECTOR_PROGRAM_OPT',   'redirect_program');
+define('REDIRECT_BYPASS_OPT',      'redirector_bypass');
 define('REDIRECT_CHILDREN_OPT',    'url_rewrite_children');
-define('REDIRECTOR_PROCESS_COUNT', '16 startup=8 idle=4 concurrency=0'); # redirector processes count will started
+define('REDIRECTOR_PROCESS_COUNT', '5'); # redirector processes count will started

 # ------------------------------------------------------------------------------
 # squidguard config options

My Integrations box shows now:

url_rewrite_program /usr/pbi/squidguard-squid3-i386/bin/squidGuard -c /usr/pbi/squidguard-squid3-i386/etc/squidGuard/squidGuard.conf;url_rewrite_bypass off;url_rewrite_children 16 startup=8 idle=4 concurrency=0

anmr2380 · Mar 15, 2014, 11:09 PM

Saludos señores pfsense

Tengo un problema con el pfsense2.1+squid3-dev+squidguard-squid3, el problema del squid3-dev solucionado me sirvio algo que publicaron en otro foro el problema es con el squiguard-squid3 no me inicia hice lo de este foro me funciono al primer reinicio pero despues del segundo ya no sale "detenido service" volvi aplicar nuevamente los pasos del foro pero ya no inicia ,antes de que sucediera que no inicie, trate de arrancar el servicio "Clamav Antivirus" y el "Icap inteface for squid and clamav integration" pero no arrancaron de ahi reinicie y ya no arranco squidguard-squid3 :'( :-X :-\ alguna ayuda porfavor esta montado sobre vmware 10

bellera · Mar 16, 2014, 12:20 AM

Por favor, postear en inglés. Esto es un foro en lengua inglesa. ¡Gracias!

Please, post in English. This forum is in English. Thanks!

Go to Proxy filter SquidGuard: Log page: Filter config and look at your squidGuard configuration.

If you doesn't understand the configuration post it to the forum.

Tikimotel · Mar 16, 2014, 11:30 AM

@bellera:

My fault… Missing base directory...
[2.1-RELEASE][admin@pfsense.localdomain]/root(1): find / -name squidguard_configurator.inc
/usr/local/pkg/squidguard_configurator.inc
I'm sorry! My first time for system patches!

I've edited the original post to point out the base directory more and it's importance for the patch to work.

Tikimotel · Mar 16, 2014, 1:03 PM

@anmr2380:

Saludos señores pfsense

Tengo un problema con el pfsense2.1+squid3-dev+squidguard-squid3, el problema del squid3-dev solucionado me sirvio algo que publicaron en otro foro el problema es con el squiguard-squid3 no me inicia hice lo de este foro me funciono al primer reinicio pero despues del segundo ya no sale "detenido service" volvi aplicar nuevamente los pasos del foro pero ya no inicia ,antes de que sucediera que no inicie, trate de arrancar el servicio "Clamav Antivirus" y el "Icap inteface for squid and clamav integration" pero no arrancaron de ahi reinicie y ya no arranco squidguard-squid3 :'( :-X :-\ alguna ayuda porfavor esta montado sobre vmware 10

All I can say about this subject is the following:

Het Squid package is recent aangepast. De clamav functionaliteiten werken pas zeer recent en alleen in de i386 versie. Een beetje zoeken in op het forum kan geen kwaad.
Je vraag gaat totaal niet over mijn onderwerp en zal je in het forum onderwerp https://forum.pfsense.org/index.php?topic=73426.msg402098#msg402098 van Marcello terug moeten vinden en wellicht dat je daar je vraag over ipcap en clamav beter daar kan stellen.

As you can read above English is not my original language and I do my best to post on this international forum in English so that others may understand also.
Please try and accept that the English language is more internationally accepted than your own…

anmr2380 · Mar 16, 2014, 3:35 PM

Thank you for your answers, sorry for the Spanish language, English is not my native language, and sorry for the mistakes of translation to English in this message, well the squidguard-squid3 this solved error was a mistake of my understanding in this forum because as I said English is not my native language and I was applying the patch wrong, besides coming well translated to be translated into the Spanish does not alwaysgood for my version I had applied the patch that public tikimotel and was applying the de bellera, but matter well arranged, now the problem I have is that having active squidguard-squid 3 I get this error "Unable to determine the IP address from the http host name" when browsing internet, according to achievement understand not working dns translation when is active the squidguard-squid3 agredeceria your supports to fix it since I am just entering the world of pfsense come migrate from smoothwall 8) 8) 8) ;D ;D

mohanrao83 · Aug 1, 2014, 4:33 PM

@wcrowder:

Worked perfectly…

sorry,
i had do same instruction but my firewall is not filtering https.

pls help.

Tikimotel · Aug 22, 2014, 3:06 PM

Squid doesn't handle https by default.
My best guess is, if it isn't passed through the proxy it won't be passed on to the active redirector.

I don't have ssl proxy set up, so I can't tell you if the proxy will also pass https urls through the SquidGuard redirector.

aGeekhere · Oct 8, 2014, 6:15 AM

Hi all (new to pfsense)

Trying to get HTTPS filtering working.
I have followed the above steps.

I have Installed:

squid3-dev
squidGuard-squid3
System Patches

The issue I am having is squidGuard wont start with error message

php: /pkg_edit.php: The command '/usr/pbi/squid-i386/sbin/squid -k reconfigure -f /usr/pbi/squid-i386/etc/squid/squid.conf' returned exit code '1', the output was '2014/10/08 13:41:19| Warning: empty ACL: acl throttle_exts urlpath_regex -i "/var/squid/acl/throttle_exts.acl" squid: ERROR: No running copy'

Any ideas on why squidGuard wont start?

[Solved] Had to restart

[Solved] To filter https do use Enable SSL filtering? and have to give every computer a CA? is there another way?

Ok got Transparent HTTPS proxy filtering with squidGuard-squid3 and squid3-dev working :)

webstor · Oct 8, 2014, 8:58 AM

Hi mehere,

could you please post your config.
When I enable SSL filtering, squidguard is not working correctly. The service is running but it looks like squidguard is getting bypassed.

aGeekhere · Oct 9, 2014, 7:33 AM

webstor Try restarting a few times (For some strange reason it worked after a few boots). If not then make sure that:
-Network Address Translation is enabled
-Proxy interface(s) is set to lan
-Transparent Proxy interface(s) is set to lan

Let me know if that fixes it.

UPDATE: If the squid service does not want to start Cut all the content from Integrations then save then paste it back in it again.

However the issue i am having now is EVERY https site shows the warning screen or This Connection is Untrusted screen (For chrome its Your connection is not private).

This is the part that I am having trouble with "To create a CA on pfsense, go to system -> Cert Manager
Install the CA crt as an trusted ca on each computer you want to filter ssl to avoid ssl error on each connection."

I have created a CAs in System: Certificate Authority Manager then tried both the Internal and intermediate Certificate.

Tried both Certificate s in CA in SSL man in the middle Filtering.

I tried installing them in both the recommended location and also in the trusted root location, Even manually imported into chrome . This still does not fix this issue.

Any help would be great

UPDATE: I get NET::ERR_CERT_COMMON_NAME_INVALID, is pfsense creating the Certificate with the Wrong COMMON_NAME

webstor · Oct 9, 2014, 7:18 PM

Hi mehere,

squid is running fine and bumping as it should, the problem is that squidguard is bypassed because of the server side first feature which is necessary to not run into cert errors.

aGeekhere · Oct 9, 2014, 9:16 PM

Hi webstor
Where is this "server side first feature"? as I am running into https Certificate errors.

webstor · Oct 10, 2014, 8:56 AM

You have to add this to Custom ACLS (Before_Auth).

In which cert error are you running?
Have you imported the CA Cert already?

Thanx.

aGeekhere · Oct 10, 2014, 10:44 AM

If I put (Before_Auth) in Custom ACLS then I cant connect to any https website, without it I can connect however I get the warning.

I followed this to create the Certificate http://www.sxl.net/guides/how-to-setup-pfsense-ssl-certificate-authority/

So my problem is the https filtering is working however the Certificate is not

And yours is bypassing squidgard, hmm