Web Filter

[Geoff]

Also I installed dansguardian from the universe/multiverse list, does this mean that if i do an apt-get upgrade it will upgrade dansguardian?

 

Yes, apt will keep dansguardian up to date.

 

Ok I think ive set it all up now and appears to be working properly. I just need to sort out the blacklist and praselist, exactly how do i do this?

 

You can get phraselist updates from The Phrase Master for free.

 

http://contentfilter.futuragts.com/phraselists/

 

You can get regular updates for your blacklists from urlblacklist.com for not very much money.

 

http://urlblacklist.com/

 

URLBlacklist also has a auto update script you can download and use as a cron job if you wish.

 

Can someone tell me what the command to find out what the versions of the different packages/software eg if i wanted to find out what version of dansguardian, how would i do it?

 

root@proxy:~# dansguardian -v
DansGuardian 2.9.7.5

Built with: '--enable-clamav' '--enable-email' '--enable-ntlm' '--enable-clamd'

[HodgeHi]

i installed censornet onto an old box and found it to be pretty simple (i'm not that great with linux, see the many threads...) to configure and run. It lets you pull the users from the ad and also scan the network for machines or import a dhcp file.

 

There is the web-based system that lets you gather reports on usage and you can also restrict PCs or users in certain groups.

 

All in all pretty good really, and authentication is through AD as well.

[apeo]

Thanks for your input, appreciate it. Ok extracted the blacklist and phraselists into the dansguardian directory now all i have to do is restart dansguardian right? i dont have to make any config changes for it to pick up the lists.. While im at it if i want to add my own list be it blacklist or phraselist how do i do it? which file do i edit? E.g. i want to ban foo.bar.com or ban the word 'NaughtyWord', how would i add it in?

[Geoff]

now all i have to do is restart dansguardian right?

 

/etc/init.d/dansguardian restart

 

Does the job but there are more gentle ways to do it (Doesn't disconnect existing client sessions).

 

dansguardian -g

 

i dont have to make any config changes for it to pick up the lists.. While im at it if i want to add my own list be it blacklist or phraselist how do i do it? which file do i edit? E.g. i want to ban foo.bar.com or ban the word 'NaughtyWord', how would i add it in?

 

Depends. There are several files in the lists folder to control differing things. You will need to edit some to make your phrase lists/black lists function.

 

Ban Lists

 

bannedextensionlist - File type extension bans. Here you can ban .exe, .mp3 etc.

 

bannedmimetypelist - File mime type extension bans. Here you can ban text/plain, application/executable, etc.

 

bannedregexpurllist - URL regular expression bans. Here you can ban parts of sites with urls matching certain words or phrases. eg

(images.google){1,}.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)

blocks google video/images. Additionally you'll want to include the 'expressions' blacklists in this file like so:

.Include

 

bannedurllist - URL Ban list. When you only need to ban part of a site. So for example you with to allow http://www.somesite.com but not http://www.somesite.com/forums you'd add the forums url here. You'll also want to include the 'urls' list from your downloaded blacklists in this file too:

.Include

 

bannediplist - IP Ban list. This prevents CLIENT machines with the listed IP's from using the proxy. So if you have a machine on ip 10.0.0.5 infested with spyware and you want to stop it from sending spam via some webform you can list its ip here and deny it internet access.

 

bannedphraselist - List of weighted phrases for the phrase match filtering. You need to include your downloaded phraselists here too:

.Include

 

bannedsitelist - List of banned domains. eg google.com. You need to include your blacklists 'domain' files here:

.Include

[apeo]

Ah ok.. right. Just one more question, you have given examples of code which im not entirely sure what to do with (bearing in mind that im a complete nix newb). :oops:

[Geoff]

Which one?

[apeo]

The .include statements, do i use it in a script or something? :?

[apeo]

Ok just figured out where the statements are.. duh.. was looking in the blacklists and phraselists.

 

Thanks for the help.

[Guest Guest]

Dont know if its been mentioned but Endian Firewall is an all in one solution hitting all of your criteria, with a nice web GUI meaning you dont even have to look at a single script or config file if you dont want to.

 

The other way, like said, is Ubuntu and then build on top of that exactly what you want, leaving oput what you dont.

 

BTW im a linux newbie and i have absolutely no problem with Ubuntu. Everything is just so easy to do. Want an app? type "apt-get install appname" and thats it, it downloads and installs all by itself

 

If the particular app you want isnt avalible as a package you will have to mess around with sourcecode, but atleast your 90% there

[apeo]

Dont know if its been mentioned but Endian Firewall is an all in one solution hitting all of your criteria, with a nice web GUI meaning you dont even have to look at a single script or config file if you dont want to.

 

The other way, like said, is Ubuntu and then build on top of that exactly what you want, leaving oput what you dont.

 

BTW im a linux newbie and i have absolutely no problem with Ubuntu. Everything is just so easy to do. Want an app? type "apt-get install appname" and thats it, it downloads and installs all by itself

 

If the particular app you want isnt avalible as a package you will have to mess around with sourcecode, but atleast your 90% there

 

Thanks for the input and i may just check that out, and yes it is easy to install software the question is which ones do you install. Ive found that there are associated software/packages/libs that could also be installed that isnt installed with the main software/package, and Ive had difficulties in finding out what they all do.

 

Anyway, I was just tweaking and generally playing around with my new web filter and it would seem that my dansguardian access logs arent showing usernames even after setting usernameidmethodntlm = on. Any ideas?

[Geoff]

Is NTLM authentication working in Squid?

[apeo]

Yes if I went direct to squid (ie port 3128) but when I switch it to dansguardian (ie port 8080) it will only show ip.

[Geoff]

Which version of Dansguardian are you using?

[apeo]

Version is 2.8.0.6 and this is weird going direct to squid did work but now isnt since I setup dansguardian. It keeps asking for authentication now and wont accept any user.

[Geoff]

Check the permissions on the winbind privileged pipe. If you've rebooted the PC and not fixed the init scripts winbind will reset them.

[apeo]

Ok that was it, so how do i fix the init scripts then?

 

Oh and I rechecked dansguardian and it still doesnt show username so i had another look at dansguardian config. I changed the proxyip to the ip of the server (from the loopback) and it now asks for user credentials (annoying). I put it in and it allows be to browse but in the logs it still doesnt show usernames.

[Geoff]

Ok that was it, so how do i fix the init scripts then?

 

You need to alter the init script for squid. Add a line to alter the group ownership of the winbind pipe just before squid is started.

 

I changed the proxyip to the ip of the server (from the loopback) and it now asks for user credentials (annoying). I put it in and it allows be to browse but in the logs it still doesnt show usernames.

 

The version of dansguardian you have cannot pick up user credentials in the configuration you have. Either use a sandwich configuration or upgrade to the beta version.

[apeo]

Oh right... whats a 'sandwich configuration'? I didnt you the beta cause i wasnt sure how stable it was.. cant really cope with normal errors, let alone funny ones generated by the program itself.

[Geoff]

Sandwich config is the following

 

Internet <-> Squid 1 <-> Dansguardian <-> Squid 2 <-> Clients

 

Squid 1 - connects to external sites

 

Dansguardian - Content filtering.

 

Squid 2 - Handles authentication.

[apeo]

Ah right get ya now... I've set it up like this:

 

Internet <-> Lea Proxy <-> Dansguardian <-> Squid <-> Clients

 

Which i believe is effectively the same. Anyway, yes now i can get the right info if i combine the squid and dansguardian logs ie use dansguardian logs to identify access violation and then use the squid logs to see who did it. Im gonna try the Beta version now and see how i get on.

[Geoff]

If you switch to the beta it'll definately work. However in your setup you'll have to switch the order of Squid and Dansguardian. Dansguardian beta sniffs the NTLM authentication going on between squid and the clients and grabs the info it needs for logging/filtering.

[apeo]

I know this must be getting annoying now and i wouldnt ask but ive been stuck on this for a while now.... I tried to get the beta on by doing:

 

./configure --prefix=/usr/local --sysconfdir=/etc --with-logdir=/var/log/dansguardian --enable-ntlm

make

make install

 

This is after i did a apt-get remove dansguardian, and annoyingly dansguardian wont start... ive tried to start it with /etc/init.d/dansguardian start and nothing. It doesnt display anything just goes to the next prompt.. no error messages.. no indacation of any kind.. What did i do wrong?