Need a Dansguardian / Squid configuration expert

[Number6]

Following on from my previous thread.

 

I've installed a Ubuntu server running Dansguardian and squid.

 

I can't for the life of me work out how to authenticate AD users onto squid in order that I can set up different classes of filtering for different users.

 

If there's anyone on here that knows this system and is available for a bit of consultancy / training work here in Worcester please PM me.

[RabbieBurns]

have you considered Smoothwall Schoolguardian? Its very reasonably priced and has a very simple GUI and the main workings are dansguardian and squid.

[Jamman960]

I found the following how-to very useful, it still took some tweaking but I got it working in the end - How To Install And Configure Dansguardian With Multi-Group Filtering And Squid With NTLM Auth On Debian Etch | HowtoForge - Linux Howtos and Tutorials - its mostly the same for ubuntu except having to use different package managers etc etc

 

In the end I setup the 1st policy to block everything and then played around until NTLM auth worked and put me on the 2nd policy. If I remember correctly it came down to which port I connected to, I believe I had to connect directly to dansguardian which then went through squid to get it working.

[tom_newton]

Thanks Mr Burns! Yes, we do offer the "package" way to content filtering nirvana

 

Jamman - i think you have it about right there.

 

It can get a bit trial and error with dg, and you'll probably find you need to ask more specific questions to get the right answers. I am afraid I don't do much on the dg config side, but I will throw my 2p's worth in where I can

[Number6]

Hello Mr Burns, Jamman and Tom.

 

Unfortunately we cannot go down the Smoothwall route for two reasons; 1) we have nothing left in this years budget for new projects (and precious little for consumables even) and 2) we use a Sonicwall firewall, as do our other two sites and if I were to propose paying for a content filtering solution then questions would be asked about why I'm not paying for the Sonicwall integrated solution. I have my own reasons for not wanting to go down the Sonicwall route apart from cost.

 

So, as you see, I'm between a rock and a hard place for the moment.

 

My reasoning for going the Dansguardian route are 1) it might work well once set up and 2) it's free, apart from my time and 3) even if it doesn't prove to be manageable then I can put it forward as an argument for purchasing Smoothwall in 12 months time.

 

In terms of being more specific about what I want DG + Squid to do then this is what I want:

 

This site operates an SBS2003 controlled network. The SBS box is the DC, DNS server and runs WSUS. Obviously it also runs AD.

 

There are two other servers, a NAS box running Storage Server 2003 and a Server 2008 box that runs Sophos, SIMS, DHCP and acts as the KM server for the workstations.

 

There is a front-end Sonicwall hardware firewall.

 

There are 70 PCs on the network.

 

I have Dansguardian and squid running on a Ubuntu server box.

 

I wish to set up four groups - One will be totally blocked from internet access, one will be strongly filtered, one will be less strongly filtered and one will be unfiltered.

 

I want Squid to transparently read the AD user information passed by the client browser and for it to transparently authenticate the user into the appropriate group - users A, B and C will always be blocked, D, E and F will be always strongly filtered, users G, H and I will always be weakly filtered, IT Admin will always be unfiltered. Squid will pass the authority to Dansguardian and caching and filtering will then be handled according to group memberships.

 

Obviously all the authentication must be username / password based rather than IP based.

 

And that's it in a nutshell. If I can can get this framework running then it should simply be a case of keeping the filtering lists and config files up to date.

 

So if anyone would like to:

 

A) Give me advice how to do this

 

Or

 

B) Set it all up for me, either here or remotely.

 

then please get in touch.

 

I'm fairly sure we could find a reasonable consultancy fee if someone wishes to come here and do the setup for us.

 

Thanks in anticipation.

[Number6]

OK, I have made great strides forward but am now stuck at the final hurdle and wonder if anyone can help?

 

I have now got the Ubuntu box configured as a member of the domain via winbind and all of the tests show that it is seeing all of the network. The box can ping the DC by name and IP and vice-versa so DNS is all OK.

 

BUT.....

 

Now that I have all this working no browser can see the proxy, e.g. Chrome returns Error 102 Connection refused and IE simply refuses to display the page. This is the same whatever port I try to use for the proxy (8080, 8081 or 3128). It's not a browser problem as, with no proxy selected it's fine.

 

I've gone over and over the squid.conf file until I'm seeing it in my sleep but I can see no reason for connections being refused.

 

Squid and Dansguardian both start OK from the console, they both return "OK" when restarted. I could connect OK before I joined the box to the domain.

 

Anyone have any ideas where I can go from here?

[siuko]

What do your log files show?

 

You should often get a "not authenticated certain domain/username due to issue" error message somewhere in your log files - if not that it should hopefully show an access denied for another reason.

 

Have you configured your squid/dg for ntlm authentication?

[Guest Guest]

Theres plenty of guides out there. I haven't got time to run through this completely but it looks about right Setting up Squid NTLM DansGuardian Sarg - openSUSE

 

The way ive got it setup (in a nutshell) is;

 

Install squid, dg, winbind, (iirc) krb5, and samba.

 

Bind the server to your domain and make sure krb5 and samba is setup correctly.

Change the squid config to include the ntlm helper. This allows squid to authenticate without having to do the old "2 squids" hack or by using samba.

Use this script to pull usernames from AD http://dansguardian.org/downloads/chrisnighswonger/usermap

Now you configure DG for multigroups. Configure each group to read the appropriate phrase/badword lists. (dansguardianf1.conf ,dansguardianf2.conf etc)

 

 

To answer your question. You point your browser at the DG port (8080 by default iirc), and DG passes that onto squid on port (3128 iirc)

 

And iirc you have to make sure ntlm is in the dansguardian plugins folder if it isnt by default.

Edited April 8, 2010 by Guest

[Number6]

Everything seems to be configured OK. All the winbind tests and kinit give the properly expected responses.

 

Browser is pointed at DG:8080

 

proxy-ntlm.conf is in the DG authplugins folder with the content of:

 

# Proxy-NTLM auth plugin

# Identifies usernames in "Proxy-Authorization: NTLM" headers;

# relies on the upstream proxy (squid) to perform the actual password check.

 

plugname = 'proxy-ntlm'

 

 

The squid log files are very confusing and I'm still trying to make head or tail of them.

[Number6]

OK, I'm not now sure that squid is even running properly, or at all.

 

If I look at the squid config via webmin, on that page is a button "start Squid" - click it and it doesn't change to "stop Squid". How can I check definitively that squid is running, or otherwise

[Number6]

It isn't running and I don't know why.

 

On running /usr/sbin/squid -NCd1 I get :

 

/usr/sbin/squid -NCd1

WARNING: Cannot write log file: /var/log/squid/cache.log

/var/log/squid/cache.log: Permission denied

messages will be sent to 'stderr'.

2010/04/08 13:31:55| WARNING: Closing open FD 2

2010/04/08 13:31:55| Starting Squid Cache version 2.7.STABLE6 for amd64-debian-linux-gnu...

2010/04/08 13:31:55| Process ID 2664

2010/04/08 13:31:55| With 1024 file descriptors available

2010/04/08 13:31:55| Using epoll for the IO loop

2010/04/08 13:31:55| Performing DNS Tests...

FATAL: ipcache_init: DNS name lookup tests failed.

Squid Cache (Version 2.7.STABLE6): Terminated abnormally.

CPU Usage: 0.010 seconds = 0.000 user + 0.010 sys

Maximum Resident Size: 0 KB

Page faults with physical i/o: 0

Aborted

[Guest Guest]

To check status/start/stop;

/etc/init.d/squid start/stop/restart/status

 

 

Personally id start again. Somethings gone wrong as it shouldnt be throwing up errors for permissions. You should be able to fly through now you have an idea of what you are doing. Also i found Debian 5 (lenny) alot better for dansguardian, never did get things to work quite right on ubuntu.

[Number6]

I've removed and reinstalled squid.

 

Without any modification squid runs and reports OK.

 

BUT... as soon as I modify squid.conf to include ntlm_auth and restart squid it errors out as follows:

 

/usr/sbin/squid -NCd1

2010/04/08 14:04:31| Starting Squid Cache version 2.7.STABLE6 for amd64-debian-linux-gnu...

2010/04/08 14:04:31| Process ID 2548

2010/04/08 14:04:31| With 1024 file descriptors available

2010/04/08 14:04:31| Using epoll for the IO loop

2010/04/08 14:04:31| Performing DNS Tests...

FATAL: ipcache_init: DNS name lookup tests failed.

Aborted

 

Again, all the winbind tests and kinit return OK, I can ping the nameserver by name and IP, it's in resolve.conf.

 

What are the DNS name lookup tests? Does it just test to see if it can reach the nameserver or is it something else?

[Mcshammer_dj]

try using an IP address for the DNS_nameservers

[Number6]

try using an IP address for the DNS_nameservers

 

In resolve.conf? I already tried that, same result.

[Mcshammer_dj]

have you got a similar statement in sqid.conf

[Number6]

have you got a similar statement in sqid.conf

 

Yes, I put an entry in the dns_nameservers section of squid.conf. Still no result.

[siuko]

SQUID Frequently Asked Questions: Troubleshooting

 

10.22 FATAL: ipcache_init: DNS name lookup tests failed

 

Squid normally tests your system's DNS configuration before it starts server requests. Squit tries to resolve some common DNS names, as defined in the dns_testnames configuration directive. If Squid cannot resolve these names, it could mean that your DNS nameserver is unreachable or not running, or your /etc/resolv.conf file may contain incorrect information.

 

To disable this feature, use the -D command line option.

 

Note, Squid does NOT use the dnsservers to test the DNS. The test is performed internally, before the dnsservers start.

[Number6]

I have given up for today. Spent two solid days on it so far and I think I'm just going round in circles.

 

I think tomorrow I'll start completely afresh, even down to reinstalling the OS.

 

What think you all about the OS, is Ubuntu a problem and should I simply go with a Debian build? Or should Ubuntu server be OK?

[tom_newton]

Ubuntu server should be fine. I'd get squid going on its own first. May be worth investing in the o'reilly "squid book", it's the dogs.

[siuko]

I am running 2 Squid/DG proxies at the school I work at.

 

They are both running on Ubuntu 8.04 Server. They work great.

 

But I am no expert at ubuntu or linux and it takes me AAAAAAAAGES (about a week if I'm not busy) to configure them to fully work with AD and NTLM. It mainly takes me so long as I just collect info from google searches and slowly make things operational... and forget to write down what I've done as that slows me down even more hahaha

 

I will help all I can with any questions you have (and give any config files you might need etc) - if I can remember from when I did it

[Number6]

I am running 2 Squid/DG proxies at the school I work at.

 

They are both running on Ubuntu 8.04 Server. They work great.

 

But I am no expert at ubuntu or linux and it takes me AAAAAAAAGES (about a week if I'm not busy) to configure them to fully work with AD and NTLM. It mainly takes me so long as I just collect info from google searches and slowly make things operational... and forget to write down what I've done as that slows me down even more hahaha

 

I will help all I can with any questions you have (and give any config files you might need etc) - if I can remember from when I did it

 

You sound like me!

 

Your offer is very kind and I may make use of it.

 

I've just reinstalled Ubuntu and I'm about to start a reinstall of Squid and DG. If you have working Squid and DG config files I'd welcome having copies if only to look at to see what I need to do. PM me and I'll give you my email address.

 

Thanks again.

[Number6]

I'm now a whole heap further on than I was yesterday - squid is running, I haven't yet installed DG as I was concentrating on squid first. However - having joined the server to the domain and setting up squid with ntlm auth I have a problem - a password dialogue pops up in all browsers and none of our usernames / passwords are being recognized. All kinit and wbinfo responses are as expected and are OK. Any ideas?

[Number6]

This is my squid.conf file:

 

[auth_param]

 

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp

auth_param ntlm children 24

auth_param ntlm keep_alive on

 

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic

auth_param basic children 24

auth_param basic realm Squid proxy-caching web server

auth_param basic credentialsttl 2 hours

 

[Access Controls]

 

acl all src all

acl manager proto cache_object

acl localhost src 127.0.0.1/32

acl to_localhost dst 127.0.0.0/8

#

# Example rule allowing access from your local networks.

# Adapt to list your (internal) IP networks from where browsing

# should be allowed

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network

acl localnet src 172.16.0.0/12 # RFC1918 possible internal network

acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

#

acl SSL_ports port 443 # https

acl SSL_ports port 563 # snews

acl SSL_ports port 873 # rsync

acl Safe_ports port 80 # http

acl Safe_ports port 21 # ftp

acl Safe_ports port 443 # https

acl Safe_ports port 70 # gopher

acl Safe_ports port 210 # wais

acl Safe_ports port 1025-65535 # unregistered ports

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 488 # gss-http

acl Safe_ports port 591 # filemaker

acl Safe_ports port 777 # multiling http

acl Safe_ports port 631 # cups

acl Safe_ports port 873 # rsync

acl Safe_ports port 901 # SWAT

acl purge method PURGE

acl CONNECT method CONNECT

 

acl ntlm_auth proxy_auth REQUIRED

 

http_access allow ntlm_auth

 

Is there anything wrong with this?

[dhicks]

I've just reinstalled Ubuntu and I'm about to start a reinstall of Squid and DG.

 

I've got a similar task to do over this Easter break - we need a VM to combine two ADSL connections in to one somehow. I'll be using Debian rather than Ubunut as that seems to work better with Xen. I seem to remember from last time I set up a Squid machine that I had to install Squid from source, making sure I enabled support for transparent proxying when compiling.

 

--

David Hicks