Need a Dansguardian / Squid configuration expert

April 9, 2010

PM sent

April 9, 2010

I've got a similar task to do over this Easter break - we need a VM to combine two ADSL connections in to one somehow. I'll be using Debian rather than Ubunut as that seems to work better with Xen. I seem to remember from last time I set up a Squid machine that I had to install Squid from source, making sure I enabled support for transparent proxying when compiling.

--
David Hicks

Na, deffo dont need to do that now, not with debian anyway

tom_newton · April 9, 2010

I've got a similar task to do over this Easter break - we need a VM to combine two ADSL connections in to one somehow. I'll be using Debian rather than Ubunut as that seems to work better with Xen. I seem to remember from last time I set up a Squid machine that I had to install Squid from source, making sure I enabled support for transparent proxying when compiling.

David, wil one of your SmoothWalls not do that for ye?

dhicks · April 9, 2010

David, wil one of your SmoothWalls not do that for ye?

I was told SchoolGuardian can’t handle multiple internet connections, we would need Advanced Firewall to do that.

--

David Hicks

ind1ekid · April 9, 2010

This is my squid.conf file:

Is there anything wrong with this?

I'd say it looks fine, other than asking why you have 24 childen set for your ntlm helper processes? Seems like a lot to me.

edit: on second glances, I left the basic authenticators commented out - i just have the 3 lines for NTLM auth ..not 100% what difference that will be making to your setup?

Edited April 9, 2010 by ind1ekid

siuko · April 9, 2010

Hehe those lines are from my script.... I just had more children to make sure there were plenty of helper processes to auth with...

Probably way beyond required but the system has plenty of resources and I wanted to see if it helped any

dhicks · April 15, 2010

I was told SchoolGuardian can’t handle multiple internet connections, we would need Advanced Firewall to do that.

Just to check I'm on the right track here: We have a nice, shiny new copy of School Guardian with all updates installed. It seems to be able to do failover between two ADSL connections, but it can't load-balance between them. To do that, I'm aiming for a Debian install with IPTables rules as described here:

How To: Load Balancing & Failover With Dual/ Multi WAN / ADSL / Cable Connections on Linux

--

David Hicks

Number6 · April 15, 2010

Having not been able to get back onto the squid install til today from last Friday I'm happy to report that I now have Squid running and authenticating to the AD usernames, IE transparently and other browsers requiring a username and password.

Achieved with thanks to a member of Edugeek for his support and invaluable advice last Friday and Today + copious quantities of Google! (and tea)

Now I have to get DG installed and configured but that's a task for tomorrow.

tom_newton · April 16, 2010

David - It may be that only advanced firewall can do that (I can't honestly remember and I don't have SG to hand) - ring your account manager, I am sure they'll swap it out for you!

Number6 · April 16, 2010

Right

I'm moving along slowly.

Squid and DG are working using ntlm_auth against AD users and this is all fine.

I have two problems to resolve though:

1) When I reboot the server clients won't authenticate. I have to stop squid, run winbind-ch.sh and then restart squid, it then works fine until the next reboot when I have to rerun the preceding. Winbind-ch.sh is in rc2.d and I've tried playing with the run times to no avail. Any ideas?

2) How do I get DG to recognise filtergroups? I've set up two groups, one filtered and one not and I put my AD username in the filtergroups list but clients won't read it. Is there anything else I need to do to make groups work?

dhicks · April 16, 2010

ring your account manager, I am sure they'll swap it out for you!

Well, yes, but that would cost us more money. I'm setting up another machine to act as a load-balancing router for the two ADSL connections - I'm currently looking at using ZeroShell, that seems to do what we want, unless anyone can suggest a better solution?

--

David Hicks

Number6 · April 16, 2010

Right

I'm moving along slowly.

Squid and DG are working using ntlm_auth against AD users and this is all fine.

I have two problems to resolve though:

1) When I reboot the server clients won't authenticate. I have to stop squid, run winbind-ch.sh and then restart squid, it then works fine until the next reboot when I have to rerun the preceding. Winbind-ch.sh is in rc2.d and I've tried playing with the run times to no avail. Any ideas?

2) How do I get DG to recognise filtergroups? I've set up two groups, one filtered and one not and I put my AD username in the filtergroups list but clients won't read it. Is there anything else I need to do to make groups work?

April 16, 2010

1. Yep thats a problem with Ubuntu. You need to add the script to change permissions as a startup cron job. Debian doesnt have that problem.

2. Did you download my zip file i PMed you with? Its all in there.

Basically it looks like this

filtergroupslist

user1=filter1
user2=filter1
user3=filter2

dansguardian.conf

...
filtergroups = 4	
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'
...

dansguardianf1.conf

...
groupname = 'Unauthenticated/Banned'
...

dansguardianf2.conf

...
groupname = 'Pupils'

# Content filtering files location
bannedphraselist = '/etc/dansguardian/lists/groups/pupils/bannedphraselist'
weightedphraselist = '/etc/dansguardian/lists/groups/pupils/weightedphraselist'
exceptionphraselist = '/etc/dansguardian/lists/groups/pupils/exceptionphraselist'
bannedsitelist = '/etc/dansguardian/lists/groups/pupils/bannedsitelist'
greysitelist = '/etc/dansguardian/lists/groups/pupils/greysitelist'
exceptionsitelist = '/etc/dansguardian/lists/groups/pupils/exceptionsitelist'
bannedurllist = '/etc/dansguardian/lists/groups/pupils/bannedurllist'
greyurllist = '/etc/dansguardian/lists/groups/pupils/greyurllist'
etc etc
...

dansguardianf3.conf

...
groupname = 'Staff'
...

siuko · April 16, 2010

1. Yep thats a problem with Ubuntu. You need to add the script to change permissions as a startup cron job. Debian doesnt have that problem.

Damn might have to take a look at debian the next time I'm building a squid / dg box....

That permissions thing always irratates me!

Number6 · April 16, 2010

1. Yep thats a problem with Ubuntu. You need to add the script to change permissions as a startup cron job. Debian doesnt have that problem.

2. Did you download my zip file i PMed you with? Its all in there.

Basically it looks like this

filtergroupslist

user1=filter1
user2=filter1
user3=filter2

dansguardian.conf

...
filtergroups = 4	
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'
...

dansguardianf1.conf

...
groupname = 'Unauthenticated/Banned'
...

dansguardianf2.conf

...
groupname = 'Pupils'

# Content filtering files location
bannedphraselist = '/etc/dansguardian/lists/groups/pupils/bannedphraselist'
weightedphraselist = '/etc/dansguardian/lists/groups/pupils/weightedphraselist'
exceptionphraselist = '/etc/dansguardian/lists/groups/pupils/exceptionphraselist'
bannedsitelist = '/etc/dansguardian/lists/groups/pupils/bannedsitelist'
greysitelist = '/etc/dansguardian/lists/groups/pupils/greysitelist'
exceptionsitelist = '/etc/dansguardian/lists/groups/pupils/exceptionsitelist'
bannedurllist = '/etc/dansguardian/lists/groups/pupils/bannedurllist'
greyurllist = '/etc/dansguardian/lists/groups/pupils/greyurllist'
etc etc
...

dansguardianf3.conf

...
groupname = 'Staff'
...

I did all that but DG seems to be ignoring it. Everyone is defaulting to group 1

Number6 · April 16, 2010

Should the originator's username be logged in the DG access log?

April 16, 2010

Yep, assuming you have logging turned on.

Authentication deffo working? This guide is for Suse, but it shows you everything you need to know to get authentication working. http://en.opensuse.org/Setting_up_Squid_NTLM_DansGuardian_Sarg

Edited April 16, 2010 by Guest

Number6 · April 16, 2010

This is odd now. Everything appears OK according to all the guides I've read, all wbinfo, kinit, etc commands give the right responses but no usernames are being logged. Also I've just tried browsing from a non-domain pc and it hasn't asked for authentication.

Number6 · April 16, 2010

If I point the browser at the squid port then the request is authenticated. If I point it at the DG port it isn't authenticated?

Number6 · April 16, 2010

Had enough for now. Look again next week.

DG conf file is set to listen on 8080 and the proxy port is set to 3128.

Squid.conf is set to use nltm_auth.

All wbinfo checks and kinit respond OK.

If the browser is pointed at 3128 then authentication is requested but if pointed at 8080 then it appears not to be and filtering for all users takes place as per group 1, neither are usernames logged in either the squid or DG access logs.

April 16, 2010

you do have the line

authplugin = '/etc/dansguardian/authplugins/proxy-ntlm.conf'

in your dansguardian.conf file dnt you?

Number6 · April 16, 2010

Yes it is there.

Number6 · April 16, 2010

Here are my squid and DG config files. I've deleted all commented out lines.

If you are able to and have the time could you have a look and see if there's anything obviously wrong or missing please?

Thanks

squid.conf.txt

dansguardian.conf.txt

Edited April 16, 2010 by Number6

Number6 · April 21, 2010

Well, I'm happy to report that it's now all good

There were a couple of minor settings in squid.conf that were wrong. All usernames are now being logged correctly and browsing is being authenticated. Filter groups are also working, so I just need to modify the group settings now before I roll out a production copy.

Thanks for all the help, and to one person in particular from here who has spent several hours with me via online chat and who provided invaluable help - you know who you are and thanks very much!

stolli · June 4, 2010

Well, I'm happy to report that it's now all good

There were a couple of minor settings in squid.conf that were wrong. All usernames are now being logged correctly and browsing is being authenticated. Filter groups are also working, so I just need to modify the group settings now before I roll out a production copy.

Thanks for all the help, and to one person in particular from here who has spent several hours with me via online chat and who provided invaluable help - you know who you are and thanks very much!

What was wrong?

What distribution?

Can you post yout configs?

Need a Dansguardian / Squid configuration expert

Recommended Posts

Guest Guest

Guest Guest

tom_newton

dhicks

ind1ekid

siuko

dhicks

Number6

tom_newton

Number6

dhicks

Number6

Guest Guest

siuko

Number6

Number6

Guest Guest

Number6

Number6

Number6

Guest Guest

Number6

Number6

Number6

stolli

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New