Guest Guest Posted April 9, 2010 Posted April 9, 2010 I've got a similar task to do over this Easter break - we need a VM to combine two ADSL connections in to one somehow. I'll be using Debian rather than Ubunut as that seems to work better with Xen. I seem to remember from last time I set up a Squid machine that I had to install Squid from source, making sure I enabled support for transparent proxying when compiling. -- David Hicks Na, deffo dont need to do that now, not with debian anyway
tom_newton Posted April 9, 2010 Posted April 9, 2010 I've got a similar task to do over this Easter break - we need a VM to combine two ADSL connections in to one somehow. I'll be using Debian rather than Ubunut as that seems to work better with Xen. I seem to remember from last time I set up a Squid machine that I had to install Squid from source, making sure I enabled support for transparent proxying when compiling. David, wil one of your SmoothWalls not do that for ye?
dhicks Posted April 9, 2010 Posted April 9, 2010 David, wil one of your SmoothWalls not do that for ye? I was told SchoolGuardian can’t handle multiple internet connections, we would need Advanced Firewall to do that. -- David Hicks
ind1ekid Posted April 9, 2010 Posted April 9, 2010 (edited) This is my squid.conf file: Is there anything wrong with this? I'd say it looks fine, other than asking why you have 24 childen set for your ntlm helper processes? Seems like a lot to me. edit: on second glances, I left the basic authenticators commented out - i just have the 3 lines for NTLM auth ..not 100% what difference that will be making to your setup? Edited April 9, 2010 by ind1ekid
siuko Posted April 9, 2010 Posted April 9, 2010 Hehe those lines are from my script.... I just had more children to make sure there were plenty of helper processes to auth with... Probably way beyond required but the system has plenty of resources and I wanted to see if it helped any
dhicks Posted April 15, 2010 Posted April 15, 2010 I was told SchoolGuardian can’t handle multiple internet connections, we would need Advanced Firewall to do that. Just to check I'm on the right track here: We have a nice, shiny new copy of School Guardian with all updates installed. It seems to be able to do failover between two ADSL connections, but it can't load-balance between them. To do that, I'm aiming for a Debian install with IPTables rules as described here: How To: Load Balancing & Failover With Dual/ Multi WAN / ADSL / Cable Connections on Linux -- David Hicks
Number6 Posted April 15, 2010 Author Posted April 15, 2010 Having not been able to get back onto the squid install til today from last Friday I'm happy to report that I now have Squid running and authenticating to the AD usernames, IE transparently and other browsers requiring a username and password. Achieved with thanks to a member of Edugeek for his support and invaluable advice last Friday and Today + copious quantities of Google! (and tea) Now I have to get DG installed and configured but that's a task for tomorrow.
tom_newton Posted April 16, 2010 Posted April 16, 2010 David - It may be that only advanced firewall can do that (I can't honestly remember and I don't have SG to hand) - ring your account manager, I am sure they'll swap it out for you!
Number6 Posted April 16, 2010 Author Posted April 16, 2010 Right I'm moving along slowly. Squid and DG are working using ntlm_auth against AD users and this is all fine. I have two problems to resolve though: 1) When I reboot the server clients won't authenticate. I have to stop squid, run winbind-ch.sh and then restart squid, it then works fine until the next reboot when I have to rerun the preceding. Winbind-ch.sh is in rc2.d and I've tried playing with the run times to no avail. Any ideas? 2) How do I get DG to recognise filtergroups? I've set up two groups, one filtered and one not and I put my AD username in the filtergroups list but clients won't read it. Is there anything else I need to do to make groups work?
dhicks Posted April 16, 2010 Posted April 16, 2010 ring your account manager, I am sure they'll swap it out for you! Well, yes, but that would cost us more money. I'm setting up another machine to act as a load-balancing router for the two ADSL connections - I'm currently looking at using ZeroShell, that seems to do what we want, unless anyone can suggest a better solution? -- David Hicks
Number6 Posted April 16, 2010 Author Posted April 16, 2010 Right I'm moving along slowly. Squid and DG are working using ntlm_auth against AD users and this is all fine. I have two problems to resolve though: 1) When I reboot the server clients won't authenticate. I have to stop squid, run winbind-ch.sh and then restart squid, it then works fine until the next reboot when I have to rerun the preceding. Winbind-ch.sh is in rc2.d and I've tried playing with the run times to no avail. Any ideas? 2) How do I get DG to recognise filtergroups? I've set up two groups, one filtered and one not and I put my AD username in the filtergroups list but clients won't read it. Is there anything else I need to do to make groups work?
Guest Guest Posted April 16, 2010 Posted April 16, 2010 1. Yep thats a problem with Ubuntu. You need to add the script to change permissions as a startup cron job. Debian doesnt have that problem. 2. Did you download my zip file i PMed you with? Its all in there. Basically it looks like this filtergroupslist user1=filter1 user2=filter1 user3=filter2 dansguardian.conf ... filtergroups = 4 filtergroupslist = '/etc/dansguardian/lists/filtergroupslist' ... dansguardianf1.conf ... groupname = 'Unauthenticated/Banned' ... dansguardianf2.conf ... groupname = 'Pupils' # Content filtering files location bannedphraselist = '/etc/dansguardian/lists/groups/pupils/bannedphraselist' weightedphraselist = '/etc/dansguardian/lists/groups/pupils/weightedphraselist' exceptionphraselist = '/etc/dansguardian/lists/groups/pupils/exceptionphraselist' bannedsitelist = '/etc/dansguardian/lists/groups/pupils/bannedsitelist' greysitelist = '/etc/dansguardian/lists/groups/pupils/greysitelist' exceptionsitelist = '/etc/dansguardian/lists/groups/pupils/exceptionsitelist' bannedurllist = '/etc/dansguardian/lists/groups/pupils/bannedurllist' greyurllist = '/etc/dansguardian/lists/groups/pupils/greyurllist' etc etc ... dansguardianf3.conf ... groupname = 'Staff' ...
siuko Posted April 16, 2010 Posted April 16, 2010 1. Yep thats a problem with Ubuntu. You need to add the script to change permissions as a startup cron job. Debian doesnt have that problem. Damn might have to take a look at debian the next time I'm building a squid / dg box.... That permissions thing always irratates me!
Number6 Posted April 16, 2010 Author Posted April 16, 2010 1. Yep thats a problem with Ubuntu. You need to add the script to change permissions as a startup cron job. Debian doesnt have that problem. 2. Did you download my zip file i PMed you with? Its all in there. Basically it looks like this filtergroupslist user1=filter1 user2=filter1 user3=filter2 dansguardian.conf ... filtergroups = 4 filtergroupslist = '/etc/dansguardian/lists/filtergroupslist' ... dansguardianf1.conf ... groupname = 'Unauthenticated/Banned' ... dansguardianf2.conf ... groupname = 'Pupils' # Content filtering files location bannedphraselist = '/etc/dansguardian/lists/groups/pupils/bannedphraselist' weightedphraselist = '/etc/dansguardian/lists/groups/pupils/weightedphraselist' exceptionphraselist = '/etc/dansguardian/lists/groups/pupils/exceptionphraselist' bannedsitelist = '/etc/dansguardian/lists/groups/pupils/bannedsitelist' greysitelist = '/etc/dansguardian/lists/groups/pupils/greysitelist' exceptionsitelist = '/etc/dansguardian/lists/groups/pupils/exceptionsitelist' bannedurllist = '/etc/dansguardian/lists/groups/pupils/bannedurllist' greyurllist = '/etc/dansguardian/lists/groups/pupils/greyurllist' etc etc ... dansguardianf3.conf ... groupname = 'Staff' ... I did all that but DG seems to be ignoring it. Everyone is defaulting to group 1
Number6 Posted April 16, 2010 Author Posted April 16, 2010 Should the originator's username be logged in the DG access log?
Guest Guest Posted April 16, 2010 Posted April 16, 2010 (edited) Yep, assuming you have logging turned on. Authentication deffo working? This guide is for Suse, but it shows you everything you need to know to get authentication working. http://en.opensuse.org/Setting_up_Squid_NTLM_DansGuardian_Sarg Edited April 16, 2010 by Guest
Number6 Posted April 16, 2010 Author Posted April 16, 2010 This is odd now. Everything appears OK according to all the guides I've read, all wbinfo, kinit, etc commands give the right responses but no usernames are being logged. Also I've just tried browsing from a non-domain pc and it hasn't asked for authentication.
Number6 Posted April 16, 2010 Author Posted April 16, 2010 If I point the browser at the squid port then the request is authenticated. If I point it at the DG port it isn't authenticated?
Number6 Posted April 16, 2010 Author Posted April 16, 2010 Had enough for now. Look again next week. DG conf file is set to listen on 8080 and the proxy port is set to 3128. Squid.conf is set to use nltm_auth. All wbinfo checks and kinit respond OK. If the browser is pointed at 3128 then authentication is requested but if pointed at 8080 then it appears not to be and filtering for all users takes place as per group 1, neither are usernames logged in either the squid or DG access logs.
Guest Guest Posted April 16, 2010 Posted April 16, 2010 you do have the line authplugin = '/etc/dansguardian/authplugins/proxy-ntlm.conf' in your dansguardian.conf file dnt you?
Number6 Posted April 16, 2010 Author Posted April 16, 2010 (edited) Here are my squid and DG config files. I've deleted all commented out lines. If you are able to and have the time could you have a look and see if there's anything obviously wrong or missing please? Thankssquid.conf.txtdansguardian.conf.txt Edited April 16, 2010 by Number6
Number6 Posted April 21, 2010 Author Posted April 21, 2010 Well, I'm happy to report that it's now all good There were a couple of minor settings in squid.conf that were wrong. All usernames are now being logged correctly and browsing is being authenticated. Filter groups are also working, so I just need to modify the group settings now before I roll out a production copy. Thanks for all the help, and to one person in particular from here who has spent several hours with me via online chat and who provided invaluable help - you know who you are and thanks very much!
stolli Posted June 4, 2010 Posted June 4, 2010 Well, I'm happy to report that it's now all good There were a couple of minor settings in squid.conf that were wrong. All usernames are now being logged correctly and browsing is being authenticated. Filter groups are also working, so I just need to modify the group settings now before I roll out a production copy. Thanks for all the help, and to one person in particular from here who has spent several hours with me via online chat and who provided invaluable help - you know who you are and thanks very much! What was wrong? What distribution? Can you post yout configs?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now