Need a Dansguardian / Squid configuration expert

[joe90bass]

Well, I'm happy to report that it's now all good

 

There were a couple of minor settings in squid.conf that were wrong. All usernames are now being logged correctly and browsing is being authenticated. Filter groups are also working, so I just need to modify the group settings now before I roll out a production copy.

 

Thanks for all the help, and to one person in particular from here who has spent several hours with me via online chat and who provided invaluable help - you know who you are and thanks very much!

 

I'm at exactly the same stage you were! Could you post what the minor settings were that needed changing.

 

Cheers!

[siuko]

Where have you got so far with it?

 

Are your logs showing any helpful errors?

[joe90bass]

I have Squid 3 and DG 2.10.1.1 installed on Ubuntu 10.04 and via winbind on the domain. I have 5 groups in DG with group 1 being access denied. I've put users into groups via the usermap2.sh script and I've verified that they are in the right groups in DG. When browsing the web though all users are filtered by group1 (access denied) looking at the DG log via webmin shows

Warning - it appears either 'anonymizelogs=on' was set in dansguardian.conf or no "auth" methods were enabled so Individual names were not logged

but I do have ntlm_auth set! I'm assuming I have a squid config error not a DG one.

 

When looking at the access.log in Squid I can see that when I go direct to squid on port 3128 my IP and username are logged, when going via DG it shows as 127.0.0.1 with no username.

 

edit: This then gets forwarded to our LA proxy and the username and password is included in the squid.conf (this part works!)

Edited August 9, 2010 by joe90bass

[siuko]

Silly first question but do you have anonymizelogs=on in /etc/dansguardian/dansguardian.conf?

 

Mine is commented out...

[joe90bass]

it was commented out, it's currently enabled but set to anonymizelogs = off

[siuko]

Is it anything like this > 0001616: Dansguardian should enable ntlm authplugin when using ntlm auth in squid - Mantis

[joe90bass]

Yes, saw that earlier and thought I'd cracked it! But already have proxy-basic and proxy-ntlm uncommented

[siuko]

Can you restart your server just incase the conf isnt updating and try authing again and post 3-4 lines of the log file to see whats happening?

[joe90bass]

From the squid access.log

 

ns.com/ping/cookie=6M5STLOKDODA9GMCF14TN93AUN6LDOH9&alias=edugeek.net&idle=177&vs=i&ra=UHYD00Z50FH09ZLMOGTW4NN2Q0XLT1GQ - FIRST_UP_PARENT/192.168.248.201 text/javascript

1281361974.163 262 127.0.0.1 TCP_MISS/200 530 GET http://www.youtube.com/set_awesome? - FIRST_UP_PARENT/192.168.248.201 text/xml

1281361981.765 541 127.0.0.1 TCP_MISS/200 531 GET http://edugeek.net.woopra-ns.com/ping/cookie=6M5STLOKDODA9GMCF14TN93AUN6LDOH9&alias=edugeek.net&idle=189&vs=i&ra=7UUDQS4ZNCN96BO8EPC8JO2Q0QCXJKCE - FIRST_UP_PARENT/192.168.248.201 text/javascript

1281361983.252 200171 127.0.0.1 TCP_MISS/200 12426067 GET http://v18.lscache5.c.youtube.com/videoplayback? - FIRST_UP_PARENT/192.168.248.201 video/x-flv

1281362427.351 537 127.0.0.1 TCP_MISS/200 1457 GET YouTube - Broadcast Yourself. - FIRST_UP_PARENT/192.168.248.201 text/html

1281362427.420 28 127.0.0.1 TCP_MISS/200 1532 GET http://www.youtube.com/favicon.ico - FIRST_UP_PARENT/192.168.248.201 image/x-icon

1281362457.826 2191 127.0.0.1 TCP_MISS/200 1457 GET Main Index | DansGuardian Documentation Wiki - FIRST_UP_PARENT/192.168.248.201 text/html

 

 

From Dansguardian access.log

2010.8.9 15:00:27 - 172.21.117.38

*DENIED* Your username is not allowed to web browse: - GET 0 0 Banned User 1 403 - No_Web_Access -

2010.8.9 15:00:27 - 172.21.117.38 http://www.youtube.com/favicon.ico *DENIED* Your username is not allowed to web browse: - GET 0 0 Banned User 1 403 - No_Web_Access -

2010.8.9 15:00:57 - 172.21.117.38 using_ntlm_for_user_identification | DansGuardian Documentation Wiki *DENIED* Your username is not allowed to web browse: - GET 0 0 Banned User 1 403 - No_Web_Access

 

Cheers!

[siuko]

I'm guessing that means that its working ok?

[joe90bass]

It means it's blocking the default group 1 as expected, but I'm in group 5 which has (or should have!) unrestricted access

[siuko]

It must be reading your username correctly though to be able to say its going to ban you...

 

Are your filter groups reading everything right?

 

You can change the dansguardian access denied page to show which username is being banned - if that helps...

[joe90bass]

I understood it was banning me as it's using group 1 as the 'deny all' as it hasn't picked my userID up in the group it should be in. I know very little about Squid/DG but when hitting DG first and looking at the Squid logs I would expect to see DG passing my IP and userID to squid, but it's not I only see 127.0.0.1. If this is correct then I'm wasting my time on the toubleshooting I'm trying. I've done all the tests (winbind, ntlm_auth command line, etc) I can find to verify that squid is picking up the user IDs from AD correctly (and it is, or seems to be)

 

I'll take a look at editing the denied page to see what that throws up- cheers!

[joe90bass]

I've amended the block page to show the group that's being blocked and it is group1 no_web_access, howEver, as above I'm in group 5!

[siuko]

Can you also get it to show username so that you can find out exactly who it thinks you are?

[joe90bass]

Can you also get it to show username so that you can find out exactly who it thinks you are?

 

The -USER- option is set in the template, but only "-" shows on the block page. It shows the PC that the request came from and the group though. It's as if it's not authenticating, but I can't work out why! There's some talk of kerberos issues between Squid 3 and DG, just trying to find out which exact version of Squid I'm running. Webmin shows 3.0

 

edit: running Squid 3.0 stable 19

Edited August 10, 2010 by joe90bass

[siuko]

Yeah its definitely not picking up your username in DG so it dumps you in the default group.

 

In your squid logs is it showing the username at all? (I think you mentioned earlier that it was)

[joe90bass]

It does show the name if I use 3128 in the proxy address (i.e squid direct) if I got to 8080 (DG) then no it just shows 127.0.0.1 in the log no user name

[siuko]

My Dansguardian access log shows this :

 

2010.8.10 12:13:06 (username here) 10.25.74.1 Google GET 221 0 1 302 - normalgroup -

 

The username here was my username - I checked my squid logs and they dont seem to contain any usernames?

[joe90bass]

Okay, so I'm barking up the wrong tree with that as an issue, or at least symptom of it

 

Just so frustrating as I'm so close to getting it working.......

[siuko]

Can you disable username/password pass thru on IE so that it has to request your username and password to browse sites?

 

If you do this so you can check that it is requesting the details correctly and that it is also reading the username and password correctly from your DC.