Dansguardian on windows 2003 domain

[Geoff]

Sounds like you've got an old version of ntlm_auth hanging around.

[netadmin]

I tried to reinstall Samba, hoping that might fix the problem.

It did not. I also reinstalled Winbind, which did not help anything either.

 

I am now using the 3.0.2-11 version of Samba. Winbind is the same version.

 

What package should I upgrade to get NTLM to the same, newer version?

[Geoff]

ntlm_auth comes with squid on Suse.

 

http://benjiweber.co.uk:8080/webpin/index.jsp?searchTerm=ntlm_auth&distro=openSUSE_102

[netadmin]

I have reinstalled Squid three times, hoping this might update the ntlm_auth files. I even deleted the ntlm_auth files once, then reinstalled.

 

I still keep getting unknown option message for ntlm_auth -V

 

Any tips?

[Geoff]

compile/install from source code?

[netadmin]

I have decided to take a different approach and try SquidNT on my windows 2003 DC (DC IP: 192.168.0.1, SquidNT port: 3128), thinking it might be easier to get setup the rest of the way.

 

Good news! SquidNT proxies the sites and logs the username, automatically getting it from NTLM. However, all is still not working.

 

I programmed Dansguardian (IP: 192.168.0.2, port 8181) to look at the Proxy IP for SquidNT.

 

Dansguardian does successfully block the sites I tell it to, but Dansguardian does not get the username from Squid or display non-blocked sites.

 

Any tips on this? Maybe it's something simple. I have IE set to connect to proxy at 192.168.0.2, port 8181.

[netadmin]

Update:

 

I have now gotten Dansguardian to proxy sites using squid and block needed sites. However, it still does not get the username from Squid.

 

If I try to connect to just the Squid proxy server, it does log the username.

When I try to connect (using IE) to the Dansguardian filter, it does not log the username in the Dansguardian log.

 

Does anyone have any tips on this issue? I'm getting so close...

[Geoff]

What version of Dansguardian?

[netadmin]

Dansguardian is version 2.8.0

[Geoff]

You need 2.9 to make it work the way you have it set up.

[netadmin]

OK. 2.9.8 is now installed.

 

However, when I start it it says "Squid not running. Dansguardian requires Squid".

 

Squid is running on the Windows 2003 machine.

If I just start squid on the linux box (which is not being used), it then says Dansguardian start FAILED.

 

Any ideas? I'm guessing a config problem.

[netadmin]

OK. I have now reinstalled Dansguardian version 2.9.8.5 on my linux server. It does accept traffic.

 

If I set IE to connect directly to SquidNT, it logs the username properly in Squid.

 

If I set IE to connect to Dansguardian (which has the proxy ip set to SquidNT), then it logs just the site on SquidNT (also on the DG log, though), but no user name.

 

Any ideas? I think I'm getting really close. Thanks!

[Geoff]

verify your dansguardian.conf has the correct authentication plugins enabled.

 

authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'
authplugin = '/etc/dansguardian/authplugins/proxy-ntlm.conf'

 

Your paths may differ.

[netadmin]

The auth paths are now enabled and correct.

 

It still does not work though

Any other ideas?

[Geoff]

Ensure 127.0.0.1/Localhost is not allowed to bypass authentication.

[netadmin]

OK. I found part of the problem.

I had created an ACL that bypass authentication coming from the linux server.

 

The Squid log now shows the domain username, but the DG log doesn't.

Any ideas? (It's getting so close, it seems like)

[Geoff]

Dansguardian needs to be 'in front' of Squid.

 

Client -> DG -> Squid -> Internet

[netadmin]

Below is a screenshot of the network settings from DG.

 

I have the browsers set to the DG ip (192.168.0.2) with port 8080.

 

Do I still have things out of order?

[Geoff]

My dansguardian is set as follows:

 

# Network Settings
#
# the IP that DansGuardian listens on.  If left blank DansGuardian will
# listen on all IPs.  That would include all NICs, loopback, modem, etc.
# Normally you would have your firewall protecting this, but if you want
# you can limit it to a certain IP. To bind to multiple interfaces,
# specify each IP on an individual filterip line.
filterip =

# the port that DansGuardian listens to.
filterport = 8080

# the ip of the proxy (default is the loopback - i.e. this server)
proxyip = 127.0.0.1

# the port DansGuardian connects to proxy on
proxyport = 3128

 

And Squid:

 

#IP/Port squid listens for connections on

http_port 127.0.0.1:3128

 

Thus clients connect on port 8080