Number6

OK, many thanks.

Right. I now have a properly running version of Squid on Ubuntu server. I now need to clone it before I move on to installing DG. Can I just clone the server from the Clonezilla Live CD? Can I send the image to a windows share?

Having not been able to get back onto the squid install til today from last Friday I'm happy to report that I now have Squid running and authenticating to the AD usernames, IE transparently and other browsers requiring a username and password. Achieved with thanks to a member of Edugeek for his support and invaluable advice last Friday and Today + copious quantities of Google! (and tea) Now I have to get DG installed and configured but that's a task for tomorrow.

There has to be a way of doing it. Some sort of auto refresh, it's only a browser after all. I'm more concerned about how to send the data elsewhere. 2008 can obviously collect and consolidate the data from elsewhere so, ergo there must be a way of forwarding it on somewhere else?

Four at one site and ten at the other. A mix of 2003, 2008 and even the odd NT and 2000 one.

What I'm hoping to achieve is to be able to subsequently filter the centralised log output so that only critical errors are displayed. I don't need to see the background noise of xyz print job completed successfully, only the abc DNS server service stopped type of error. Email alerts are well and good but I'm looking more for a monitoring overview. A PC in my office that is permanently displaying white-cross-on-red-background errors in real time is my preferred solution, maybe in a split screen style displaying warnings on the left and errors on the right. That way I can see at a glance the general state of play and, if I'm not there and I get the inevitable phone call telling me that something's gone wrong I can ask someone to go into my office and read me the errors, or even photograph the screen and send it to me by mms. I'm not always in front of my email. Just a wild thought really, on an otherwise slow day at the office.

Now that's more like it! That addresses the centralised logging. Next bit is how can I configure the server, or some external third party software to display the forwarded events, refreshed in real time automatically?

I looked at Splunk, again, does more than I want or need.

Thanks Mschammer, but that's more than I need. I really only want a scrolling realtime display of the event log.

Is there any free, or low cost software that will enable me to permanently monitor, in real time events generated by multiple windows servers? What I'm envisioning is having a spare PC permanently monitoring and displaying realtime info so that at any time I can see at a glance if any server is experiencing issues. Anything?

Thanks :-)

Yes, I agree. I will do so next time. Trouble is I got it to a stage where it was working and just thought "I wonder what will happen if I change this permission and that directory ownership" or similar - oh dear, it breaks it! I did this twice and both times I wasn't intending to change anything major and thought " I can always change it back again" Next time I will get it working and then snapshot it. You reckon Clonezilla is the best option?

Thanks again everyone for the helpful replies. I have, as of the end of last week got Ubuntu integrated with AD and I've got squid authenticating using AD. However, twice now I've tried tweaking settings and broken Squid When I'm next in I inrtend to reinstall Ubuntu (again) and start from scratch - I'm quietly confident but we'll see.

This is my squid.conf file: Is there anything wrong with this?

I'm now a whole heap further on than I was yesterday - squid is running, I haven't yet installed DG as I was concentrating on squid first. However - having joined the server to the domain and setting up squid with ntlm auth I have a problem - a password dialogue pops up in all browsers and none of our usernames / passwords are being recognized. All kinit and wbinfo responses are as expected and are OK. Any ideas?

You sound like me! Your offer is very kind and I may make use of it. I've just reinstalled Ubuntu and I'm about to start a reinstall of Squid and DG. If you have working Squid and DG config files I'd welcome having copies if only to look at to see what I need to do. PM me and I'll give you my email address. Thanks again.

I have given up for today. Spent two solid days on it so far and I think I'm just going round in circles. I think tomorrow I'll start completely afresh, even down to reinstalling the OS. What think you all about the OS, is Ubuntu a problem and should I simply go with a Debian build? Or should Ubuntu server be OK?

Yes, I put an entry in the dns_nameservers section of squid.conf. Still no result.

In resolve.conf? I already tried that, same result.

I've removed and reinstalled squid. Without any modification squid runs and reports OK. BUT... as soon as I modify squid.conf to include ntlm_auth and restart squid it errors out as follows: Again, all the winbind tests and kinit return OK, I can ping the nameserver by name and IP, it's in resolve.conf. What are the DNS name lookup tests? Does it just test to see if it can reach the nameserver or is it something else?

It isn't running and I don't know why. On running /usr/sbin/squid -NCd1 I get :

OK, I'm not now sure that squid is even running properly, or at all. If I look at the squid config via webmin, on that page is a button "start Squid" - click it and it doesn't change to "stop Squid". How can I check definitively that squid is running, or otherwise

Everything seems to be configured OK. All the winbind tests and kinit give the properly expected responses. Browser is pointed at DG:8080 proxy-ntlm.conf is in the DG authplugins folder with the content of: # Proxy-NTLM auth plugin # Identifies usernames in "Proxy-Authorization: NTLM" headers; # relies on the upstream proxy (squid) to perform the actual password check. plugname = 'proxy-ntlm' The squid log files are very confusing and I'm still trying to make head or tail of them.

OK, I have made great strides forward but am now stuck at the final hurdle and wonder if anyone can help? I have now got the Ubuntu box configured as a member of the domain via winbind and all of the tests show that it is seeing all of the network. The box can ping the DC by name and IP and vice-versa so DNS is all OK. BUT..... Now that I have all this working no browser can see the proxy, e.g. Chrome returns Error 102 Connection refused and IE simply refuses to display the page. This is the same whatever port I try to use for the proxy (8080, 8081 or 3128). It's not a browser problem as, with no proxy selected it's fine. I've gone over and over the squid.conf file until I'm seeing it in my sleep but I can see no reason for connections being refused. Squid and Dansguardian both start OK from the console, they both return "OK" when restarted. I could connect OK before I joined the box to the domain. Anyone have any ideas where I can go from here?

Hello Mr Burns, Jamman and Tom. Unfortunately we cannot go down the Smoothwall route for two reasons; 1) we have nothing left in this years budget for new projects (and precious little for consumables even) and 2) we use a Sonicwall firewall, as do our other two sites and if I were to propose paying for a content filtering solution then questions would be asked about why I'm not paying for the Sonicwall integrated solution. I have my own reasons for not wanting to go down the Sonicwall route apart from cost. So, as you see, I'm between a rock and a hard place for the moment. My reasoning for going the Dansguardian route are 1) it might work well once set up and 2) it's free, apart from my time and 3) even if it doesn't prove to be manageable then I can put it forward as an argument for purchasing Smoothwall in 12 months time. In terms of being more specific about what I want DG + Squid to do then this is what I want: This site operates an SBS2003 controlled network. The SBS box is the DC, DNS server and runs WSUS. Obviously it also runs AD. There are two other servers, a NAS box running Storage Server 2003 and a Server 2008 box that runs Sophos, SIMS, DHCP and acts as the KM server for the workstations. There is a front-end Sonicwall hardware firewall. There are 70 PCs on the network. I have Dansguardian and squid running on a Ubuntu server box. I wish to set up four groups - One will be totally blocked from internet access, one will be strongly filtered, one will be less strongly filtered and one will be unfiltered. I want Squid to transparently read the AD user information passed by the client browser and for it to transparently authenticate the user into the appropriate group - users A, B and C will always be blocked, D, E and F will be always strongly filtered, users G, H and I will always be weakly filtered, IT Admin will always be unfiltered. Squid will pass the authority to Dansguardian and caching and filtering will then be handled according to group memberships. Obviously all the authentication must be username / password based rather than IP based. And that's it in a nutshell. If I can can get this framework running then it should simply be a case of keeping the filtering lists and config files up to date. So if anyone would like to: A) Give me advice how to do this Or B) Set it all up for me, either here or remotely. then please get in touch. I'm fairly sure we could find a reasonable consultancy fee if someone wishes to come here and do the setup for us. Thanks in anticipation.