_Jo_

Finally got DG 2.9 working with NTLM. Tweaked the log location permissions, then found I couldn't restart the service "I seem to be running already", (permissions wrong on /etc/init.d/dansguardian) tweaked that as well, then had an error about not being able to start because of some files in /tmp, so cleaned them up and it appears to be working, and logging usernames. I've been told now that the ISA does support Basic. (I've still not managed to get it to work though.) Does anyone have a simple squid.conf I could look at which passes basic auth to an upstream ISA, or uses one account to authenticate with the ISA? (so I don't have to use NTLMAPS) My squid.conf is a bit messy at the moment because I've used 101 sites and examples to try and get it working! Thanks everyone for your help so far!

Both commented out. # daemonuser='nobody' # daemongroup='nobody' (I just tried uncommenting them and restarting, and same error.) Edit: Hm. Just tried changing that to # daemonuser='nobody' # daemongroup='nogroup' and restarted: Error openting / creating log file. (Check ownership and access rights). I am running as nobody and I am trying to open /var/log/dansguardian/access.log

I have been configuring it manually. I put webmin on as an afterthought to view the log files. Ok... installing DG 2.9 : installs ok, but when I try to run it I get Unable to getgrnam(): Success and DG won't start.

2 Instances of squid? That sounds complicated. I'm having trouble configuring one instance properly at the moment! (I'll get the hang of it eventually) I'll give 2.9 a try. (the webmin report viewer said it didn't work with that version. Typical.) Is there any way I can get squid to talk to the ISA directly? ISA is set not to allow basic auth. I don't really want to use NTLMAPS as we could have 250 people connecting at the same time and I'm not sure how it'll cope.

Hi Geoff, It's running Dansguardian 2.8.0.6

The ISA doesn't appear to support basic authentication. So I've tried putting NTLMAPS on the server and running all internet access through that so: Client -> dansguardian -> squid -> ntlmaps -> ISA While this works, I'm not sure if it will work quickly enough for 250 users at the same time. The clients still get prompted for authentication by squid when the open a new browser. Is there any way to avoid this and still record the usernames?

Oops. I remember reading that bit now. Back to square 1. Thanks for pointing that out. I wanted to put all pupil requests through DansGuardian before they went on to the LEA ISA proxy server, which requires authentication. They also log all access and put requests through websense. I could put them all through NTLMAPS, but as far as I know, all access would then be recorded at the LEA under the same username. (This is the only way I've configured it before.) @Geoff: "Alternatively add an IP rule so that squid does not need to authenticate." Is this simple? Would DG still work with this configuration? I thought squid would have to authenticate with the ISA. Jo

I've tried for a few days now to get my squid configuration to work with a parent ISA server using NTLM. I've read through a lot of really good threads on edugeek and elsewhere to get it this far, but I just can't get the authentication to work. Initial installation seemed to go ok. Samba, winbind appear to work. However, when I request a page in a browser, I get 3 pop up boxes asking for user / password. squid access.log shows: 1206709266.220 7 TCP_denied/407 2287 GET http://www.google.co.uk/ - NONE/- text/html After 3 retries of putting in a user/password (and I was hoping it wouldn't prompt at all) I then get an error page from the parent proxy: HTTP 407 Proxy Authentication Required - The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. (12209) ----------------------------------------------------------------- Internet Security and Acceleration Server ISA Server: ISA. Via: 1.0 UBFW.:3128 (squid/2.6.STABLE14) wbinfo -t checking the trust secret via RPC calls succeeded net ads status -U Outputs a lot of information about the squid host from AD my squid.conf contains cache_peer servername parent 8080 0 default no-query login=PASS auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp auth_param ntlm children 5 authenticate_ttl 180 seconds auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic acl ntlm_users proxy_auth REQUIRED http_access allow ntlm_users IF I change the parent proxy address to that of another Linux box I have here running NTLMAPS, the request goes through and I can browse. So I must be getting something really wrong with my squid.conf as far as the authentication side goes. I've tried specifying a user/password on the cache_peer line and that didn't work either. I still got prompted at the client, and it still failed. Any help appreciated, getting a bit fed up! Jo Ubuntu server 7.10 Squid v2.6.STABLE14 NTLM_AUTH Version 3.0.26a