pfSense Gold Subscription

Author Topic: Dansguardian package for 2.0  (Read 108527 times)

0 Members and 2 Guests are viewing this topic.

Offline wheelz

  • Full Member
  • ***
  • Posts: 130
    • View Profile
Re: Dansguardian package for 2.0
« Reply #135 on: March 26, 2012, 08:02:25 pm »
Hmm... I restarted the services and now squid won't start.  This is actually what I had happening the first time I set it up.  I get the following when I try to start it from the command line:

Quote
2012/03/26 20:52:00| parseConfigFile: squid.conf:18 unrecognized: 'sslcrtd_children'
2012/03/26 20:52:00| ACL name 'all' not defined!
FATAL: Bungled (null) line 182: http_reply_access allow all
Squid Cache (Version 2.7.STABLE9): Terminated abnormally.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9926
    • View Profile
Re: Dansguardian package for 2.0
« Reply #136 on: March 26, 2012, 08:06:50 pm »
Dansguardian package does not force a squid install if you have squid already installed. Try to reinstall squid package.

Offline wheelz

  • Full Member
  • ***
  • Posts: 130
    • View Profile
Re: Dansguardian package for 2.0
« Reply #137 on: March 26, 2012, 08:33:23 pm »
I fixed it!  ;D  I guess somehow a line got removed from the squid conf.  I just added
Quote
acl all src 0.0.0.0/0.0.0.0
to the custom options and now both squid and dans is working.

Offline wheelz

  • Full Member
  • ***
  • Posts: 130
    • View Profile
Re: Dansguardian package for 2.0
« Reply #138 on: March 26, 2012, 09:25:44 pm »
Is it possible to have Active Directory pass-through authentication so that users don't have to enter a user name and password to browse through squid/dans?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9926
    • View Profile
Re: Dansguardian package for 2.0
« Reply #139 on: March 26, 2012, 09:58:10 pm »
I did it last week with squid + samba + Kerberos but dansguardian ntlm plugin could not detect squid ntlm responses.

The way I got it working was squid with ntlm or negociate then dansguardian then another squid in cache mode.

I did a smal post in portugueses forum with steps I did. Try to google translate it  :)

http://forum.pfsense.org/index.php/topic,47532.msg250366.html#msg250366

Offline wheelz

  • Full Member
  • ***
  • Posts: 130
    • View Profile
Re: Dansguardian package for 2.0
« Reply #140 on: March 28, 2012, 04:19:40 pm »
So I am following your posts on what you did for the samba authentication.  Everything went ok and I ran the kinit command ok but the domain join returns the following:

Quote
net ads join -U MyAdminAccount@MYDOMAIN.LOCAL
Host is not configured as a member server.
Invalid configuration.  Exiting....
Failed to join domain: This operation is only allowed for the PDC of the domain.

Perhaps it is just easier if I post my files.  If you assume the following:

AD Domain is mydomain.local
PDC Emulator DC is mydc.mydomain.local
Admin Account for domain join is MyAdminAccount
pfsense host name is pfsense

Is this configuration correct?

/etc/krb5.conf
Code: [Select]
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/ksadmind.log
[libdefaults]
default_realm = MYDOMAIN.LOCAL.
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
default_tgs_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
default_tkt_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
preferred_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
[realms]
PRIVATE.V.VNET = {
kdc = mydc.mydomain.local.:88
admin_server = mydc.mydomain.local.:749
default_domain = domain.
}
[domain_realm]
.domain. = MYDOMAIN.LOCAL.
domain. = MYDOMAIN.LOCAL.
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

/etc/samba.smb.conf

Code: [Select]
[global]
netbios name = MYDC
workgroup = MYDOMAIN
realm = MYDOMAIN.LOCAL
server string = Domain Proxy Server
encrypt passwords = yes
security = ADS
password server = mydc.mydomain.local
log level = 3
log file = /var/log/samba/%m.log
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
printcap name = /etc/printcap
preferred master = No
dns proxy = No
ldap ssl = no
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind use default domain = yes
cups options = raw

/var/heimdal/kdc.conf

Code: [Select]
[kdcdfefaults]
acl_file = /var/heimdal/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
v4_mode = noreauth
[libdefaults]
default_realm = MYDOMAIN.
[realms]
MYDOMAIN. = {
master_key_type = des-cbc-crc
supported_enctypes = des3-hmac-sha1:normal arcfourhmac:
normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
des-cbc-crc:v4 des-cbc-crc:afs3
}

/var/heimdal/kadm5.acl

Code: [Select]
*/admin@MYDOMAIN.LOCAL *
Additional Squid parameters (I added the acl all src 0.0.0.0/0.0.0.0 to fix my previous issue)

Code: [Select]
acl all src 0.0.0.0/0.0.0.0;auth_param ntlm program /usr/local/bin/ntlm_auth -use-cached-creds -helper-protocol=squid-2.5-ntlmssp;auth_param ntlm children 30;on auth_param ntlm keep_alive;proxy_auth REQUIRED acl password;http_access allow password
I wasn't completely sure about the pathing in the config files as they weren't changed in the other guy's posts that you were helping.  Also I wasn't sure which NETBIOS name to use in the samba config and exactly what is supposed to be in the kadm5.acl file.  I did a copy/paste of the Proxy parameters but it didn't paste right so that's why I wanted to confirm those as well.

Also for when you specify the PDC, does this have to be the DC with the PDC emulator role or can it be any DC?

Thanks in advance!

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9926
    • View Profile
Re: Dansguardian package for 2.0
« Reply #141 on: March 29, 2012, 12:33:12 am »
wheelz,

some checks:
  • Make sure pfsense machine name isn't the same name as any user on your active directory
  • perform a kinit/klist to make sure you have kerberos comunication do active directory before net ads join
  • Pay attention on . and UPPERCASES of kerberos config files, follow exactly what is on squid howto.

att,
Marcello Coutinho

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9926
    • View Profile
Re: Dansguardian package for 2.0
« Reply #142 on: March 29, 2012, 12:37:19 am »
Version 1.5.2 is out with some bug fixes including startup script exclusion on package reinstalls.

Offline jigpe

  • Sr. Member
  • ****
  • Posts: 371
    • View Profile
Re: Dansguardian package for 2.0
« Reply #143 on: March 29, 2012, 03:00:38 am »
Cant do it on x86 :(

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9926
    • View Profile
Re: Dansguardian package for 2.0
« Reply #144 on: March 29, 2012, 07:40:26 am »
Cant do it on x86 :(

What error did you got?

Offline Cino

  • Hero Member
  • *****
  • Posts: 1048
    • View Profile
Re: Dansguardian package for 2.0
« Reply #145 on: March 29, 2012, 10:34:13 am »
strange, dansguardian wont start when I reboot the box.. But i can manually start it. I looked around in my log and I see reloads itself a few times on startup... I can confirm it started during the boot process but then it dies... When I manually start it, it stays running.

Offline FiscoKid

  • Newbie
  • *
  • Posts: 2
    • View Profile
Re: Dansguardian package for 2.0
« Reply #146 on: March 29, 2012, 01:07:50 pm »
I am trying to install Dansguardian into PFsense It says on boot up that it started, however in services it reported it has stopped. When I go into the webgui for the settings it has the icapserver address in the contentscannertimeout field. Below is the log. I corrected the dansguardian configuation file to read the default of 60 seconds, however the web gui field will not reflect the change. On reboot the icapserver address is back in the .conf file.

Mar 29 13:54:10    root: /usr/local/etc/rc.d/dansguardian: WARNING: failed to start dansguardian
Mar 29 13:54:10    dansguardian[666]: Error parsing the dansguardian.conf file or other DansGuardian configuration files
Mar 29 13:54:10    dansguardian[666]: Config problem; check allowed values for contentscannertimeout
Mar 29 13:47:06    root: /usr/local/etc/rc.d/dansguardian: WARNING: failed to start dansguardian
Mar 29 13:47:06    dansguardian[15796]: Error parsing the dansguardian.conf file or other DansGuardian configuration files
Mar 29 13:47:06    dansguardian[15796]: Config problem; check allowed values for contentscannertimeout

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9926
    • View Profile
Re: Dansguardian package for 2.0
« Reply #147 on: March 29, 2012, 01:31:09 pm »
FiscoKid,

What field gui and config options are wrong?

Offline Cino

  • Hero Member
  • *****
  • Posts: 1048
    • View Profile
Re: Dansguardian package for 2.0
« Reply #148 on: April 01, 2012, 07:56:52 am »
strange, dansguardian wont start when I reboot the box.. But i can manually start it. I looked around in my log and I see reloads itself a few times on startup... I can confirm it started during the boot process but then it dies... When I manually start it, it stays running.

i made a quick rc.d script to start dansguardian on startup..

Offline Macom2007

  • Full Member
  • ***
  • Posts: 121
    • View Profile
Re: Dansguardian package for 2.0
« Reply #149 on: April 01, 2012, 12:06:46 pm »
I get this error if i want to use Dansguardian :

dansguardian[723]: Error connecting to proxy

Squid is installed and running ... Any help ?