--- In dansguardian@y..., "b k" <bkahuna2k@z...> wrote:
> Greg,
>
> Do you remember what you changed in the host name in Linux Network
Configuation
> to get it to work...  I'm experiencing the same issue on RH 7.1
>
> -BK

I changed the 127.0.0.1 to localhost.  I used the GUI netwok
configuration tool in the system menu to do it.  Hope that helps.

Greg

>
>
> RE: ---> SUCCESS!  DG is running fine, fast and filtering!  I used
the
>
> uncompiled file of DG 1.1.  I think the problem was the host name in
>
> the Linux network configuration.  Hope this helps others.
>
> Thanks all.
>
> Greg Crawford
>
> ___________________________________________________________________
> To get your own FREE ZDNet Onebox - FREE voicemail, email, and fax,
> all in one place - sign up today at http://www.zdnetonebox.com

Dear List,

I am wondering if someone can help answer my problem?? I have recently
compiled and installed successfully the latest version of DansGuardian. It
works like a charm!!

However, dansguardian does not seem to be passing my username to squid.
Eachtime, my username, in squid's access.log file is being returned as "-",
which means that squid is not recording my username.

Turning off dansguardian, records my username in squid's access.log

All configuration settings in "/etc/dansguardian/dansguardian.conf" is
correct. Is there something I am overlooking??

Thanks in Anticipation,

Thomas Adam
Linux Co-ordinator at the Purbeck School (Network Support)
Not for long though

www.purbeck.dorset.sch.uk


Please note that the content of this message is confidential between the
original sender and the intended recipient(s) of the message. If you are not an
intended recipient and/or have received this message in error, kindly disregard
the content of the message and return it to the original sender.

If you have any complaints about this message please reply to:
        office@...

The Purbeck School E-Mail server running:
        users.purbeck.dorset.sch.uk

In message <005d01c103b8$825ec800$6a72010a@...> you wrote:

> Dear List,
>
> I am wondering if someone can help answer my problem?? I have recently
> compiled and installed successfully the latest version of DansGuardian. It
> works like a charm!!
>
> However, dansguardian does not seem to be passing my username to squid.
> Eachtime, my username, in squid's access.log file is being returned as "-",
> which means that squid is not recording my username.
>
> Turning off dansguardian, records my username in squid's access.log
>
> All configuration settings in "/etc/dansguardian/dansguardian.conf" is
> correct. Is there something I am overlooking??

Hmmm, odd.  Is it proxy authentication you are using?

I have personally installed DG with SG and squid using simple proxy
authentication (the clear text/mime one) on about 10 sites.  I did nothing
special and all of them log in the squid logs the user name.  The only
difference that comes to mind is that I changed the emulate_httpd_logs to on.

DG should just pass through it all authentication information.  And it does.

I think we need a squid expert to answer the question (I am not).

Insidently, DG2 logs the user in its logs so you won't need the squid logs
for this.  But its not ready yet.  Selected beta testing is in a few weeks.

[snip]

--
Daniel Barron

Dear List,

I have tried Dan's suggestion, and it is still not working. One thing that I
did forget to mention, is that we are running an identd server on Windows 9x
workstations. Does this matter??

In squid, we are using an "ident ACL" to tell squid to retrieve the
usernamem from the identd server. In each case, DG is still not passing the
username forward to squid/squidGuard.

Any further thoughts welcome.
Regards,

Thomas Adam


** Original message below **

Hmmm, odd.  Is it proxy authentication you are using?

I have personally installed DG with SG and squid using simple proxy
authentication (the clear text/mime one) on about 10 sites.  I did nothing
special and all of them log in the squid logs the user name.  The only
difference that comes to mind is that I changed the emulate_httpd_logs to
on.

DG should just pass through it all authentication information.  And it does.

I think we need a squid expert to answer the question (I am not).

Insidently, DG2 logs the user in its logs so you won't need the squid logs
for this.  But its not ready yet.  Selected beta testing is in a few weeks.

[snip]

--
Daniel Barron



Please note that the content of this message is confidential between the
original sender and the intended recipient(s) of the message. If you are not an
intended recipient and/or have received this message in error, kindly disregard
the content of the message and return it to the original sender.

If you have any complaints about this message please reply to:
        office@...

The Purbeck School E-Mail server running:
        users.purbeck.dorset.sch.uk

I got Dansguardian running on Mandrake's Single Network Firewall.
Runs Great...
Anyone interested in how to do it?

-BK

___________________________________________________________________
To get your own FREE ZDNet Onebox - FREE voicemail, email, and fax,
all in one place - sign up today at http://www.zdnetonebox.com

On Wednesday 04 July 2001 11:23, you wrote:
> I got Dansguardian running on Mandrake's Single Network Firewall.
> Runs Great...
> Anyone interested in how to do it?

What a question, but ofcause we are (well I am :o)

Mads

--- In dansguardian@y..., "b k" <bkahuna2k@z...> wrote:
> I got Dansguardian running on Mandrake's Single Network Firewall.
> Runs Great...
> Anyone interested in how to do it?

Yes.  If you could do a nice HOWTO I can stick it on the DG web site.
Or, if you want to put it on a site of your own, I can link to it in
the HOWTO section.

--- In dansguardian@y..., "n6tadam" <n6tadam@u...> wrote:
> Dear List,
>
> I have tried Dan's suggestion, and it is still not working. One
thing that I
> did forget to mention, is that we are running an identd server on
Windows 9x
> workstations. Does this matter??
>
> In squid, we are using an "ident ACL" to tell squid to retrieve the
> usernamem from the identd server. In each case, DG is still not
passing the
> username forward to squid/squidGuard.
>
> Any further thoughts welcome.

The connection to squid is comming from the linux server itself (i.e.
loopback), not from the PCs.  The PCs connect to DG, then DG connects
to the proxy.  Squid will be trying to find the ident of the linux
itself.

It is not that DG is not passing the username through as it never
gets passed to it.  Squid makes a seperate connection to the
requesting PC and from that determines the username.  Squid is unable
to determine the original IP and has no mechanism for doing so even
though it supports the /insertion/ of the X-Forwarded-For.  It just
ignores it.

I do not know of a solution to your problem.

Ok guys...

Here's the link for the "How to get DG 1.1.x running on MandrakeSecurity
SNF.

http://www.bkahuna.scripterz.org/dg-on-snf.html

If you discover any shortcuts or improvements let me know and I'll update
it.

I wrote/tried this and it does work.

-BK

___________________________________________________________________
To get your own FREE ZDNet Onebox - FREE voicemail, email, and fax,
all in one place - sign up today at http://www.zdnetonebox.com

Anyone got this one figured out yet??

Sure would be nice not to have to configure browsers to proxy port 8080.
I've been able to configure a transparent proxy with squid and sg but
when dansguardian is added it fails to function properly.

Any ideas?


-BK

---- "b k" <bkahuna2k@...> wrote:
> Does anyone know how to get Dansguardian to run as a transparent proxy
> on standard RH 6.2 with squid, squidguard and DG installed?
>
> -BK
>
> ___________________________________________________________________
> To get your own FREE ZDNet Onebox - FREE voicemail, email, and fax,
> all in one place - sign up today at http://www.zdnetonebox.com
>
>
> To unsubscribe from this group, send an email to:
> dansguardian-unsubscribe@egroups.com
>
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>
>
>
>

___________________________________________________________________
To get your own FREE ZDNet Onebox - FREE voicemail, email, and fax,
all in one place - sign up today at http://www.zdnetonebox.com

-----Original Message-----
From: b k [mailto:bkahuna2k@...]
Sent: Wednesday, July 04, 2001 11:58 PM
To: dansguardian@yahoogroups.com
Subject: Re: [dansguardian] Transparent Proxy w/ DG on RH 6.2?

Anyone got this one figured out yet??

Sure would be nice not to have to configure browsers to proxy port 8080.
I've been able to configure a transparent proxy with squid and sg but
when dansguardian is added it fails to function properly.

Any ideas?


-BK

---- "b k" <bkahuna2k@...> wrote:
> Does anyone know how to get Dansguardian to run as a transparent proxy
> on standard RH 6.2 with squid, squidguard and DG installed?
>
> -BK
>
> ___________________________________________________________________
> To get your own FREE ZDNet Onebox - FREE voicemail, email, and fax,
> all in one place - sign up today at http://www.zdnetonebox.com
>
>
> To unsubscribe from this group, send an email to:
> dansguardian-unsubscribe@egroups.com
> 
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>
>
>
>

___________________________________________________________________
To get your own FREE ZDNet Onebox - FREE voicemail, email, and fax,
all in one place - sign up today at http://www.zdnetonebox.com


To unsubscribe from this group, send an email to:
dansguardian-unsubscribe@egroups.com


Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.

In message <20010705041747.QBSP18323.mta09.onebox.com@...> you wrote:

> Ok guys...
>
> Here's the link for the "How to get DG 1.1.x running on MandrakeSecurity
> SNF.
>
> http://www.bkahuna.scripterz.org/dg-on-snf.html
>
> If you discover any shortcuts or improvements let me know and I'll update
> it.
>
> I wrote/tried this and it does work.
>
> -BK

Looks good, but I have some comments/questions:

Why do you use the precompiled nb++?  It's rather large and I don't actually
like people using it if they don't need to.  I have a 2Mbit down and 256Kbit
up connection.  And it's really annoying when I'm playing counter-strike to
be lag fragged.  It's also quite large for people with modems to download.

Your accessdeniedaddress looks a bit odd.  Why is that?

I've noticed that it's called DG 1.x on the title of the page.  Some people
may find your page and wonder what it means.  It would be better if it said
DansGuardian 1.1.x (note the exta .1).

DG1.1.1 (which has never been released properly yet) has an issue which is
that it starts up just after squid and checks that it can connect to squid,
otherwise it does not start up.  This is desirable.  However, squid forks
into the background before it is ready to recieve connections so on some
machines DG tests the link to squid before squid is ready so it exits.  Is
this why you have the sleep?  I will fix this before I do a new release.

It's great to have your input like this!  Thanks.

--
Daniel Barron

Here's a link for another howto.

Or you can just go to http://www.bkahuna.scripterz.org
Both howto's are there.

-BK

____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1

To All:

1) Please be nice and try avoiding d/l'ing the compiled version of nb++ from
Dan's site if possible...(we all love CS!)

2) I changed the Howto to reflect 1.1.x in the title.

3) The accessdeniedaddress looks funny due to SFN preinstalls apache to a
different port / directory.  (it does work if set to what's in the howto)

4) Dan is right the sleep was added to allow squid to fully come up so dg
would not fail on start up.  Not a problem if you are not using version 1.1.1

5) My email service died today so my new address is:
bkahuna2k@...

6) Any spots left to beta version 2?

7) If you know ipchains well you might be able to get around moving the http
port.  Let me know how if you know and I update the howto.

-BK

In message <20010705041747.QBSP18323.mta09.onebox.com@...> you wrote:

> Ok guys...
>
> Here's the link for the "How to get DG 1.1.x running on MandrakeSecurity
> SNF.
>
> http://www.bkahuna.scripterz.org/dg-on-snf.html
>
> If you discover any shortcuts or improvements let me know and I'll update
> it.
>
> I wrote/tried this and it does work.
>
> -BK

Looks good, but I have some comments/questions:

Why do you use the precompiled nb++?  It's rather large and I don't actually
like people using it if they don't need to.  I have a 2Mbit down and 256Kbit
up connection.  And it's really annoying when I'm playing counter-strike to
be lag fragged.  It's also quite large for people with modems to download.

Your accessdeniedaddress looks a bit odd.  Why is that?

I've noticed that it's called DG 1.x on the title of the page.  Some people
may find your page and wonder what it means.  It would be better if it said
DansGuardian 1.1.x (note the exta .1).

DG1.1.1 (which has never been released properly yet) has an issue which is
that it starts up just after squid and checks that it can connect to squid,
otherwise it does not start up.  This is desirable.  However, squid forks
into the background before it is ready to recieve connections so on some
machines DG tests the link to squid before squid is ready so it exits.  Is
this why you have the sleep?  I will fix this before I do a new release.

It's great to have your input like this!  Thanks.

--
Daniel Barron


To unsubscribe from this group, send an email to:
dansguardian-unsubscribe@egroups.com


Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/



____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1

In message <20010706194737.25164.qmail@...> you wrote:

> To All:
>
> 1) Please be nice and try avoiding d/l'ing the compiled version of nb++
> from Dan's site if possible...(we all love CS!)

:)

>
> 2) I changed the Howto to reflect 1.1.x in the title.

Just looked now and can see no change?

[snip]
>
> 4) Dan is right the sleep was added to allow squid to fully come up so dg
> would not fail on start up. Not a problem if you are not using version
> 1.1.1

I'll try and fix it this weekend and release 1.1.2.  Remember 1.1.1 has
never been released properly - I just wanted people to test it and report
back.

>
> 5) My email service died today so my new address is:
> bkahuna2k@...
>
> 6) Any spots left to beta version 2?

You just got the last one ;)

[snip]

--
Daniel Barron

Daniel Barron <dg@...> wrote:

>> 2) I changed the Howto to reflect 1.1.x in the title.

>Just looked now and can see no change?

[SNIP]



OOPS...my mistake...should be fixed now

-BK


____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1

Get it from here:

http://dansguardian.org/?page=download

http://dansguardian.org

It resolves all known issues except some problems with RH7.1 which I am yet
to replicate.

--
Daniel Barron

Is there any way to display a HTML page instead of the CGI script that
Dansguardian uses? I tried naming a HTML page in the .conf file, but i just
get an error page in the browser. Please tell me there's a way to do it
without changing the code!

Many Thanks

Laurence J Praties
Systems Administrator
Gazelle Informatics Ltd
tel: 0871 871 0222
fax:0871 871 0223
laurence.praties@...

Sure just change the line:

accessdeniedaddress = http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl
<http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl>

to point to whatever page you want to on your internal http server.
Although I'm not sure why you would want to.  The CGI page is great.  It
provides very useful info about why the page is blocked.  Also I'm not sure
what the error is that your receiving, but if you point the
accessedeiedaddress to an page on the web for example http:\\www.yahoo.com"
it may help you to eliminate an access or configuration issue with your
internal http server.

		 -----Original Message-----
		 From: laurence@... [mailto:laurence@...]
		 Sent: Monday, July 09, 2001 9:48 AM
		 To: dansguardian@yahoogroups.com
		 Subject: [dansguardian] HTML instead of CGI

		 Is there any way to display a HTML page instead of the CGI
script that
		 Dansguardian uses? I tried naming a HTML page in the .conf
file, but i just
		 get an error page in the browser. Please tell me there's a
way to do it
		 without changing the code!

		 Many Thanks

		 Laurence J Praties
		 Systems Administrator
		 Gazelle Informatics Ltd
		 tel: 0871 871 0222
		 fax:0871 871 0223
		 laurence.praties@...


		 To unsubscribe from this group, send an email to:
		 dansguardian-unsubscribe@egroups.com


		 Your use of Yahoo! Groups is subject to
http://docs.yahoo.com/info/terms/

I did exactly that. Just edit the .conf file.
accessdeniedaddress = www.foo.com

It works well for us.

I got it all up and Running on RH7.1 Friday and tested over the weekend.
Runs great.




Bryan Dyson
LAN Administrator
Solana Beach Presbyterian Church
LAN_Administrator@...

Is there any way to display a HTML page instead of the CGI script that
Dansguardian uses? I tried naming a HTML page in the .conf file, but i just
get an error page in the browser. Please tell me there's a way to do it
without changing the code!

Many Thanks

Laurence J Praties
Systems Administrator
Gazelle Informatics Ltd
tel: 0871 871 0222
fax:0871 871 0223
laurence.praties@...


To unsubscribe from this group, send an email to:
dansguardian-unsubscribe@egroups.com


Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Here's and idea to speed the filter in version 2.

Have dansguardian cache the url once a page has been scanned.  Then if a
person goes back to the site it can just pass through rather than rescanning
it. Then you could set an age limit on it that could be configurable though
dansguardian.conf.  For example a week or 2 week cache.

-BK

____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1

I just tried version 1.1.2 and it seems faster than 1.1.0

Anyone agrees/disagrees?

Will test some more

Regards

Mads

I had some problems with a popup at one site were developing

When logging off the username "teste@..." the page was blocked by
the bannedextensions list which contains the extension .com

The popup code is: (login is the username)

function abrepoplogoff() {
   var janela = window.open("/port/menu/pop_logoff.asp?login=" +
parent.topoescondidositenatura.document.comunidade.login.value.toLowerCase()
,"","width=360,height=160,toolbar=no,location=no,status=no,menubar=no,scroll
bars=no,resizable=no");
}

The problem continues to appear in version 1.1.2 of DG.

So I have to free access to .com downloads, which I really don't like

Any ideas?

Regards,

Mads

Guys and Girls,

Try changing the /etc/hosts file

127.0.0.1               localhost.localdomain localhost

to

127.0.0.1               localhost localhost.localdomain

That did it for me

Regards,

Mads

New HowTo's added...also update some...reduced /simplified the steps.

I added this page today...
Running Dansguardian as a Transparent Proxy on SNF 7.2

Here's the link:

http://www.bkahuna.scripterz.org

-BK


____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1

There is a problem with DG when accessing urls with .exe or .com

I entered these extensions in the bannedextensions list to block download of
these types, DG just block all requests containing these "words".

There is a lot of site that uses this funcionality. I wonder why this haven't
been reported before, some webemail clients uses this approach and one of our
users alerted me of the error.

Are you aware of this Daniel, I haven't seen any posting from you today, are
you taking a vacation? :0)

Regards,

Mads

What about the mime type? Have you checked that?

I personally do not block any extensions, I use it for bad site filtering
and it work great for that!

-Andy

		 -----Original Message-----
		 From: Mads Rasmussen [mailto:mads@...]
		 Sent: Tuesday, July 10, 2001 4:05 PM
		 To: dansguardian@yahoogroups.com
		 Subject: [dansguardian] problems accessing urls with
.exe or .com (NOT downloads)


		 There is a problem with DG when accessing urls with .exe or
.com

		 I entered these extensions in the bannedextensions list to
block download of
		 these types, DG just block all requests containing these
"words".

		 There is a lot of site that uses this funcionality. I wonder
why this haven't
		 been reported before, some webemail clients uses this
approach and one of our
		 users alerted me of the error.

		 Are you aware of this Daniel, I haven't seen any posting
from you today, are
		 you taking a vacation? :0)

		 Regards,

		 Mads

		 To unsubscribe from this group, send an email to:
		 dansguardian-unsubscribe@egroups.com


		 Your use of Yahoo! Groups is subject to
http://docs.yahoo.com/info/terms/

running DG 1.1.2 generates zombies - is this normal?

After I deleted all phrases performance improved alot on our Rh 7.1 server.
I'm just left with the zombie process, but it dies rather quickly, it seems
DG spawns processes after demand and when killing them a zombie is being
generated (it a process whos father died, right?)

Before I deleted the phrases DG used 100 % CPU and every user was complaining
(we have 120 users using internet access in their work).
Now it seems fast and nice, just my problem is that DG is only blocking
downloads now. No "bad" sites is being blocked by DG (I have squidguard but
DG could catch sites that SG can't)
Now the it is using between 10 and 90 % of the CPU, increasing and decreasing.

Any chance of a better performance? (like a kernel hack or something?) How
about increasing the number of DG processes?

Any other have the same experience with DG 1.1.2

Regards,

Mads

In message <01071111253900.01730@kennedy> you wrote:

>
> running DG 1.1.2 generates zombies - is this normal?
>

No.

> After I deleted all phrases performance improved alot on our Rh 7.1
> server.  I'm just left with the zombie process, but it dies rather quickly,
> it seems  DG spawns processes after demand and when killing them a zombie
> is being  generated (it a process whos father died, right?)

I always thought of it as a mother.  A zombie (as reported by top) is also
a child process that the kernel is waiting to tell the parent process has
died and the parent is not acknowledging it.

>
> Before I deleted the phrases DG used 100 % CPU and every user was
> complaining  (we have 120 users using internet access in their work). Now
> it seems fast and nice, just my problem is that DG is only blocking
> downloads now. No "bad" sites is being blocked by DG (I have squidguard but
> DG could catch sites that SG can't) Now the it is using between 10 and 90 %
> of the CPU, increasing and decreasing.

This is not normal.  It does seem DG has problems with RH7.1.  Why are you
using a 'not thought of as stable' version in a production server?  Use
RH6.2 with all the patches.  You will find a /lot/ of secure linuxes do this,
for example, smoothwall.

>
> Any chance of a better performance? (like a kernel hack or something?) How
> about increasing the number of DG processes?
>

No, this is not a solution.  It is clearly a bug in nb++ or RH7.1.
Obviously, DG2 will fix this.  However, in the mean time, I think I need to
work out where the bug is and solve it or make a workaround.

Perhaps there is a kind and clever person who can do a trace on DG and find
out where in the code it is eating up the cpu?

I've just completed opposing forces so can get back to DG ;)  And I have a
long weekend, so expect some work done or a fix soon.  But help would be
nice!

--
Daniel Barron

In message <01071017044202.01521@kennedy> you wrote:

>
> There is a problem with DG when accessing urls with .exe or .com
>
> I entered these extensions in the bannedextensions list to block download
> of  these types, DG just block all requests containing these "words".
>
> There is a lot of site that uses this funcionality. I wonder why this
> haven't  been reported before, some webemail clients uses this approach and
> one of our  users alerted me of the error.

After some thought, what must be happening is that the url ends in .com or
.exe, but without the trailing '/'.

>
> Are you aware of this Daniel, I haven't seen any posting from you today,
> are  you taking a vacation? :0)

Yes I was taking a break.  I got round to playing Opposing Forces, then
looked up and it was three days later! ;)

It is very odd it has not been spotted before.  It, obviously, only effects
stupi^H^H^H^H^H ill advised web server admins who use non unix-like web
servers.

It is a bug in the logic that extracts the url from the HTTP request header,
or extension checking code.  (watch this space).

--
Daniel Barron