= Dansguardian =

Nachdem ich schon viel in eurem Wiki gelesen habe, muß ich auch
mal etwas zurück geben (habe ich schon viel zu lange vor mir her
geschoben)

=== Was ist das eigentlich ===

Dansguardian ist ein Tranparentproxy, der den Inhalt der Webseite
und nicht nur - wie allgemein üblich - die URL nach Begriffen filtert.

zu bekommen ist er unter [http://dansguardian.org/]

Er steht unter GPL ist aber für den kommerziellen Einsatz
gebürenpflichtig


=== Einrichten von Dansguardian auf Suse 8.1 ===

Es reicht aus wenn ihr die Radhat rpm nehmt und auf der Maschine
einspielt! Ihr könnt es auch selber Kompilieren. Der Befehl dazu
steht in der Readme! Wenn ihr es als rpm installiert, müßt ihr
noch das cgi von /var/www/cgi-bin/ nach /srv/www/cgi-bin/
verschieben .

=== Konfigurieren ===

Die Konfiguration ist eigentlich soweit fertig. Es sind nur einige
Anpassungen sind zu machen!

  # Web Access Denied Reporting (does not affect logging)
  #
  # -1 = log, but do not block - Stealth mode
  #  0 = just say 'Access Denied'
  #  1 = report why but not what denied phrase
  #  2 = report fully 
  #  3 = use HTML template file (accessdeniedaddress ignored)
  reportinglevel = 3

  # HTML Template file path.
  # Only used when reportinglevel is set to 3.
  # When used, DansGuardian will display the HTML file instead of
  # using the perl cgi script.  This option is faster, cleaner
  # and easier to customise the access denied page.
  htmltemplate = '/etc/dansguardian/template.html'

  # Logging Settings
  # 0 = none  1 = just denied  2 = all text based  3 = all requests
  loglevel = 2

  # Log Exception Hits
  # Log if an exception (user, ip, URL, phrase) is matched and so
  # the page gets let through.  Can be useful for diagnosing
  # why a site gets through the filter.  on | off
  logexceptionhits = on

  # Log File Format
  # 1 = DansGuardian format        2 = CSV-style format
  # 3 = Squid Log File Format      4 = Tab delimited
  logfileformat = 1

  # Network Settings
  #
  # the IP that DansGuardian listens on.  If left blank DansGuardian will
  # listen on all IPs.  That would include all NICs, loopback, modem, etc.
  # Normally you would have your firewall protecting this, but if you want
  # you can limit it to only 1 IP.  Yes only one.
  filterip =

  # the port that DansGuardian listens to
  # It needs to be greater than 1024
  filterport = 8080

  # the ip of the proxy (default is the loopback - i.e. this server)
  proxyip = 127.0.0.1

  # the port DansGuardian connects to proxy on
  proxyport = 3128

  # accessdeniedaddress is the address of your web server to which the cgi
  # dansguardian reporting script was copied
  accessdeniedaddress = 'http://192.168.2.1/cgi-bin/dansguardian.pl'

  # Content filtering files location
  bannedphraselist = '/etc/dansguardian/bannedphraselist'
  exceptionphraselist = '/etc/dansguardian/exceptionphraselist'
  weightedphraselist = '/etc/dansguardian/weightedphraselist'
  bannedsitelist = '/etc/dansguardian/bannedsitelist'
  exceptionsitelist = '/etc/dansguardian/exceptionsitelist'
  exceptionurllist = '/etc/dansguardian/exceptionurllist'
  bannedurllist = '/etc/dansguardian/bannedurllist'
  bannedregexpurllist = '/etc/dansguardian/bannedregexpurllist'
  bannedextensionlist = '/etc/dansguardian/bannedextensionlist'
  bannedmimetypelist = '/etc/dansguardian/bannedmimetypelist'
  bannediplist = '/etc/dansguardian/bannediplist'
  exceptioniplist = '/etc/dansguardian/exceptioniplist'
  banneduserlist = '/etc/dansguardian/banneduserlist'
  exceptionuserlist = '/etc/dansguardian/exceptionuserlist'
  picsfile = '/etc/dansguardian/pics'
  contentregexplist = '/etc/dansguardian/contentregexplist'

  # messages file for internationalisation.
  languagefile = '/etc/dansguardian/messages'

  # Weighted phrase mode
  # There are 3 possible modes of operation:
  # 0 = off = do not use the weighted phrase feature.
  # 1 = on, normal = normal weighted phrase operation.
  # 2 = on, singular = each weighted phrase found only counts once on a page.
  weightedphrasemode = 2

  # Naughtyness limit
  # This the limit over which the page will be blocked.  Each weighted phrase is given
  # a value either positive or negative and the values added up. Phrases to do with
  # good subjects will have negative values, and bad subjects will have positive
  # values.  See the weightedphraselist file for examples.
  # As a guide:
  # 50 is for young children,  100 for old children,  160 for young adults.
  naughtynesslimit = 50


  # Show weighted phrases found
  # If enabled then the phrases found that made up the total which excedes
  # the naughtyness limit will be logged and, if the reporting level is
  # high enough, reported. on | off
  showweightedfound = on


  # Positive result caching for text URLs
  # Caches good pages so they don't need to be scanned again
  # 0 = off (recommended for ISPs with users with disimilar browsing)
  # 100 = recommended for schools
  urlcachenumber = 100
  #
  # Age before they are stale and should be ignored in seconds
  # 0 = never
  # 300 = reccomended
  urlcacheage = 300
  # Reverse lookups for banned site and URLs.
  # If set to on, DansGuardian will look up the forward DNS for an IP URL
  # address and search for both in the banned site and URL lists. This would
  # prevent a user from simply entering the IP for a banned address.
  # It will reduce searching speed somewhat so unless you have a local caching
  # DNS server, leave it off and use the Blanket IP Block option in the
  # bannedsitelist file instead.
  reverseaddresslookups = off

  # Build bannedsitelist and bannedurllist cache files.
  # This will compare the date stamp of the list file with the date stamp of
  # the cache file and will recreate as needed.
  # If a bsl or bul .processed file exists, then that will be used instead.
  # It will increase process start speed by 300%.  On slow computers this will
  # be significant.  Fast computers do not need this option. on | off
  createlistcachefiles = on

  # POST protection (web upload and forms)
  # does not block forms without any file upload, i.e. this is just for
  # blocking or limiting uploads
  # measured in kilobytes after MIME encoding and header bumph
  # use 0 for a complete block
  # use higher (e.g. 512 = 512Kbytes) for limiting
  # use -1 for no blocking
  #maxuploadsize = 512
  #maxuploadsize = 0
  maxuploadsize = -1

  # Max content filter page size
  # Sometimes web servers label binary files as text which can be very
  # large which causes a huge drain on memory and cpu resources.
  # To counter this, you can limit the size of the document to be
  # filtered and get it to just pass it straight through.
  # This setting also applies to content regular expression modification.
  # The size is in Megabytes - eg 2 = 2048Kb
  # use 0 for no limit
  maxcontentfiltersize = 1

  # Username identification methods (used in logging)
  # You can have as many methods as you want and not just one.  The first one
  # will be used then if no username is found, the next will be used.
  # * proxyauth is for when basic proxy authentication is used (no good for
  #   transparent proxying).
  # * ntlm is for when the proxy supports the MS NTLM authentication
  #   protocol.  (Only works with IE5.5 sp1 and later).  **NOT IMPLEMENTED**
  # * ident is for when the others don't work.  It will contact the computer
  #   that the connection came from and try to connect to an identd server
  #   and query it for the user owner of the connection.
  usernameidmethodproxyauth = off
  usernameidmethodntlm = off # **NOT IMPLEMENTED**
  usernameidmethodident = off

  # Misc settings

  # if on it adds an X-Forwarded-For: <clientip> to the HTTP request
  # header.  This may help solve some problem sites that need to know the
  # source ip. on | off
  forwardedfor = off

  # if on it uses the X-Forwarded-For: <clientip> to determine the client
  # IP. This is for when you have squid between the clients and DansGuardian.
  # Warning - headers are easily spoofed. on | off
  usexforwardedfor = off

  # sets the maximum number of processes to sporn to handle the incomming
  # connections.  This will prevent DoS attacks killing the server with
  # too many spawned processes.
  # On large sites you might want to double or triple this number.
  maxchildren = 120

  # if on it logs some debug info regarding fork()ing and accept()ing which
  # can usually be ignored.  These are logged by syslog.  It is safe to leave
  # it on or off
  logconnectionhandlingerrors = off

=== Iptables zum umleiten auf den Transparentproxy ===

* Ändern der iptables Regeln (unter suse kann man das in die /etc/initd/boot.local eintragen) 
  
  iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j REDIRECT --to-port 8080
  # Alle Anfragen von Port 80 zum Port 8080 (dort arbeitet DansGuardian) weiterleiten

* Speren von Squid Port

  iptables -A INPUT -m tcp -p tcp -s ! 127.0.0.1 --dport 3128 -j DROP
  # Dmit keiner direkt auf den Squid kann und somit DansGuardian umgeht

=== Ein Anfang ===

1. Squid Kompilieren mit der Option "--enable-linux-netfilter"
2. Squid so einrichten, dass er läuft 

Folgende Zeilen in der squid.conf ändern

  httpd_accel_host virtual
  httpd_accel_port 80
  httpd_accel_single_host off
  httpd_accel_with_proxy on
  httpd_accel_uses_host_header on

3a. Ändern der IpTables Regeln (unter suse kann man das in die /etc/initd/boot.local eintragen)
 
  iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j REDIRECT --to-port 8080

Alle Anfragen von Port 80 zum Port 8080 dort arbeitet DansGuardian weiterleiten

Wenn man will, kann man DansGuardian auch auf einer anderen
Maschine laufen lassen
 
  iptables -t nat -A PREROUTING -m tcp -p tcp -s ! {DG's IP ADDRESS} --dport 80 -j DNAT --to {DG's IP ADDRESS}:8080

Die "!" sind wichtig weil man nicht wie normal vom loopback (127.0.0.1) aus geht

3b. Speren von Squid Port

  iptables -A INPUT -m tcp -p tcp -s ! 127.0.0.1 --dport 3128 -j DROP

Das ist nötig damit keiner direkt Squid als Proxy angeben kann und
so mit DansGuardian umgehen würde! 

4. Default Gateway 
Der Recher sollte als Standart-Gateway für den Intertnet-Zugang
eigerichtet werden. Das kann im jedem Client eingestellt werden oder
oder in der /etc/dhcp.conf

Das ist die Überbestzung mit einigen Anpassungen an suse von
http://dansguardian.org/downloads/DGandTransparent.txt

=== Anmerkung ===

Leider muß ich selber ersteinmal fertig werden. Aber ich hoffe, dass
ich jetzt selber den Anfang gemacht habe und dass ich es auch fertig
schreibe.

AnsgarJazdzewski

----

Schön. :-) Sieht ja gut aus bisher. Willkommen im Club! Das Ding
kannte ich noch gar nicht, bin schon gespannt auf Deine Erfahrung.
Übrigens könnte es eine gute Idee sein, wenn Du einen User-Login
machen würdest. Dann kann man in RecentChanges besser sehen, wer
was geändert hat. Außerdem ist es üblich, dass sich jeder Benutzer
eine eigene Seite einrichtet, die den Usernamen als Titel hat.
Meine ist ThomasBayen, Deine sollte AnsgarJazdzewski sein. Dort
kannst Du dann was über Dich schreiben und andere können Dir
Kommentare dort hinterlassen (So wie dieser Absatz hier, den Du von
der DansGuardian-Seite wieder löschen solltest). -- ThomasBayen

Für Debian gibt es DansGuardian in Sarge und Etch als fertige Pakete. --PeterHormanns

[{Tag Firewall}]