Difference between revisions of "Installing Dansguardian on LinuxMCE"

Latest revision as of 23:04, 19 October 2012

Basics

DansGuardian is an award winning Open Source web content filter which currently runs on Linux, FreeBSD, OpenBSD, NetBSD, Mac OS X, HP-UX, and Solaris. It filters the actual content of pages based on many methods including phrase matching, PICS filtering and URL filtering. It does not purely filter based on a banned list of sites like lesser totally commercial filters.

DansGuardian is designed to be completely flexible and allows you to tailor the filtering to your exact needs. It can be as draconian or as unobstructive as you want. The default settings are geared towards what a primary school might want but DansGuardian puts you in control of what you want to block.

DansGuardian is a true web content filter. We will see how to configure DansGuardian on Ubuntu Linux along with LinuxMCE.

Installing packages

tinyproxy

   apt-get install tinyproxy

shorewall

   apt-get install shorewall

dansguardian

   apt-get install dansguardian

dhcp

   apt-get install dhcp3-server

dns server

   apt-get install dnsmasq 

Optional:

Dansguardian Web Log Viewer

   apt-get install dglog

Installing webmin and dansguardian webmin module

First you need to install the additional packages:

   sudo aptitude install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl libmd5-perl

Download and install webmin package:

   wget http://prdownloads.sourceforge.net/webadmin/webmin_1.480_all.deb 
   
   sudo dpkg -i webmin_1.480_all.deb

Configure Packages

Tinyproxy

   vi /etc/tinyproxy/tinyproxy.conf  

Make the following changes

1. User root
2. Group root
3. Allow 192.168.80.0/25

Dansguardian

  vi  /etc/dansguardian/dansguardian.conf

Make the following changes:

1. Delete UNCONFIGURED line
2. filterport = 8081
3. proxyip = 192.168.80.1
4. proxyport = 8888
5. usernameidmethodproxyauth = off

Shorewall

Make the following changes:

copy configuration files (take backup of existing files):

  cp /usr/share/doc/shorewall-common/default-config/* /etc/shorewall/ 

set "shorewall" auto start at boot time:

  vi /etc/default/shorewall

1. startup = 1

"zones" tells the firewall to zone each name for the rest configuration file e.g. loc, net:

  vi /etc/shorewall/zones

1. #ZONES TYPE OPTION IN OUT
2. #OPTIONS OPTIONS
3. fw firewall
4. net ipv4
5. loc ipv4
6. #Last Line - ADD ENTRIES ABOVE THIS ONE - DO NOT REMOVE

"interfaces" tells the firewall which is internal and external interfaces:

  vi /etc/shorewall/interfaces

1. #ZONE INTERFACE BROADCAST OPTIONS
2. #Note assuming "eth1"- is internal ip & "eth0"- is external ip
3. net eth0 detect dhcp,tcpflags
4. loc eth1 detect dhcp
5. #LAST LINE --ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

"masq" tells the firewall that internal network(eth1)is connected through external network(eth0):

  vi /etc/shorewall/masq

1. #INTERFACE SUBNET ADDRESS PROTO PORT(S) IPSEC
2. eth0 eth1
3. #LAST LINE --ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

"policy" tells the firewall that how should handle the requests:

  vi /etc/shorewall/policy

1. loc all ACCEPT
2. net all DROP
3. fw all ACCEPT
4. all all REJECT

"shorewall.conf" we will configure ip_forwarding:

  vi /etc/shorewall/shorewall.conf

1. IP_FORWARDING=On

"rules" allows to set firewall rules:

  vi /etc/shorewall/rules

1. SECTION NEW
2. ACCEPT net fw tcp 80
3. REDIRECT loc 8081 tcp www
4. ACCEPT loc fw tcp 22
5. ACCEPT net fw icmp
6. ACCEPT loc loc icmp
7. #LAST LINE --ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

# check shorewall working or not properly:

  shorewall check

Restart Applications

   /etc/init.d/dnsmasq restart 
   /etc/init.d/tinyproxy restart
   /etc/init.d/shorewall restart
   /etc/init.d/dansguardian restart
   
   Troubleshooting:
   1.  Still not working restart the system once
   2.  Check all service started are not "ps -ef | grep <service>" service - apache2, dnsmasq, tinyproxy, shorewall, dansguardian, 
   and dhcpd.  If any of the service is not starting, start the service sh /etc/init.d.<service> start.  Check especially dnsmasq 
   and shorewall services.

DHCP Server

Note: you need not to make any changes if you are working on single system or dhcp is already running on your local network interface(any changes dhcpd.conf or interfaces respective files)

 vi /etc/default/dhcp3-server

1. INTERFACE="eth1"

 vi /etc/dhcp3/dhcpd.conf

1. #change the subnet, netmask, range, dns, router as per your settings
2. default-leasetime=86400
3. max-leasetime=60480
4. subnet 192.168.0.0 netmask 255.255.255.0{
5. range 192.168.0.2 192.168.1.99;
6. option domain-name-server 192.168.80.1;
7. option routers 192.168.80.2;
8. }

set static ip address:

 vi /etc/network/interfaces

1. auto lo
2. iface lo inet loopback
3. auto eth0
4. iface eth0 inet dhcp
5. auto eth1
6. iface eth1 inet static
7. address 192.168.80.1
8. netmask 255.255.255.0

 #restart dhcp

1. /etc/init.d/dhcpd restart

Adding BlackList

A BlackList is a precompiled list of sites that are deemed potentially worrisome.

    cd /etc/dansguardian    
    wget http://urlblacklist.com/downloads/OriginalUpdateBL
    vi OriginalUpdateBL

1. modify line 68 by switching the listed URL with the following:
2. http://urlblacklist.com/cgi-bin/commercialdownload.pl?type=download&file=bigblacklist

   chmod 777 /etc/dansguardian/OriginalUpdateBL
   /etc/dansguardian/OriginalUpdateBL

when script is finished if you see any errors.

   /etc/init.d/dansguardian restart

if the above script is not creating blacklists directory and creating blacklists file then follow the following:

   cd /etc/dansguardian  
   wget http://urlblacklist.com/cgi-bin/commercialdownload.pl?type=download&file=bigblacklist
   tar -xvf bigblacklist.tar.gz
   chown -R root:root blacklists
   chmod -R 755 blacklists

Webmin and Dansguardian webmin configuration

Login into Webmin(open your web browser and enter the following):

 https://192.168.80.1:10000/

Install and configure the Dansguardian Webmin module:

   1.Open browser & login as madmin(sudo user) https://192.168.80.1:10000
   
   2.Go to Webmin > Webmin Configuration > Webmin Modules
   Select "From ftp or http URL" and paste the link below into the dialog box and click Install Module. 
  (http://downloads.sourceforge.net/project/dgwebminmodule/dgwebmin-devel/0.7.0beta1b/dgwebmin-0.7.0beta1b.wbm?use_mirror=voxel)
   
   Observe: The following modules have been successfully installed and added to your access control list :
   DansGuardian Web Content Filter in /usr/share/webmin/dansguardian (4612 kB) under category Servers

Trouble shooting:

The first time you try to run the dg module, you'll get errors such as:

   Warning - DansGuardian binary file not found, maybe you need to update your module config (especially the directory paths).  
   (Expected location: /sbin/dansguardian)

Solution:

The problem is that the we are using different directory locations for many of the files. So, look at the Configurable options for DansGuardian Web Content Filter (in the upper left corner of the dg page) - and nearly every path needs to be changed.

For instance, our binary is in /usr/sbin/dansguardian instead of /sbin/dansguardian, so change that.

Confirm the locations for the rest of the files by running

find / -name dansguardian
results may show:
   /usr/share/webmin/dansguardian
   /usr/share/lintian/overrides/dansguardian
   /usr/share/doc/dansguardian
   /usr/share/dansguardian
   /usr/sbin/dansguardian
   /var/log/dansguardian
   /etc/webmin/dansguardian
   /etc/init.d/dansguardian
   /etc/logrotate.d/dansguardian
   /etc/dansguardian

When you've finished replacing all of the locations, hit save on the config page and then "stop & restart DG" on the top right of the main DG page.

Then it should work! If not, check your syslog for errors. You should be able to check the status of DG, review logs with a good viewer, and view and edit many of the detailed configurations.