DansGuardian open source content filtering

Editor's Notes

• #4: Schools, businesses and even home users have a lot to lose from their workstation users accidentally or intentionally accessing offensive content, time-wasting content, or malware. DansGuardian protects your network from all three. DansGuardian logs to /var/log/dansguardian/access.log. Directives in the configuration can tell DG to log in squid format, making it easy to analyze the logs later with tools like calamaris.
• #5: TinyProxy uses far fewer resources than squid, making it very nice for home use. However, you give up 3 of 5 of your authentication mechanisms. Squid is also probably better for an environment with many users. DG forks similar to Apache HTTPD. EPEL, of course, being “Extra Packages for Enterprise Linux”. You could also grab the source from dansguardian.org.
• #6: Smoothwall gives a commercial packaging and support for DG. Either the browser intentionally used DG as a proxy, or the firewall intercepts the traffic, redirecting it to DG. Explicit-proxy is better, but more difficult to manage. Transparent-proxy is easier to manage, but gives you less flexibility when it comes to traffic like SSL, as well as cutting out 3 of 5 of DG's auth mechanisms. For SSL, sending the traffic directly to squid is typically a better idea.
• #10: Examples: Gateway is 10.0.0.1, dg box is 10.0.0.2 iptables -t nat -A FORWARD -s 10.0.0.2 -j ACCEPT iptables -t nat -A FORWARD -m tcp -p tcp –dport 80 ! -d 10.0.0.0/8 -j DNAT –to-destination 10.0.0.2:8080 iptables -t filter -A FORWARD -m tcp -p tcp –dport 3128 ! -d 10.0.0.2 -j REJECT iptables -t filter -A FORWARD -m tcp -p tcp –dport 8080 ! -d 10.0.0.2 -j REJECT iptables -t filter -A FORWARD -m tcp -p tcp –dport 8888 -j REJECT iptables -t filter -A FORWARD -m tcp -p tcp –dport 443 -j REJECT iptables -t filter -A FORWARD -j LOG Service iptables save Now, make sure you set squid on 10.0.0.1 to listen to port 80 only from loopback (DG), but 443 from all clients
• #11: Examples: Redirect box's own traffic to dg iptables -t nat -A OUTPUT -m owner --uid-owner squid -j ACCEPT iptables -t nat -A OUTPUT -m tcp -p tcp –dport 80 -j DNAT –to-destination 127.0.0.1:8080 iptables -t filter -A OUTPUT -m tcp -p tcp --dport 3128 -j REJECT iptables -t filter -A OUTPUT -m tcp -p tcp –dport 8080 -j REJECT iptables -t filter -A OUTPUT -m tcp -p tcp --dport 8888 -j REJECT iptables -t filter -A OUTPUT -j LOG service iptables save
• #12: The default BIND (named) configuration in fedora will perform recursive lookups for localhost, and cache the results. With just a little bit of tweaking you can also use this as the nameserver for the workstations on your network. The way certain sites (like facebook.com) do dns-based load-balancing can make DG think you're being spoofed. Local lookups prevent this, although the strict behavior is disabled in DG by default in current versions. Contentscanner can set all your incoming content to be virus-scanned. Downloadmanager will try to assist with download speed, but can break large downloads in some cases.
• #13: shallalist.de is free for non-commercial use. urlblacklist.com costs money to use. Some on the mailing list tell me shallalist is better anyway.
• #18: Unfortunately you have to put “filterX” in your groupslist, even if you specify a groupname in your dansguardianfX.conf for the group. Many sites will have a default group that has zero access to the internet, forcing users to login to get any access. In a DHCP setting, you might use ip auth to place most users in a default group, but set permanent leases for frequent users who you want to place in a different group.
• #19: Anything you can do in Perl, you can do here, but keep in mind it's perlre, not PCRE.