Installation und Konfiguration unter CentOS 6.x

Transcription

22.12.2016 06:28.
1/46
Dansguardian Version 2.10.1.1 - Installation und Konfiguration unter CentOS 6.x
Dansguardian Version 2.10.1.1 - Installation
und Konfiguration unter CentOS 6.x
Für die Zugriffsverwaltung und inhaltliche Bewertung der angewählten Internetseiten bedienen wir
uns dem Proxy Squid und dem Contentfilter Dansguardian.
Bei dieser Konstellation arbeiten Squid und Dansguardian als einer Vermittler, der auf der einen
Seite Anfragen entgegennimmt, um dann über seine eigene Adresse eine Verbindung zu einem
Zielhost herzustellen. So bleibt einerseits die eigentliche Adresse des Client-Rechners dem Zielhost
gegenüber komplett verborgen, was eine gewisse Anonymität schafft. Ferner können die Ergebnisse
der Clientanfragen zwischengespeichert werden, um so Bandbreite zu sparen, da diese gepufferten
Objekte nicht nochmals geladen werden müssen. Darüber hinaus haben wir so die Möglichkeit:
unerwünschte Seiten zu blocken (Pornographie)
bestimmte Inhalte nur bestimmten Usern zur Verfügung zu stellen (Multimediainhalte des
WWW)
Seiten auf unerwünschten Inhalt zu überprüfen und ggf. zu blocken (Glücksspiel und politische
Propaganda) oder
eine Virenprüfung der übermittelten Daten vorzunehmen.
Installation
Download
Als erstes holen wir uns das RPM-Paket, welches für CentOS 6.x speziell mit der ClamAVUnterstützung compiliert wurde, vom Djanos public Repository Server.
Je nach verwendeter Serverarchitektur wählen wir das zugehörige RPM-PAket aus:
i386/586/686
# wget
http://repository.nausch.org/public/i386/dansguardian-2.10.1.1-1.el6.i6
86.rpm
x86_64
# wget
http://repository.nausch.org/public/x86_64/dansguardian-2.10.1.1-1.el6.
x86_64.rpm
Linux - Wissensdatenbank - https://dokuwiki.nausch.org/
Last update: 22.11.2013 15:32.
centos:dansg:install https://dokuwiki.nausch.org/doku.php/centos:dansg:install
Die Integrität des heruntergeladenen RPMs können wir an Hand des RPM-GPG-KEY-CentOS-6
überprüfen. Hierzu importieren wir einfach den Public-Key des RPM-Builders.
# rpm --import http://repository.nausch.org/public/RPM-GPG-KEY-CentOS-6
Anschließen überprüfen wir, ob mit dem zuvor heruntergeladenen RPM alles stimmt.
# rpm -K dansguardian-2.10.1.1-1.el6.x86_64.rpm
dansguardian-2.10.1.1-1.el6.x86_64.rpm: rsa sha1 (md5) pgp md5 OK
YUM Installation
Das zuvor heruntergeladene RPM installieren wir, wie gewohnt mittels yum.
# yum install dansguardian-2.10.1.1-1.el6.x86_64.rpm -y
Das Paket dansguardian des aktuellen Release-Kandidaten hat nun im Gegensatz zur Version aus dem
rpmforge Repository einen weitaus größeren Umfang, was uns ein detailierter Blick in das RPM,
nach erfolgter Installation des Paketes, zeigt.
# rpm -qil dansguardian
Name
: dansguardian
Relocations: (not relocatable)
Version
: 2.10.1.1
Vendor: django
Release
: 1.el6
Build Date: Sat 15 Oct 2011
10:23:02 PM CEST
Install Date: Tue 15 Nov 2011 10:09:04 AM CET
Build Host:
vml010006.intra.nausch.org
Group
: System Environment/Daemons
Source RPM:
dansguardian-2.10.1.1-1.el6.src.rpm
Size
: 1387134
License: GPLv2+
Signature
: RSA/SHA1, Sat 15 Oct 2011 10:23:04 PM CEST, Key ID
31b4758f7c65ab27
Packager
: Django
URL
: http://www.dansguardian.org/
Summary
: Content filtering web proxy
Description :
DansGuardian is a web filtering engine that checks the content within
the page itself in addition to the more traditional URL filtering.
DansGuardian is a content filtering proxy. It filters using multiple
methods,
including URL and domain filtering, content phrase filtering, PICS
filtering,
MIME filtering, file extension filtering, POST filtering.
Compiled with ClamAV support.
/etc/dansguardian
https://dokuwiki.nausch.org/
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
3/46
/etc/dansguardian/authplugins
/etc/dansguardian/authplugins/ident.conf
/etc/dansguardian/authplugins/ip.conf
/etc/dansguardian/authplugins/proxy-basic.conf
/etc/dansguardian/authplugins/proxy-digest.conf
/etc/dansguardian/authplugins/proxy-ntlm.conf
/etc/dansguardian/contentscanners
/etc/dansguardian/contentscanners/clamdscan.conf
/etc/dansguardian/contentscanners/commandlinescan.conf
/etc/dansguardian/contentscanners/icapscan.conf
/etc/dansguardian/contentscanners/kavdscan.conf
/etc/dansguardian/dansguardian.conf
/etc/dansguardian/dansguardianf1.conf
/etc/dansguardian/downloadmanagers
/etc/dansguardian/downloadmanagers/default.conf
/etc/dansguardian/downloadmanagers/fancy.conf
/etc/dansguardian/downloadmanagers/trickle.conf
/etc/dansguardian/lists
/etc/dansguardian/lists/authplugins
/etc/dansguardian/lists/authplugins/ipgroups
/etc/dansguardian/lists/bannedextensionlist
/etc/dansguardian/lists/bannediplist
/etc/dansguardian/lists/bannedmimetypelist
/etc/dansguardian/lists/bannedphraselist
/etc/dansguardian/lists/bannedregexpheaderlist
/etc/dansguardian/lists/bannedregexpurllist
/etc/dansguardian/lists/bannedsitelist
/etc/dansguardian/lists/bannedurllist
/etc/dansguardian/lists/blacklists
/etc/dansguardian/lists/blacklists/ads
/etc/dansguardian/lists/blacklists/ads/domains
/etc/dansguardian/lists/blacklists/ads/urls
/etc/dansguardian/lists/contentregexplist
/etc/dansguardian/lists/contentscanners
/etc/dansguardian/lists/contentscanners/exceptionvirusextensionlist
/etc/dansguardian/lists/contentscanners/exceptionvirusmimetypelist
/etc/dansguardian/lists/contentscanners/exceptionvirussitelist
/etc/dansguardian/lists/contentscanners/exceptionvirusurllist
/etc/dansguardian/lists/downloadmanagers
/etc/dansguardian/lists/downloadmanagers/managedextensionlist
/etc/dansguardian/lists/downloadmanagers/managedmimetypelist
/etc/dansguardian/lists/exceptionextensionlist
/etc/dansguardian/lists/exceptionfilesitelist
/etc/dansguardian/lists/exceptionfileurllist
/etc/dansguardian/lists/exceptioniplist
/etc/dansguardian/lists/exceptionmimetypelist
/etc/dansguardian/lists/exceptionphraselist
/etc/dansguardian/lists/exceptionregexpurllist
/etc/dansguardian/lists/exceptionsitelist
/etc/dansguardian/lists/exceptionurllist
/etc/dansguardian/lists/filtergroupslist
Last update: 22.11.2013 15:32.
/etc/dansguardian/lists/greysitelist
/etc/dansguardian/lists/greyurllist
/etc/dansguardian/lists/headerregexplist
/etc/dansguardian/lists/logregexpurllist
/etc/dansguardian/lists/logsitelist
/etc/dansguardian/lists/logurllist
/etc/dansguardian/lists/phraselists
/etc/dansguardian/lists/phraselists/badwords
/etc/dansguardian/lists/phraselists/badwords/weighted_dutch
/etc/dansguardian/lists/phraselists/badwords/weighted_french
/etc/dansguardian/lists/phraselists/badwords/weighted_german
/etc/dansguardian/lists/phraselists/badwords/weighted_portuguese
/etc/dansguardian/lists/phraselists/badwords/weighted_spanish
/etc/dansguardian/lists/phraselists/chat
/etc/dansguardian/lists/phraselists/chat/weighted
/etc/dansguardian/lists/phraselists/chat/weighted_italian
/etc/dansguardian/lists/phraselists/conspiracy
/etc/dansguardian/lists/phraselists/conspiracy/weighted
/etc/dansguardian/lists/phraselists/domainsforsale
/etc/dansguardian/lists/phraselists/domainsforsale/weighted
/etc/dansguardian/lists/phraselists/drugadvocacy
/etc/dansguardian/lists/phraselists/drugadvocacy/weighted
/etc/dansguardian/lists/phraselists/forums
/etc/dansguardian/lists/phraselists/forums/weighted
/etc/dansguardian/lists/phraselists/gambling
/etc/dansguardian/lists/phraselists/gambling/banned
/etc/dansguardian/lists/phraselists/gambling/banned_portuguese
/etc/dansguardian/lists/phraselists/gambling/weighted
/etc/dansguardian/lists/phraselists/gambling/weighted_portuguese
/etc/dansguardian/lists/phraselists/games
/etc/dansguardian/lists/phraselists/games/weighted
/etc/dansguardian/lists/phraselists/goodphrases
/etc/dansguardian/lists/phraselists/goodphrases/exception
/etc/dansguardian/lists/phraselists/goodphrases/exception_email
/etc/dansguardian/lists/phraselists/goodphrases/weighted_general
/etc/dansguardian/lists/phraselists/goodphrases/weighted_general_danish
/etc/dansguardian/lists/phraselists/goodphrases/weighted_general_dutch
/etc/dansguardian/lists/phraselists/goodphrases/weighted_general_malay
/etc/dansguardian/lists/phraselists/goodphrases/weighted_general_polish
/etc/dansguardian/lists/phraselists/goodphrases/weighted_general_portuguese
/etc/dansguardian/lists/phraselists/goodphrases/weighted_general_swedish
/etc/dansguardian/lists/phraselists/goodphrases/weighted_news
/etc/dansguardian/lists/phraselists/googlesearches
/etc/dansguardian/lists/phraselists/googlesearches/banned
/etc/dansguardian/lists/phraselists/gore
/etc/dansguardian/lists/phraselists/gore/weighted
/etc/dansguardian/lists/phraselists/gore/weighted_portuguese
/etc/dansguardian/lists/phraselists/idtheft
/etc/dansguardian/lists/phraselists/idtheft/weighted
/etc/dansguardian/lists/phraselists/illegaldrugs
/etc/dansguardian/lists/phraselists/illegaldrugs/banned
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
5/46
/etc/dansguardian/lists/phraselists/illegaldrugs/weighted
/etc/dansguardian/lists/phraselists/illegaldrugs/weighted_portuguese
/etc/dansguardian/lists/phraselists/intolerance
/etc/dansguardian/lists/phraselists/intolerance/banned_portuguese
/etc/dansguardian/lists/phraselists/intolerance/weighted
/etc/dansguardian/lists/phraselists/intolerance/weighted_portuguese
/etc/dansguardian/lists/phraselists/legaldrugs
/etc/dansguardian/lists/phraselists/legaldrugs/weighted
/etc/dansguardian/lists/phraselists/malware
/etc/dansguardian/lists/phraselists/malware/weighted
/etc/dansguardian/lists/phraselists/music
/etc/dansguardian/lists/phraselists/music/weighted
/etc/dansguardian/lists/phraselists/news
/etc/dansguardian/lists/phraselists/news/weighted
/etc/dansguardian/lists/phraselists/nudism
/etc/dansguardian/lists/phraselists/nudism/weighted
/etc/dansguardian/lists/phraselists/peer2peer
/etc/dansguardian/lists/phraselists/peer2peer/weighted
/etc/dansguardian/lists/phraselists/personals
/etc/dansguardian/lists/phraselists/personals/weighted
/etc/dansguardian/lists/phraselists/personals/weighted_portuguese
/etc/dansguardian/lists/phraselists/pornography
/etc/dansguardian/lists/phraselists/pornography/banned
/etc/dansguardian/lists/phraselists/pornography/banned_portuguese
/etc/dansguardian/lists/phraselists/pornography/weighted
/etc/dansguardian/lists/phraselists/pornography/weighted_chinese
/etc/dansguardian/lists/phraselists/pornography/weighted_danish
/etc/dansguardian/lists/phraselists/pornography/weighted_dutch
/etc/dansguardian/lists/phraselists/pornography/weighted_french
/etc/dansguardian/lists/phraselists/pornography/weighted_german
/etc/dansguardian/lists/phraselists/pornography/weighted_italian
/etc/dansguardian/lists/phraselists/pornography/weighted_japanese
/etc/dansguardian/lists/phraselists/pornography/weighted_malay
/etc/dansguardian/lists/phraselists/pornography/weighted_norwegian
/etc/dansguardian/lists/phraselists/pornography/weighted_polish
/etc/dansguardian/lists/phraselists/pornography/weighted_portuguese
/etc/dansguardian/lists/phraselists/pornography/weighted_russian
/etc/dansguardian/lists/phraselists/pornography/weighted_spanish
/etc/dansguardian/lists/phraselists/pornography/weighted_swedish
/etc/dansguardian/lists/phraselists/proxies
/etc/dansguardian/lists/phraselists/proxies/weighted
/etc/dansguardian/lists/phraselists/rta
/etc/dansguardian/lists/phraselists/rta/banned
/etc/dansguardian/lists/phraselists/safelabel
/etc/dansguardian/lists/phraselists/safelabel/banned
/etc/dansguardian/lists/phraselists/secretsocieties
/etc/dansguardian/lists/phraselists/secretsocieties/weighted
/etc/dansguardian/lists/phraselists/sport
/etc/dansguardian/lists/phraselists/sport/weighted
/etc/dansguardian/lists/phraselists/translation
/etc/dansguardian/lists/phraselists/translation/weighted
Last update: 22.11.2013 15:32.
/etc/dansguardian/lists/phraselists/travel
/etc/dansguardian/lists/phraselists/travel/weighted
/etc/dansguardian/lists/phraselists/upstreamfilter
/etc/dansguardian/lists/phraselists/upstreamfilter/weighted
/etc/dansguardian/lists/phraselists/violence
/etc/dansguardian/lists/phraselists/violence/weighted
/etc/dansguardian/lists/phraselists/violence/weighted_portuguese
/etc/dansguardian/lists/phraselists/warezhacking
/etc/dansguardian/lists/phraselists/warezhacking/weighted
/etc/dansguardian/lists/phraselists/weapons
/etc/dansguardian/lists/phraselists/weapons/weighted
/etc/dansguardian/lists/phraselists/weapons/weighted_portuguese
/etc/dansguardian/lists/phraselists/webmail
/etc/dansguardian/lists/phraselists/webmail/weighted
/etc/dansguardian/lists/pics
/etc/dansguardian/lists/urlregexplist
/etc/dansguardian/lists/weightedphraselist
/etc/httpd/conf.d/dansguardian.conf
/etc/logrotate.d/dansguardian
/etc/rc.d/init.d/dansguardian
/usr/sbin/dansguardian
/usr/share/dansguardian
/usr/share/dansguardian/dansguardian.pl
/usr/share/dansguardian/languages
/usr/share/dansguardian/languages/arspanish
/usr/share/dansguardian/languages/arspanish/fancydmtemplate.html
/usr/share/dansguardian/languages/arspanish/messages
/usr/share/dansguardian/languages/arspanish/template.html
/usr/share/dansguardian/languages/bulgarian
/usr/share/dansguardian/languages/bulgarian/fancydmtemplate.html
/usr/share/dansguardian/languages/bulgarian/messages
/usr/share/dansguardian/languages/bulgarian/template.html
/usr/share/dansguardian/languages/chinesebig5
/usr/share/dansguardian/languages/chinesebig5/fancydmtemplate.html
/usr/share/dansguardian/languages/chinesebig5/messages
/usr/share/dansguardian/languages/chinesebig5/template.html
/usr/share/dansguardian/languages/chinesegb2312
/usr/share/dansguardian/languages/chinesegb2312/fancydmtemplate.html
/usr/share/dansguardian/languages/chinesegb2312/messages
/usr/share/dansguardian/languages/chinesegb2312/template.html
/usr/share/dansguardian/languages/czech
/usr/share/dansguardian/languages/czech/fancydmtemplate.html
/usr/share/dansguardian/languages/czech/messages
/usr/share/dansguardian/languages/czech/template.html
/usr/share/dansguardian/languages/danish
/usr/share/dansguardian/languages/danish/fancydmtemplate.html
/usr/share/dansguardian/languages/danish/messages
/usr/share/dansguardian/languages/danish/template.html
/usr/share/dansguardian/languages/dutch
/usr/share/dansguardian/languages/dutch/fancydmtemplate.html
/usr/share/dansguardian/languages/dutch/messages
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
7/46
/usr/share/dansguardian/languages/dutch/template.html
/usr/share/dansguardian/languages/french
/usr/share/dansguardian/languages/french/fancydmtemplate.html
/usr/share/dansguardian/languages/french/messages
/usr/share/dansguardian/languages/french/template.html
/usr/share/dansguardian/languages/german
/usr/share/dansguardian/languages/german/fancydmtemplate.html
/usr/share/dansguardian/languages/german/messages
/usr/share/dansguardian/languages/german/template.html
/usr/share/dansguardian/languages/hebrew
/usr/share/dansguardian/languages/hebrew/fancydmtemplate.html
/usr/share/dansguardian/languages/hebrew/messages
/usr/share/dansguardian/languages/hebrew/template.html
/usr/share/dansguardian/languages/hungarian
/usr/share/dansguardian/languages/hungarian/fancydmtemplate.html
/usr/share/dansguardian/languages/hungarian/messages
/usr/share/dansguardian/languages/hungarian/template.html
/usr/share/dansguardian/languages/indonesian
/usr/share/dansguardian/languages/indonesian/fancydmtemplate.html
/usr/share/dansguardian/languages/indonesian/messages
/usr/share/dansguardian/languages/indonesian/template.html
/usr/share/dansguardian/languages/italian
/usr/share/dansguardian/languages/italian/fancydmtemplate.html
/usr/share/dansguardian/languages/italian/messages
/usr/share/dansguardian/languages/italian/template.html
/usr/share/dansguardian/languages/japanese
/usr/share/dansguardian/languages/japanese/fancydmtemplate.html
/usr/share/dansguardian/languages/japanese/messages
/usr/share/dansguardian/languages/japanese/template.html
/usr/share/dansguardian/languages/lithuanian
/usr/share/dansguardian/languages/lithuanian/fancydmtemplate.html
/usr/share/dansguardian/languages/lithuanian/messages
/usr/share/dansguardian/languages/lithuanian/template.html
/usr/share/dansguardian/languages/malay
/usr/share/dansguardian/languages/malay/fancydmtemplate.html
/usr/share/dansguardian/languages/malay/messages
/usr/share/dansguardian/languages/malay/template.html
/usr/share/dansguardian/languages/mxspanish
/usr/share/dansguardian/languages/mxspanish/fancydmtemplate.html
/usr/share/dansguardian/languages/mxspanish/messages
/usr/share/dansguardian/languages/mxspanish/template.html
/usr/share/dansguardian/languages/polish
/usr/share/dansguardian/languages/polish/fancydmtemplate.html
/usr/share/dansguardian/languages/polish/messages
/usr/share/dansguardian/languages/polish/template.html
/usr/share/dansguardian/languages/portuguese
/usr/share/dansguardian/languages/portuguese/fancydmtemplate.html
/usr/share/dansguardian/languages/portuguese/messages
/usr/share/dansguardian/languages/portuguese/template.html
/usr/share/dansguardian/languages/ptbrazilian
/usr/share/dansguardian/languages/ptbrazilian/fancydmtemplate.html
Last update: 22.11.2013 15:32.
/usr/share/dansguardian/languages/ptbrazilian/messages
/usr/share/dansguardian/languages/ptbrazilian/template.html
/usr/share/dansguardian/languages/russian-1251
/usr/share/dansguardian/languages/russian-1251/fancydmtemplate.html
/usr/share/dansguardian/languages/russian-1251/messages
/usr/share/dansguardian/languages/russian-1251/template.html
/usr/share/dansguardian/languages/russian-koi8-r
/usr/share/dansguardian/languages/russian-koi8-r/fancydmtemplate.html
/usr/share/dansguardian/languages/russian-koi8-r/messages
/usr/share/dansguardian/languages/russian-koi8-r/template.html
/usr/share/dansguardian/languages/slovak
/usr/share/dansguardian/languages/slovak/fancydmtemplate.html
/usr/share/dansguardian/languages/slovak/messages
/usr/share/dansguardian/languages/slovak/template.html
/usr/share/dansguardian/languages/spanish
/usr/share/dansguardian/languages/spanish/fancydmtemplate.html
/usr/share/dansguardian/languages/spanish/messages
/usr/share/dansguardian/languages/spanish/template.html
/usr/share/dansguardian/languages/swedish
/usr/share/dansguardian/languages/swedish/fancydmtemplate.html
/usr/share/dansguardian/languages/swedish/messages
/usr/share/dansguardian/languages/swedish/template.html
/usr/share/dansguardian/languages/turkish
/usr/share/dansguardian/languages/turkish/fancydmtemplate.html
/usr/share/dansguardian/languages/turkish/messages
/usr/share/dansguardian/languages/turkish/template.html
/usr/share/dansguardian/languages/ukenglish
/usr/share/dansguardian/languages/ukenglish/fancydmtemplate.html
/usr/share/dansguardian/languages/ukenglish/messages
/usr/share/dansguardian/languages/ukenglish/template.html
/usr/share/dansguardian/transparent1x1.gif
/usr/share/doc/dansguardian-2.10.1.1
/usr/share/doc/dansguardian-2.10.1.1/AuthPlugins
/usr/share/doc/dansguardian-2.10.1.1/COPYING
/usr/share/doc/dansguardian-2.10.1.1/ContentScanners
/usr/share/doc/dansguardian-2.10.1.1/DownloadManagers
/usr/share/doc/dansguardian-2.10.1.1/FAQ
/usr/share/doc/dansguardian-2.10.1.1/FAQ.html
/usr/share/doc/dansguardian-2.10.1.1/INSTALL
/usr/share/doc/dansguardian-2.10.1.1/Plugins
/usr/share/doc/dansguardian-2.10.1.1/README
/usr/share/doc/dansguardian-2.10.1.1/UPGRADING
/usr/share/man/man8/dansguardian.8.gz
/var/log/dansguardian
WICHTIG:
Wurde bei der Grundinstallation unseres vHOSTs das rpmforge-Repository eingebunden, bedarf
es noch einer kleinen Anpassung der zugehörigen Konfigurationsdatei
/etc/yum.repos.d/rpmforge.repo. Da wir das RPM lokal installiert haben könnte es passieren,
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
9/46
dass es zu Versionskonflikten mit dem rpmforge-Repository kommen könnte. Wir passen daher
die Konfigurationsdatei des rpmforge-Repositorys an und tragen dort folgende Zeile ein:
exclude = dansguardian*
Konfiguration
Die Konfiguration unseres Contentscanners spielt sich im Wesentlichen unter dem Verezichnis
/etc/dansguardian ab.
# cd /etc/dansguardian
# ls -alF
total 60
drwxr-xr-x
6 root root 4096 Nov 15 10:09
drwxr-xr-x. 63 root root 4096 Nov 15 10:09
drwxr-xr-x
2 root root 4096 Nov 15 10:09
drwxr-xr-x
2 root root 4096 Nov 15 10:09
-rw-r--r-1 root root 23066 Oct 15 22:23
-rw-r--r-1 root root 11635 Oct 15 22:23
drwxr-xr-x
2 root root 4096 Nov 15 10:09
drwxr-xr-x
7 root root 4096 Nov 15 10:09
./
../
authplugins/
contentscanners/
dansguardian.conf
dansguardianf1.conf
downloadmanagers/
lists/
Die beiden Konfigurationsdateien:
dansguardian.conf
dansguardianf1.conf
beinhalten die Hauptkonfigurations-Optionen des Filters. In den Unterverzeichnissen erfolgt dann die
weitere meist stark individuelle Anpassung.
authplugins
contentscanners
downloadmanagers
lists
dansguardian.conf
Die Haupfkonfiguration des Dansguardian-Content-filters/-Scanners erfolgt in der Datei
/etc/dansguardian/dansguardian.conf.
Mit dem Editor unserer Wahl - also vim - bearbeiten nun die erste der beiden Konfigurationsdateien.
# vim /etc/dansguardian/dansguardian.conf
Als erstes passen wir die Internationalisierung in der Konfigurationsdatei an:
Last update: 22.11.2013 15:32.
# language to use from languagedir.
# Django 2011-11-15
#Default: language = 'ukenglish'
language = 'german'
Die Einstellungen im Bezug auf unsere Netzwerkadressen un den zugehörigen Ports erfolgen im
Bereich Network Settings.
# Network Settings
#
# the IP that DansGuardian listens on. If left blank DansGuardian will
# listen on all IPs. That would include all NICs, loopback, modem, etc.
# Normally you would have your firewall protecting this, but if you want
# you can limit it to a certain IP. To bind to multiple interfaces,
# specify each IP on an individual filterip line.
filterip =
# the port that DansGuardian listens to.
filterport = 8080
# the ip of the proxy (default is the loopback - i.e. this server)
proxyip = 127.0.0.1
# the port DansGuardian connects to proxy on
proxyport = 3128
Zur Information der User bei anwahl von gesperrten Seiten bietet Dansguardian zwei Wege:
dansguardian.pl
Möchte man das dansguardian reporting script nutzen, so trägt man in die Konfigurationsdate den Ort
des Perl-Scriptes ein. Als Ergebnis wird dann z.B. folgende Seite generiert.
Der zugehörige Eintrag in der Konfigurationsdatei lautet:
# accessdeniedaddress is the address of your web server to which the cgi
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
11/46
# dansguardian reporting script was copied. Only used in reporting levels 1
and 2.
#
# This webserver must be either:
# 1. Non-proxied. Either a machine on the local network, or listed as an
exception
#
in your browser's proxy configuration.
# 2. Added to the exceptionsitelist. Option 1 is preferable; this option is
#
only for users using both transparent proxying and a non-local server
#
to host this script.
#
# Individual filter groups can override this setting in their own
configuration.
#
# Django 2011-11-15
#Default: accessdeniedaddress =
'http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl'
accessdeniedaddress = 'http://nausch.org/cgi-bin/dansguardian.pl'
HTML-Statuspage
Alternativ dazu gibt es eine HTML-Seite mit den Hinweisen, warum die Seite gesperrt worden ist.
Hierzu deaktiviert man einfach die Option in der konfiguartionsdatei.
# Django 2011-11-15
Last update: 22.11.2013 15:32.
#Default: accessdeniedaddress =
#accessdeniedaddress = 'http://nausch.org/cgi-bin/dansguardian.pl'
In Summe ergibt sich also folgende erste Gesamtkonfiguration, die wir uns ohne die Kommentarzeilen
mit folgendenm Statement abrufen können:
# egrep -v '(^.*#|^$)' /etc/dansguardian/dansguardian.conf
Das komplette Konfigurationsfile lautet (inkl. der Kommentare) erst einmal:
/etc/dansguardian/dansguardian.conf
# DansGuardian config file for version 2.10.1.1
# **NOTE** as of version 2.7.5 most of the list files are now in
dansguardianf1.conf
# Web Access Denied Reporting (does not affect logging)
#
# -1 = log, but do not block - Stealth mode
# 0 = just say 'Access Denied'
# 1 = report why but not what denied phrase
# 2 = report fully
# 3 = use HTML template file (accessdeniedaddress ignored) recommended
#
reportinglevel = 3
# Language dir where languages are stored for internationalisation.
# The HTML template within this dir is only used when reportinglevel
# is set to 3. When used, DansGuardian will display the HTML file
instead of
# using the perl cgi script. This option is faster, cleaner
# and easier to customise the access denied page.
# The language file is used no matter what setting however.
#
languagedir = '/usr/share/dansguardian/languages'
# language to use from languagedir.
# Django 2011-11-15
# Default: language = 'ukenglish'
language = 'german'
# Logging Settings
#
# 0 = none 1 = just denied
loglevel = 2
2 = all text based
3 = all requests
# Log Exception Hits
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
13/46
# Log if an exception (user, ip, URL, phrase) is matched and so
# the page gets let through. Can be useful for diagnosing
# why a site gets through the filter.
# 0 = never log exceptions
# 1 = log exceptions, but do not explicitly mark them as such
# 2 = always log & mark exceptions (default)
logexceptionhits = 2
# Log File Format
# 1 = DansGuardian format (space delimited)
# 2 = CSV-style format
# 3 = Squid Log File Format
# 4 = Tab delimited
logfileformat = 1
# truncate large items in log lines
#maxlogitemlength = 400
# anonymize logs (blank out usernames & IPs)
#anonymizelogs = on
# Syslog logging
#
# Use syslog for access logging instead of logging to the file
# at the defined or built-in "loglocation"
#syslog = on
# Log file location
#
# Defines the log directory and filename.
#loglocation = '/var/log/dansguardian/access.log'
# Statistics log file location
#
# Defines the stat file directory and filename.
# Only used in conjunction with maxips > 0
# Once every 3 minutes, the current number of IPs in the cache, and the
most
# that have been in the cache since the daemon was started, are written
to this
# file. IPs persist in the cache for 7 days.
#statlocation = '/var/log/dansguardian/stats'
# Network Settings
#
# the IP that DansGuardian listens on. If left blank DansGuardian will
# listen on all IPs. That would include all NICs, loopback, modem,
etc.
Last update: 22.11.2013 15:32.
# Normally you would have your firewall protecting this, but if you
want
# you can limit it to a certain IP. To bind to multiple interfaces,
# specify each IP on an individual filterip line.
filterip =
# the port that DansGuardian listens to.
filterport = 8080
# the ip of the proxy (default is the loopback - i.e. this server)
proxyip = 127.0.0.1
# the port DansGuardian connects to proxy on
proxyport = 3128
# Whether to retrieve the original destination IP in transparent proxy
# setups and check it against the domain pulled from the HTTP headers.
#
# Be aware that when visiting sites which use a certain type of roundrobin
# DNS for load balancing, DG may mark requests as invalid unless DG
gets
# exactly the same answers to its DNS requests as clients. The chances
of
# this happening can be increased if all clients and servers on the
same LAN
# make use of a local, caching DNS server instead of using upstream DNS
# directly.
#
# See http://www.kb.cert.org/vuls/id/435052
# on (default) | off
#!! Not compiled !! originalip = on
# accessdeniedaddress is the address of your web server to which the
cgi
# dansguardian reporting script was copied. Only used in reporting
levels 1 and 2.
#
# 1. Non-proxied. Either a machine on the local network, or listed as
an exception
#
in your browser's proxy configuration.
# 2. Added to the exceptionsitelist. Option 1 is preferable; this
option is
#
only for users using both transparent proxying and a non-local
server
#
#
# Individual filter groups can override this setting in their own
configuration.
#
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
15/46
# Django 2011-11-15
# default : accessdeniedaddress =
# accessdeniedaddress = 'http://nausch.org/cgi-bin/dansguardian.pl'
# Non standard delimiter (only used with accessdeniedaddress)
# To help preserve the full banned URL, including parameters, the
variables
# passed into the access denied CGI are separated using non-standard
# delimiters. This can be useful to ensure correct operation of the
filter
# bypass modes. Parameters are split using "::" in place of "&", and
"==" in
# place of "=".
# Default is enabled, but to go back to the standard mode, disable it.
nonstandarddelimiter = on
# Banned image replacement
# Images that are banned due to domain/url/etc reasons including those
# in the adverts blacklists can be replaced by an image. This will,
# for example, hide images from advert sites and remove broken image
# icons from banned domains.
# on (default) | off
usecustombannedimage = on
custombannedimagefile = '/usr/share/dansguardian/transparent1x1.gif'
# Filter groups options
# filtergroups sets the number of filter groups. A filter group is a
set of content
# filtering options you can apply to a group of users. The value must
be 1 or more.
# DansGuardian will automatically look for dansguardianfN.conf where N
is the filter
# group. To assign users to groups use the filtergroupslist option.
All users default
# to filter group 1. You must have some sort of authentication to be
able to map users
# to a group. The more filter groups the more copies of the lists will
be in RAM so
# use as few as possible.
filtergroups = 1
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'
# Authentication files location
Last update: 22.11.2013 15:32.
bannediplist = '/etc/dansguardian/lists/bannediplist'
exceptioniplist = '/etc/dansguardian/lists/exceptioniplist'
# Show weighted phrases found
# If enabled then the phrases found that made up the total which
excedes
# the naughtyness limit will be logged and, if the reporting level is
# high enough, reported. on | off
showweightedfound = on
# Weighted phrase mode
# There are 3 possible modes of operation:
# 0 = off = do not use the weighted phrase feature.
# 1 = on, normal = normal weighted phrase operation.
# 2 = on, singular = each weighted phrase found only counts once on a
page.
#
weightedphrasemode = 2
# Positive (clean) result caching for URLs
# Caches good pages so they don't need to be scanned again.
# It also works with AV plugins.
# 0 = off (recommended for ISPs with users with disimilar browsing)
# 1000 = recommended for most users
# 5000 = suggested max upper limit
# If you're using an AV plugin then use at least 5000.
urlcachenumber = 1000
#
# Age before they are stale and should be ignored in seconds
# 0 = never
# 900 = recommended = 15 mins
urlcacheage = 900
# Clean cache for content (AV) scan results
# By default, to save CPU, files scanned and found to be
# clean are inserted into the clean cache and NOT scanned
# again for a while. If you don't like this then choose
# to disable it.
# (on|off) default = on.
scancleancache = on
# Smart, Raw and Meta/Title phrase content filtering options
# Smart is where the multiple spaces and HTML are removed before phrase
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
17/46
filtering
# Raw is where the raw HTML including meta tags are phrase filtered
# Meta/Title is where only meta and title tags are phrase filtered (v.
quick)
# CPU usage can be effectively halved by using setting 0 or 1 compared
to 2
# 0 = raw only
# 1 = smart only
# 2 = both of the above (default)
# 3 = meta/title
phrasefiltermode = 2
# Lower casing options
# When a document is scanned the uppercase letters are converted to
lower case
# in order to compare them with the phrases. However this can break
Big5 and
# other 16-bit texts. If needed preserve the case. As of version
2.7.0 accented
# characters are supported.
# 0 = force lower case (default)
# 1 = do not change case
# 2 = scan first in lower case, then in original case
preservecase =
# Note:
# If phrasefiltermode and preserve case are both 2, this equates to 4
phrase
# filtering passes. If you have a large enough userbase for this to be
a
# worry, and need to filter pages in exotic character encodings, it may
be
# better to run two instances on separate servers: one with
preservecase 1
# (and possibly forcequicksearch 1) and non ASCII/UTF-8 phrase lists,
and one
# with preservecase 0 and ASCII/UTF-8 lists.
# Hex decoding options
# When a document is scanned it can optionally convert %XX to chars.
# If you find documents are getting past the phrase filtering due to
encoding
# then enable. However this can break Big5 and other 16-bit texts.
# off = disabled (default)
# on = enabled
hexdecodecontent = off
Last update: 22.11.2013 15:32.
# Force Quick Search rather than DFA search algorithm
# The current DFA implementation is not totally 16-bit character
compatible
# but is used by default as it handles large phrase lists much faster.
# If you wish to use a large number of 16-bit character phrases then
# enable this option.
# off (default) | on (Big5 compatible)
forcequicksearch = off
# Reverse lookups for banned site and URLs.
# If set to on, DansGuardian will look up the forward DNS for an IP URL
# address and search for both in the banned site and URL lists. This
would
# prevent a user from simply entering the IP for a banned address.
# It will reduce searching speed somewhat so unless you have a local
caching
# DNS server, leave it off and use the Blanket IP Block option in the
# bannedsitelist file instead.
reverseaddresslookups = off
# Reverse lookups for banned and exception IP lists.
# If set to on, DansGuardian will look up the forward DNS for the IP
# of the connecting computer. This means you can put in hostnames in
# the exceptioniplist and bannediplist.
# If a client computer is matched against an IP given in the lists,
then the
# IP will be recorded in any log entries; if forward DNS is successful
and a
# match occurs against a hostname, the hostname will be logged instead.
# It will reduce searching speed somewhat so unless you have a local
DNS server,
# leave it off.
reverseclientiplookups = off
# Perform reverse lookups on client IPs for successful requests.
# If set to on, DansGuardian will look up the forward DNS for the IP
# of the connecting computer, and log host names (where available)
rather than
# IPs against requests.
# This is not dependent on reverseclientiplookups being enabled;
however, if it
# is, enabling this option does not incur any additional forward DNS
requests.
logclienthostnames = off
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
19/46
# Build bannedsitelist and bannedurllist cache files.
# This will compare the date stamp of the list file with the date stamp
of
# the cache file and will recreate as needed.
# If a bsl or bul .processed file exists, then that will be used
instead.
# It will increase process start speed by 300%. On slow computers this
will
# be significant. Fast computers do not need this option. on | off
createlistcachefiles = on
# POST protection (web upload and forms)
# does not block forms without any file upload, i.e. this is just for
# blocking or limiting uploads
# measured in kibibytes after MIME encoding and header bumph
# use 0 for a complete block
# use higher (e.g. 512 = 512Kbytes) for limiting
# use -1 for no blocking
#maxuploadsize = 512
#maxuploadsize = 0
maxuploadsize = -1
# Max content filter size
# Sometimes web servers label binary files as text which can be very
# large which causes a huge drain on memory and cpu resources.
# To counter this, you can limit the size of the document to be
# filtered and get it to just pass it straight through.
# This setting also applies to content regular expression modification.
# The value must not be higher than maxcontentramcachescansize
# The size is in Kibibytes - eg 2048 = 2Mb
# use 0 to set it to maxcontentramcachescansize
maxcontentfiltersize = 256
# Max content ram cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size of file that DG will download and cache
# in RAM. After this limit is reached it will cache to disk
# This value must be less than or equal to maxcontentfilecachescansize.
# use 0 to set it to maxcontentfilecachescansize
# This option may be ignored by the configured download manager.
maxcontentramcachescansize = 2000
Last update: 22.11.2013 15:32.
# Max content file cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size file that DG will download
# so that it can be scanned or virus checked.
# This value must be greater or equal to maxcontentramcachescansize.
maxcontentfilecachescansize = 20000
# File cache dir
# Where DG will download files to be scanned if too large for the
# RAM cache.
filecachedir = '/tmp'
# Delete file cache after user completes download
# When a file gets save to temp it stays there until it is deleted.
# You can choose to have the file deleted when the user makes a
sucessful
# download. This will mean if they click on the link to download from
# the temp store a second time it will give a 404 error.
# You should configure something to delete old files in temp to stop it
filling up.
# on|off (defaults to on)
deletedownloadedtempfiles = on
# Initial Trickle delay
# This is the number of seconds a browser connection is left waiting
# before first being sent *something* to keep it alive. The
# *something* depends on the download manager chosen.
# Do not choose a value too low or normal web pages will be affected.
# A value between 20 and 110 would be sensible
# This may be ignored by the configured download manager.
initialtrickledelay = 20
# Trickle delay
# This is the number of seconds a browser connection is left waiting
# before being sent more *something* to keep it alive. The
# *something* depends on the download manager chosen.
# This may be ignored by the configured download manager.
trickledelay = 10
# Download Managers
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
21/46
# These handle downloads of files to be filtered and scanned.
# They differ in the method they deal with large downloads.
# Files usually need to be downloaded 100% before they can be
# filtered and scanned before being sent on to the browser.
# Normally the browser can just wait, but with content scanning,
# for example to AV, the browser may timeout or the user may get
# confused so the download manager has to do some sort of
# 'keep alive'.
#
# There are various methods possible but not all are included.
# The author does not have the time to write them all so I have
# included a plugin systam. Also, not all methods work with all
# browsers and clients. Specifically some fancy methods don't
# work with software that downloads updates. To solve this,
# each plugin can support a regular expression for matching
# the client's user-agent string, and lists of the mime types
# and extensions it should manage.
#
# Note that these are the matching methods provided by the base plugin
# code, and individual plugins may override or add to them.
# See the individual plugin conf files for supported options.
#
# The plugins are matched in the order you specify and the last
# one is forced to match as the default, regardless of user agent
# and other matching mechanisms.
#
downloadmanager = '/etc/dansguardian/downloadmanagers/fancy.conf'
#downloadmanager = '/etc/dansguardian/downloadmanagers/trickle.conf'
downloadmanager = '/etc/dansguardian/downloadmanagers/default.conf'
# Content Scanners (Also known as AV scanners)
# These are plugins that scan the content of all files your browser
fetches
# for example to AV scan. The options are limitless. Eventually all
of
# DansGuardian will be plugin based. You can have more than one
content
# scanner. The plugins are run in the order you specify.
# This is one of the few places you can have multiple options of the
same name.
#
# Some of the scanner(s) require 3rd party software and libraries eg
clamav.
# See the individual plugin conf file for more options (if any).
#
#!! Not compiled !! contentscanner =
'/etc/dansguardian/contentscanners/clamav.conf'
#contentscanner = '/etc/dansguardian/contentscanners/clamdscan.conf'
#!! Unimplemented !! contentscanner =
Last update: 22.11.2013 15:32.
'/etc/dansguardian/contentscanners/kavav.conf'
#contentscanner = '/etc/dansguardian/contentscanners/kavdscan.conf'
#contentscanner = '/etc/dansguardian/contentscanners/icapscan.conf'
#contentscanner =
'/etc/dansguardian/contentscanners/commandlinescan.conf'
# Content scanner timeout
# Some of the content scanners support using a timeout value to stop
# processing (eg AV scanning) the file if it takes too long.
# If supported this will be used.
# The default of 60 seconds is probably reasonable.
contentscannertimeout = 60
# Content scan exceptions
# If 'on' exception sites, urls, users etc will be scanned
# This is probably not desirable behavour as exceptions are
# supposed to be trusted and will increase load.
# Correct use of grey lists are a better idea.
# (on|off) default = off
contentscanexceptions = off
# Auth plugins
# These replace the usernameidmethod* options in previous versions.
They
# handle the extraction of client usernames from various sources, such
as
# Proxy-Authorisation headers and ident servers, enabling requests to
be
# handled according to the settings of the user's filter group.
# Multiple plugins can be specified, and will be queried in order until
one
# of them either finds a username or throws an error. For example, if
Squid
# is configured with both NTLM and Basic auth enabled, and both the
'proxy-basic'
# and 'proxy-ntlm' auth plugins are enabled here, then clients which do
not support
# NTLM can fall back to Basic without sacrificing access rights.
#
# If you do not use multiple filter groups, you need not specify this
option.
#
#authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'
#authplugin = '/etc/dansguardian/authplugins/proxy-digest.conf'
#authplugin = '/etc/dansguardian/authplugins/proxy-ntlm.conf'
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
23/46
#authplugin = '/etc/dansguardian/authplugins/ident.conf'
#authplugin = '/etc/dansguardian/authplugins/ip.conf'
# Re-check replaced URLs
# As a matter of course, URLs undergo regular expression search/replace
(urlregexplist)
# *after* checking the exception site/URL/regexpURL lists, but *before*
checking against
# the banned site/URL lists, allowing certain requests that would be
matched against the
# latter in their original state to effectively be converted into grey
requests.
# With this option enabled, the exception site/URL/regexpURL lists are
also re-checked
# after replacement, making it possible for URL replacement to trigger
exceptions based
# on them.
# Defaults to off.
recheckreplacedurls = off
# Misc settings
# if on it adds an X-Forwarded-For: <clientip> to the HTTP request
# header. This may help solve some problem sites that need to know the
# source ip. on | off
forwardedfor = off
# if on it uses the X-Forwarded-For: <clientip> to determine the client
# IP. This is for when you have squid between the clients and
DansGuardian.
# Warning - headers are easily spoofed. on | off
usexforwardedfor = off
# if on it logs some debug info regarding fork()ing and accept()ing
which
# can usually be ignored. These are logged by syslog. It is safe to
leave
# it on or off
logconnectionhandlingerrors = on
# Fork pool options
# If on, this causes DG to write to the log file whenever child
Last update: 22.11.2013 15:32.
processes are
# created or destroyed (other than by crashes). This information can
help in
# understanding and tuning the following parameters, but is not
generally
# useful in production.
logchildprocesshandling = off
# sets the maximum number of processes to spawn to handle the incoming
# connections. Max value usually 250 depending on OS.
# On large sites you might want to try 180.
maxchildren = 120
# sets the minimum number of processes to spawn to handle the incoming
connections.
minchildren = 8
# sets the minimum number of processes to be kept ready to handle
connections.
minsparechildren = 4
# sets the minimum number of processes to spawn when it runs out
preforkchildren = 6
# sets the maximum number of processes to have doing nothing.
# When this many are spare it will cull some of them.
maxsparechildren = 32
# sets the maximum age of a child process before it croaks it.
# This is the number of connections they handle before exiting.
maxagechildren = 500
# Sets the maximum number client IP addresses allowed to connect at
once.
# Use this to set a hard limit on the number of users allowed to
concurrently
# browse the web. Set to 0 for no limit, and to disable the IP cache
process.
maxips =
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
25/46
# Process options
# (Change these only if you really know what you are doing).
# These options allow you to run multiple instances of DansGuardian on
a single machine.
# Remember to edit the log file path above also if that is your
intention.
# IPC filename
#
# Defines IPC server directory and filename used to communicate with
the log process.
ipcfilename = '/tmp/.dguardianipc'
# URL list IPC filename
#
# Defines URL list IPC server directory and filename used to
communicate with the URL
# cache process.
urlipcfilename = '/tmp/.dguardianurlipc'
# IP list IPC filename
#
# Defines IP list IPC server directory and filename, for communicating
with the client
# IP cache process.
ipipcfilename = '/tmp/.dguardianipipc'
# PID filename
#
# Defines process id directory and filename.
#pidfilename = '/var/run/dansguardian.pid'
# Disable daemoning
# If enabled the process will not fork into the background.
# It is not usually advantageous to do this.
# on|off (defaults to off)
nodaemon = off
# Disable logging process
nologger = off
# Enable logging of "ADs" category blocks
logadblocks = off
# Enable logging of client User-Agent
# Some browsers will cause a *lot* of extra information on each line!
Last update: 22.11.2013 15:32.
loguseragent = off
# Daemon runas user and group
# This is the user that DansGuardian runs as. Normally the user/group
nobody.
# Uncomment to use. Defaults to the user set at compile time.
# Temp files created during virus scanning are given owner and group
read
# permissions; to use content scanners based on external processes,
such as
# clamdscan, the two processes must run with either the same group or
user ID.
#daemonuser = 'dansguardian'
#daemongroup = 'dansguardian'
# Soft restart
# When on this disables the forced killing off all processes in the
process group.
# This is not to be confused with the -g run time option - they are not
related.
softrestart = off
# Mail program
# Path (sendmail-compatible) email program, with options.
# Not used if usesmtp is disabled (filtergroup specific).
mailer = '/usr/sbin/sendmail -t'
dansguardianf1.conf
Die weitere Konfiguration des Dansguardian-Content-filters/-Scanners erfolgt in der Datei
/etc/dansguardian/dansguardianf1.conf.
Mit dem Editor unserer Wahl - also vim - bearbeiten nun die erste der beiden Konfigurationsdateien.
# vim /etc/dansguardian/dansguardianf1.conf
Im ersten Schritt passen wir die Ansprechschwelle der gewichteten Seitenüberprüfung an. Mit einem
Naughtyness limit von 100 liegt man schon mal in einem praktikablen Bereich. :
# Naughtyness limit
# This the limit over which the page will be blocked. Each weighted phrase
is given
# a value either positive or negative and the values added up. Phrases to
do with
# good subjects will have negative values, and bad subjects will have
positive
# values. See the weightedphraselist file for examples.
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
27/46
# As a guide:
# 50 is for young children, 100 for old children,
# Django 2011-11-15
# default: naughtynesslimit = 50
naughtynesslimit = 100
160 for young adults.
In Summe ergibt sich also folgende erste Gesamtkonfiguration, die wir auch hier mittels einesw
geeigneten egrep-Aufrufes ohne die Kommentarzeilen uns ausgebven lassen können:
# egrep -v '(^.*#|^$)' /etc/dansguardian/dansguardianf1.conf
Die komplette zweite Konfigurationsdatei sieht somit wie folgt aus.
/etc/dansguardian/dansguardianf1.conf
# DansGuardian filter group config file for version 2.10.1.1
# Filter group mode
# This option determines whether members of this group have their web
access
# unfiltered, filtered, or banned. This mechanism replaces the
"banneduserlist"
# and "exceptionuserlist" files from previous versions.
#
# 0 = banned
# 1 = filtered
# 2 = unfiltered (exception)
#
# Only filter groups with a mode of 1 need to define phrase, URL, site,
extension,
# mimetype and PICS lists; in other modes, these options are ignored to
conserve
# memory.
#
# Defaults to 0 if unspecified.
# Unauthenticated users are treated as being in the first filter group.
groupmode = 1
# Filter group name
# Used to fill in the -FILTERGROUP- placeholder in the HTML template
file, and to
# name the group in the access logs
# Defaults to empty string
#groupname = ''
# Content filtering files location
bannedphraselist = '/etc/dansguardian/lists/bannedphraselist'
weightedphraselist = '/etc/dansguardian/lists/weightedphraselist'
exceptionphraselist = '/etc/dansguardian/lists/exceptionphraselist'
bannedsitelist = '/etc/dansguardian/lists/bannedsitelist'
Last update: 22.11.2013 15:32.
greysitelist = '/etc/dansguardian/lists/greysitelist'
exceptionsitelist = '/etc/dansguardian/lists/exceptionsitelist'
bannedurllist = '/etc/dansguardian/lists/bannedurllist'
greyurllist = '/etc/dansguardian/lists/greyurllist'
exceptionurllist = '/etc/dansguardian/lists/exceptionurllist'
exceptionregexpurllist =
'/etc/dansguardian/lists/exceptionregexpurllist'
bannedregexpurllist = '/etc/dansguardian/lists/bannedregexpurllist'
picsfile = '/etc/dansguardian/lists/pics'
contentregexplist = '/etc/dansguardian/lists/contentregexplist'
urlregexplist = '/etc/dansguardian/lists/urlregexplist'
# Filetype filtering
#
# Blanket download blocking
# If enabled, all files will be blocked, unless they match the
# exceptionextensionlist or exceptionmimetypelist.
# These lists do not override virus scanning.
# Exception lists defined above override all types of filtering,
including
# the blanket download block.
# Defaults to disabled.
# (on | off)
#
blockdownloads = off
exceptionextensionlist =
'/etc/dansguardian/lists/exceptionextensionlist'
exceptionmimetypelist = '/etc/dansguardian/lists/exceptionmimetypelist'
#
# Use the following lists to block specific kinds of file downloads.
# The two exception lists above can be used to override these.
#
bannedextensionlist = '/etc/dansguardian/lists/bannedextensionlist'
bannedmimetypelist = '/etc/dansguardian/lists/bannedmimetypelist'
#
# In either file filtering mode, the following list can be used to
override
# MIME type & extension blocks for particular domains & URLs (trusted
download sites).
#
exceptionfilesitelist = '/etc/dansguardian/lists/exceptionfilesitelist'
exceptionfileurllist = '/etc/dansguardian/lists/exceptionfileurllist'
# Categorise without blocking:
# Supply categorised lists here and the category string shall be logged
against
# matching requests, but matching these lists does not perform any
filtering
# action.
#logsitelist = '/etc/dansguardian/lists/logsitelist'
#logurllist = '/etc/dansguardian/lists/logurllist'
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
29/46
#logregexpurllist = '/etc/dansguardian/lists/logregexpurllist'
# Outgoing HTTP header rules:
# Optional lists for blocking based on, and modification of, outgoing
HTTP
# request headers. Format for headerregexplist is one modification
rule per
# line, similar to content/URL modifications. Format for
# bannedregexpheaderlist is one regular expression per line, with
matching
# headers causing a request to be blocked.
# Headers are matched/replaced on a line-by-line basis, not as a
contiguous
# block.
# Use for example, to remove cookies or prevent certain user-agents.
headerregexplist = '/etc/dansguardian/lists/headerregexplist'
bannedregexpheaderlist =
'/etc/dansguardian/lists/bannedregexpheaderlist'
# Naughtyness limit
# This the limit over which the page will be blocked. Each weighted
phrase is given
# a value either positive or negative and the values added up. Phrases
to do with
# good subjects will have negative values, and bad subjects will have
positive
# values. See the weightedphraselist file for examples.
# As a guide:
# 50 is for young children, 100 for old children, 160 for young
adults.
# Django 2011-11-15
# default : naughtynesslimit = 50
naughtynesslimit = 100
# Category display threshold
# This option only applies to pages blocked by weighted phrase
filtering.
# Defines the minimum score that must be accumulated within a
particular
# category in order for it to show up on the block pages' category
list.
# All categories under which the page scores positively will be logged;
those
# that were not displayed to the user appear in brackets.
#
# -1 = display only the highest scoring category
# 0 = display all categories (default)
# > 0 = minimum score for a category to be displayed
categorydisplaythreshold =
# Embedded URL weighting
Last update: 22.11.2013 15:32.
# When set to something greater than zero, this option causes URLs
embedded within a
# page's HTML (from links, image tags, etc.) to be extracted and
checked against the
# bannedsitelist and bannedurllist. Each link to a banned page causes
the amount set
# here to be added to the page's weighting.
# The behaviour of this option with regards to multiple occurrences of
a site/URL is
# affected by the weightedphrasemode setting.
#
# NB: Currently, this feature uses regular expressions that require the
PCRE library.
# As such, it is only available if you compiled DansGuardian with '-enable-pcre=yes'.
# You can check compile-time options by running 'dansguardian -v'.
#
# Set to 0 to disable.
# Defaults to 0.
# WARNING: This option is highly CPU intensive!
embeddedurlweight =
# Enable PICS rating support
#
# Defaults to disabled
# (on | off)
enablepics = off
# Temporary Denied Page Bypass
# This provides a link on the denied page to bypass the ban for a few
minutes. To be
# secure it uses a random hashed secret generated at daemon startup.
You define the
# number of seconds the bypass will function for before the deny will
appear again.
# To allow the link on the denied page to appear you will need to edit
the template.html
# or dansguardian.pl file for your language.
# 300 = enable for 5 minutes
# 0 = disable ( defaults to 0 )
# -1 = enable but you require a separate program/CGI to generate a
valid link
bypass =
# Temporary Denied Page Bypass Secret Key
# Rather than generating a random key you can specify one.
more than 8 chars.
# '' = generate a random one (recommended and default)
# 'Mary had a little lamb.' = an example
# '76b42abc1cd0fdcaf6e943dcbc93b826' = an example
bypasskey = ''
It must be
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
31/46
# Infection/Scan Error Bypass
# Similar to the 'bypass' setting, but specifically for bypassing files
scanned and found
# to be infected, or files that trigger scanner errors - for example,
archive types with
# recognised but unsupported compression schemes, or corrupt archives.
# The option specifies the number of seconds for which the bypass link
will be valid.
# 300 = enable for 5 minutes
# 0 = disable (default)
# -1 = enable, but require a separate program/CGI to generate a valid
link
infectionbypass =
# Infection/Scan Error Bypass Secret Key
# Same as the 'bypasskey' option, but used for infection bypass mode.
infectionbypasskey = ''
# Infection/Scan Error Bypass on Scan Errors Only
# Enable this option to allow infectionbypass links only when virus
scanning fails,
# not when a file is found to contain a virus.
# on = enable (default and highly recommended)
# off = disable
infectionbypasserrorsonly = on
# Disable content scanning
# If you enable this option you will disable content scanning for this
group.
# Content scanning primarily is AV scanning (if enabled) but could
include
# other types.
# (on|off) default = off.
disablecontentscan = off
# Enable Deep URL Analysis
# When enabled, DG looks for URLs within URLs, checking against the
bannedsitelist and
# bannedurllist. This can be used, for example, to block images
originating from banned
# sites from appearing in Google Images search results, as the original
URLs are
# embedded in the thumbnail GET requests.
# (on|off) default = off
deepurlanalysis = off
# reportinglevel
#
# -1 = log, but do not block - Stealth mode
# 0 = just say 'Access Denied'
Last update: 22.11.2013 15:32.
# 1 = report why but not what denied phrase
# 2 = report fully
# 3 = use HTML template file (accessdeniedaddress ignored) recommended
#
# If defined, this overrides the global setting in dansguardian.conf
for
# members of this filter group.
#
#reportinglevel = 3
# accessdeniedaddress is the address of your web server to which the
cgi
# dansguardian reporting script was copied. Only used in reporting
levels
# 1 and 2.
#
# 1. Non-proxied. Either a machine on the local network, or listed as
an
#
exception in your browser's proxy configuration.
# 2. Added to the exceptionsitelist. Option 1 is preferable; this
option is
#
only for users using both transparent proxying and a non-local
server
#
#
# If defined, this overrides the global setting in dansguardian.conf
for
# members of this filter group.
#
#accessdeniedaddress =
# HTML Template override
# If defined, this specifies a custom HTML template file for members of
this
# filter group, overriding the global setting in dansguardian.conf.
This is
# only used in reporting level 3.
#
# The default template file path is
<languagedir>/<language>/template.html
# e.g. /usr/share/dansguardian/languages/ukenglish/template.html when
using 'ukenglish'
# language.
#
# This option generates a file path of the form:
# <languagedir>/<language>/<htmltemplate>
# e.g. /usr/share/dansguardian/languages/ukenglish/custom.html
#
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
33/46
#htmltemplate = 'custom.html'
# Email reporting - original patch by J. Gauthier
# Use SMTP
# If on, will enable system wide events to be reported by email.
# need to configure mail program (see 'mailer' in global config)
# and email recipients
# default usesmtp = off
usesmtp = off
# mailfrom
# who the email would come from
# example: mailfrom = '[email protected]'
mailfrom = ''
# avadmin
# who the virus emails go to (if notify av is on)
# example: avadmin = '[email protected]'
avadmin = ''
# contentdmin
# who the content emails go to (when thresholds are exceeded)
# and contentnotify is on
# example: contentadmin = '[email protected]'
contentadmin = ''
# avsubject
# Subject of the email sent when a virus is caught.
# only applicable if notifyav is on
# default avsubject = 'dansguardian virus block'
avsubject = 'dansguardian virus block'
# content
# Subject of the email sent when violation thresholds are exceeded
# default contentsubject = 'dansguardian violation'
contentsubject = 'dansguardian violation'
# notifyAV
# This will send a notification, if usesmtp/notifyav is on, any time an
# infection is found.
# Important: If this option is off, viruses will still be recorded like
a
# content infraction.
notifyav = off
# notifycontent
# This will send a notification, if usesmtp is on, based on thresholds
# below
notifycontent = off
Last update: 22.11.2013 15:32.
# thresholdbyuser
# results are only predictable with user authenticated configs
# if enabled the violation/threshold count is kept track of by the user
thresholdbyuser = off
#violations
# number of violations before notification
# setting to 0 will never trigger a notification
violations =
#threshold
# this is in seconds. If 'violations' occur in 'threshold' seconds,
then
# a notification is made.
# if this is set to 0, then whenever the set number of violations are
made a
# notifaction will be sent.
threshold =
authplugins
Benutzt man keine Authentifizierung im Squid-Proxy, wie im Kapitel Konfiguration des Proxy's
beschrieben, bietet Dansguardian selbst einige Plugins zur Auswahl. Die Konfigurationsdateien
befinden sich im Pfad /etc/dansguardian/authplugins.
# ll /etc/dansguardian/authplugins
total 20
-rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--
1
1
1
1
1
root
root
root
root
root
root
root
root
root
root
104
323
195
257
190
Oct
Oct
Oct
Oct
Oct
15
15
15
15
15
22:23
22:23
22:23
22:23
22:23
ident.conf
ip.conf
proxy-basic.conf
proxy-digest.conf
proxy-ntlm.conf
contentscanners
In der Konfigurationsdatei /etc/dansguardian/contentscanners/clamdscan.conf erfolgt die
Konfigurationn des Contentvirenscanners. Da der Maintainer bei der Erstellung des RPM clamd
eincompiliert hat, lautet die Konfigurationsdatei clamdscan.conf.
/etc/dansguardian/contentscanners/clamdscan.conf
plugname = 'clamdscan'
# edit this to match the location of your ClamD UNIX domain socket
#clamdudsfile = '/var/run/clamav/clamd.sock'
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
35/46
# If this string is set, the text it contains shall be removed from the
# beginning of filenames when passing them to ClamD.
# Use it to - for example - support a ClamD running inside a chroot
jail:
# if DG's filecachedir is set to "/var/clamdchroot/downloads/" and
pathprefix
# is set to "/var/clamdchroot", then file names given to ClamD will be
of the
# form "/downloads/tf*" instead of "/var/clamdchroot/downloads/tf*".
#pathprefix = '/var/clamdchroot'
exceptionvirusmimetypelist =
'/etc/dansguardian/lists/contentscanners/exceptionvirusmimetypelist'
exceptionvirusextensionlist =
'/etc/dansguardian/lists/contentscanners/exceptionvirusextensionlist'
exceptionvirussitelist =
'/etc/dansguardian/lists/contentscanners/exceptionvirussitelist'
exceptionvirusurllist =
'/etc/dansguardian/lists/contentscanners/exceptionvirusurllist'
Die Anpassung(en) dieser Konfigurationsdate erfolgt im nachfolgenden Kapitel Virenfilterung bei
Dansguardian.
downloadmanagers
Im Verzeichnis /etc/dansguardian/downloadmanagers/ erfolgt die Definition und Konfiguration
des Downloadmanagers.
# ls -alf /etc/dansguardian/downloadmanagers/
total 20
-rw-r--r-- 1 root root 539 Oct 15 22:23 default.conf
-rw-r--r-- 1 root root 2003 Oct 15 22:23 fancy.conf
-rw-r--r-- 1 root root 1012 Oct 15 22:23 trickle.conf
default.conf
# vim /etc/dansguardian/downloadmanagers/default.conf
/etc/dansguardian/downloadmanagers/default.conf
# The default download manager.
# This is the safest option for unknown user-agents and content types,
and
# hence a good one to include last.
# Which plugin should be loaded?
plugname = 'default'
Last update: 22.11.2013 15:32.
# Regular expression for matching user agents
# When not defined, matches all agents.
#useragentregexp = '.*'
# Lists of mime types and extensions to manage
# When not defined, matches everything.
# These can be enabled separately; when both enabled,
# a request may match either list.
#managedmimetypelist = ''
#managedextensionlist = ''
fancy.conf
# vim /etc/dansguardian/downloadmanagers/fancy.conf
/etc/dansguardian/downloadmanagers/fancy.conf
# The 'fancy' download manager.
# This outputs a Javascript progress bar to the browser when a file is
taking
# a long time to download, and hence is unsuitable for browsers without
# javascript support; also you may wish to enable it only for
types/extensions
# that are usually downloaded individually, rather than embedded in a
web page,
# such as executables and archives.
plugname = 'fancy'
#
# 'mozilla' also matches firefox, IE, etc.
useragentregexp = 'mozilla'
# a request may match either list.
#managedmimetypelist =
'/etc/dansguardian/lists/downloadmanagers/managedmimetypelist'
managedextensionlist =
'/etc/dansguardian/lists/downloadmanagers/managedextensionlist'
# HTML/JavaScript Template
# The contents of this file determine what is presented to the user
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
37/46
during
# and after downloading/scanning. It is essentially an HTML file, but
must
# define certain JavaScript functions - called at various stages
during
# the process - allowing the page to be modified to reflect current
progress.
# This option generates a path of the form
<languagedir>/<language>/<template>
template = 'fancydmtemplate.html'
# Maximum download size
# When a file with unknown content length gets handled by the fancy DM,
# something must be done in the case that the file is found to be too
large
# to scan (i.e. larger than maxcontentfilecachescansize).
# As of 2.9.7.0, a warning will be issued to the user that the fancy DM
may
# not be able to cache the entire file, and the file will continue to
be
# downloaded to disk (but not scanned) until it reaches this size, at
which
# point the user will simply have to re-download the file (the URL
won't be
# scanned again).
# The size is in kibibytes (i.e. 10240 = 10Mb)
maxdownloadsize = 80000
trickle.conf
# vim /etc/dansguardian/downloadmanagers/trickle.conf
/etc/dansguardian/downloadmanagers/trickle.conf
# The trickle download manager.
# This is the least safe download manager, in that files which are/can
be
# processed before they are complete - such as certain image formats,
shell
# scripts, and multimedia files - MAY have a working, malicious portion
sent
# to the browser before scanning is complete.
# However, this download manager works by sending bytes from the actual
file
# to the client, and as such is the only manager which will indicate to
all
# clients that a download is in progress in a completely standard
manner.
Last update: 22.11.2013 15:32.
# At least one kilobyte of the file will be kept back until scanning is
# complete.
plugname = 'trickle'
#useragentregexp = '.*'
# a request may match etiher list.
#managedmimetypelist = ''
#managedextensionlist = ''
lists
Die feingranulare nutzungsindividuelle Einstellung unseres Dansguardian erfolgt über mehrere Blackund/oder White-Listen. Diese befinden sich im Verzeichnis /etc/dansguardian/lists.
# ll /etc/dansguardian/lists/
total 152
drwxr-xr-x
-rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r-drwxr-xr-x
-rw-r--r-drwxr-xr-x
drwxr-xr-x
-rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--rw-r--r--
2
1
1
1
1
1
1
1
1
3
1
2
2
1
1
1
1
1
1
1
1
1
1
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
root
4096
4949
500
284
1958
321
5229
4986
2640
4096
4979
4096
4096
480
912
834
708
653
538
208
1275
361
194
Nov
Oct
Oct
Oct
Oct
Oct
Oct
Oct
Oct
Nov
Oct
Nov
Nov
Oct
Oct
Oct
Oct
Oct
Oct
Oct
Oct
Oct
Oct
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
15
10:09
22:23
22:23
22:23
22:23
22:23
22:23
22:23
22:23
10:09
22:23
10:09
10:09
22:23
22:23
22:23
22:23
22:23
22:23
22:23
22:23
22:23
22:23
authplugins
bannedextensionlist
bannediplist
bannedmimetypelist
bannedphraselist
bannedregexpheaderlist
bannedregexpurllist
bannedsitelist
bannedurllist
blacklists
contentregexplist
contentscanners
downloadmanagers
exceptionextensionlist
exceptionfilesitelist
exceptionfileurllist
exceptioniplist
exceptionmimetypelist
exceptionphraselist
exceptionregexpurllist
exceptionsitelist
exceptionurllist
filtergroupslist
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
39/46
-rw-r--r-- 1 root root 1910
drwxr-xr-x 36 root root 4096
Oct
Oct
Oct
Oct
Oct
Oct
Nov
Oct
Oct
Oct
15
15
15
15
15
15
15
15
15
15
22:23
22:23
22:23
22:23
22:23
22:23
10:09
22:23
22:23
22:23
greysitelist
greyurllist
headerregexplist
logregexpurllist
logsitelist
logurllist
phraselists
pics
urlregexplist
weightedphraselist
Auf einzelnen spezielle Dateien wird im Kapitel Optimierung von Dansguardian eingegangen.
Starten von Dansguardian
Nun starten wir das erste mal unsere neuen Dienst dansguardian:
# service dansguardian start
Web Content Filter (dansguardian) starten:
[
OK
]
Im Syslog wird uns der erfolgreiche Start entsprechend dokumentiert:
Nov 15 11:10:51 vml000040 dansguardian[12815]: Started sucessfully.
Auf Port 8080 lauscht nun unser Dansguardian-Daemon, was wir mit netstat entsprechend
überprüfen können:
# netstat -tulpen | grep dansguardian
tcp
LISTEN
0
498
0 0.0.0.0:8080
0.0.0.0:*
53511
12815/dansguardian
In der Prozessliste sehen wir ferner die gestarteten Dansguardian-Prozesse:
# ps aux | grep dansguardian
498
12815
dansguardian
498
12816
dansguardian
498
12817
dansguardian
498
12818
dansguardian
498
12819
dansguardian
498
12821
dansguardian
0.0
1.2 129580 12396 ?
Ss
11:10
0:00
0.0
1.2 129584 12296 ?
S
11:10
0:00
0.0
1.1 130560 12156 ?
S
11:10
0:00
0.0
1.1 129580 12192 ?
S
11:10
0:00
0.0
1.1 129580 12200 ?
S
11:10
0:00
0.0
1.1 129580 12200 ?
S
11:10
0:00
Last update: 22.11.2013 15:32.
498
12822
dansguardian
498
12823
dansguardian
498
12824
dansguardian
498
12825
dansguardian
498
12826
dansguardian
root
12836
dansguardian
0.0
1.1 129580 12200 ?
S
11:10
0:00
0.0
1.1 129580 12200 ?
S
11:10
0:00
0.0
1.1 129580 12200 ?
S
11:10
0:00
0.0
1.1 129580 12200 ?
S
11:10
0:00
0.0
1.1 129580 12200 ?
S
11:10
0:00
0.0
0.0 103148
S+
11:12
0:00 grep
832 pts/1
automatisches Starten von Dansguardian beim Systemstart
Damit der Dansguardian-daemon automatisch bei jedem Systemstart startet, kann die Einrichtung
des Start-Scriptes über folgenden Befehl erreicht werden:
# chkconfig dansguardian on
Die Überprüfungung ob der Dienst (Daemons) Dansguardian wirklich bei jedem Systemstart
automatisch mit gestartet wird, kann durch folgenden Befehle erreicht werden:
# chkconfig --list | grep dansguardian
dansguardian
0:off
1:off
2:on
3:on
4:on
5:on
6:off
Wichtig sind jeweils die Schalter on bzw. Ein bei den Runleveln - 2 3 4 5.
Dansguardian's Startoptionen
Das binary von Dansguardian bringt uns von Haus aus, ein paar nützliche Startoptionen mit. Welches
dies sind zeigt uns ein Aufruf von dansguardian mit der Option -h.
# dansguardian -h
Usage: dansguardian [{-c ConfigFileName|-v|-P|-h|-N|-q|-s|-r|-g}]
-v gives the version number and build options.
-h gives this message.
-c allows you to specify a different configuration file location.
-N Do not go into the background.
-q causes DansGuardian to kill any running copy.
-Q kill any running copy AND start a new one with current options.
-s shows the parent process PID and exits.
-r closes all connections and reloads config files by issuing a HUP,
but this does not reset the maxchildren option (amongst others).
-g gently restarts by not closing all current connections; only reloads
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
41/46
filter group config files. (Issues a USR1)
Option -v
Mit Hilfe der Option -v können wir uns die Programmversion anzeigen sowie die Option, die der
Maintainer beim Erstellen des Programms mit angegeben hatte.
# dansguardian -v
DansGuardian 2.10.1.1
Built with: '--build=x86_64-unknown-linux-gnu' '--host=x86_64-unknownlinux-gnu' '--target=x86_64-redhat-linux-gnu' '--program-prefix=' '-prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin'
'--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '-libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '-sharedstatedir=/var/lib' '--mandir=/usr/share/man' '-infodir=/usr/share/info' '--disable-clamav' '--enable-clamd' '--enable-icap'
'--enable-kavd' '--enable-commandline' '--enable-trickledm' '--enable-ntlm'
'--enable-email' '--with-proxyuser=dansguardian' '--withproxygroup=dansguardian' 'build_alias=x86_64-unknown-linux-gnu'
'host_alias=x86_64-unknown-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu'
'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstackprotector --param=ssp-buffer-size=4 -m64 -mtune=generic' 'CFLAGS=-O2 -g pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector -param=ssp-buffer-size=4 -m64 -mtune=generic'
Option -g
Hat man Änderungen an den Konfigurationsfiles vorgenommen so ist i.d.R. ein Neustart des daemon
notwendig.
# service dansguardian restart
Shutting down Web Content Filter (dansguardian):
Starting Web Content Filter (dansguardian):
[
[
OK
OK
]
]
Möchte man aber in einer Prodktionsumgebung mit vielen Verbindungen diese nicht unterbrechen,
sondern nur das Regelwerk neu einlesen, so nutzen wir die Option -g:
# dansguardian -g
Paketfilter anpassen
Damit nun auf unserem Dansguardian Webcontentscanner Server auch Anfragen auf Port 8080 auch
zugelassen werden, passen wir noch die iptables-Filterregeln auf unserem System an.
Last update: 22.11.2013 15:32.
Wir überprüfen also erst einmal die Paketfiltereinstellungen
# iptables -L
Chain INPUT (policy ACCEPT)
target
prot opt source
ACCEPT
all -- anywhere
RELATED,ESTABLISHED
ACCEPT
icmp -- anywhere
ACCEPT
all -- anywhere
ACCEPT
tcp -- anywhere
dpt:ssh
ACCEPT
tcp -- anywhere
dpt:squid
REJECT
all -- anywhere
icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target
prot opt source
REJECT
all -- anywhere
Chain OUTPUT (policy ACCEPT)
target
prot opt source
destination
anywhere
state
anywhere
anywhere
anywhere
state NEW tcp
anywhere
state NEW tcp
anywhere
reject-with
destination
anywhere
reject-with
destination
Für den Dansguardian Webcontent-Scanner, der auf Port 8080 lauschen wird, tragen wir also eine
passende Regel in der Konfigurationsdatei des Paketfilters iptables ein.
# vim /etc/sysconfig/iptables
/etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [:]
:FORWARD ACCEPT [:]
:OUTPUT ACCEPT [:]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# Django : 2011-11-14 squid-proxy-Zugriff freigeschaltet
#
# Django : 2011-11-15 dansguardian web cointentfilter freigeschaltet
#
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
43/46
COMMIT
Anschließend aktivieren wir die neue Regel, indem wir den Service iptables einmal durchstarten.
# service iptables restart
iptables:
iptables:
iptables:
iptables:
Flushing firewall rules:
Setting chains to policy ACCEPT: filter
Unloading modules:
Applying firewall rules:
[
[
[
[
OK
OK
OK
OK
]
]
]
]
Eine erneute Abfrage der Paketfilterregeln zeigt uns nun die neue Einstellung.
# iptables -L
Chain INPUT (policy ACCEPT)
target
prot opt source
ACCEPT
all -- anywhere
RELATED,ESTABLISHED
ACCEPT
icmp -- anywhere
ACCEPT
all -- anywhere
ACCEPT
tcp -- anywhere
dpt:ssh
ACCEPT
tcp -- anywhere
dpt:squid
ACCEPT
tcp -- anywhere
dpt:webcache
REJECT
all -- anywhere
Chain FORWARD (policy ACCEPT)
target
prot opt source
REJECT
all -- anywhere
Chain OUTPUT (policy ACCEPT)
target
prot opt source
destination
anywhere
state
anywhere
anywhere
anywhere
state NEW tcp
anywhere
state NEW tcp
anywhere
state NEW tcp
anywhere
reject-with
destination
anywhere
reject-with
destination
Clienttest
Bei einem ersten (Test-)Host in unserem Netzwerk werden wir nun bei unserem Browser als Proxy
unseren neu definierten Squid-Proxyserver eintragen. Am Beispiel von Firefox finden wir die
betreffenden Einstellungen auf dem Reiter [Netzwerk]] im Menüpunkt [Einstellungen].
Last update: 22.11.2013 15:32.
Auf dem folgenden Einstellungsfenster tragen wir nun die IP-Adresse unseres Web-Content-ScannerServers, wie auch die Portnummer 8080 ein.
Rufen wir nun eine vermutlich nicht ganz jugendfreie Seite auf, so wird uns nach der BenutzerAuthentifizierung, eine entsprechende Sperrseite angezeigt.
Printed on 22.12.2016 06:28.
22.12.2016 06:28.
45/46
Im Access-Log unseres Webcontentscanners wird der versuchte Zugriff auf die Seite protokolliert und
in diesem Beispiel auch vermerkt, dass die Seite auf Grund einer Gewichtete
Ausdrucksbeschränkung *DENIED* wurde, diese also dem Anwender gan nicht angezeigt wurde.
# less /var/log/dansguardian/access.log
2011.11.15 11:25:23 - 10.0.0.20 http://hustler.com GET 0 0 1 302 2011.11.15 11:25:24 - 10.0.0.20
http://hustlercash.com/hit/9/2/420901/7/31825/1?u=http://hustler.com/hustler
-porn/&redirect= GET 0 0 1 301 2011.11.15 11:25:26 - 10.0.0.20
http://hustler.com/hustler-porn/?cs=1&u=http://hustler.com/hustler-porn/&red
irect=&s=9&p=2&w=420901&t=7&c=31825 *DENIED* Gewichtete
Ausdrucksbeschränkung von 100 : 4926 (( cock, xxx)+( porn, fuck)+( porn,
horny)+( porn, twat)+( porn, xxx)+( slut, porn)+( slut, xxx)+( slut,
horny)+( teen , fuck)+( xxx, porn)+( xxx, sex )+( xxx, babe)+( xxx,
fuck)+( xxx, horny)+( xxx, slut)+( xxx, suck)+(18, u.s.c, 2257, compl)+(
2257 , statement)+(amateur, porn)+(amateur, slut)+(amateur,
tits)+(amateur, xxx)+(amateur, fuck)+(barely legal, horny )+(barely legal,
porn)+(barely legal, slut)+(barely legal, xxx )+(barely legal,
amateur)+(barely legal, fuck)+(barely legal, suck)+(barely legal,
teen)+(bdsm, horny )+(bdsm, porn)+(bdsm, slut)+(beaver, fuck)+(beaver,
porn)+(beaver, xxx)+(blonde, porn)+(blonde, xxx )+(blonde,
fuck)+(bondage, horny )+(bondage, porn)+(bondage, slut)+(bondage, xxx
Last update: 22.11.2013 15:32.
)+(bondage, fuck)+(centerfold, horny )+(centerfold, porn)+(centerfold,
slut)+(centerfold, teen, sex )+(centerfold, xxx )+(centerfold,
fuck)+(fuck, porn)+(fuck, xxx)+(fuck, horny)+(fuck, slut)+(hardcore,
slut)+(hardcore, fuck)+(hooker, horny )+(hooker, slut)+(hooker, xxx
)+(hooker, fuck)+(hot, slut)+(instant access, cock, suck)+(instant access,
fuck)+(instant access, horny)+(instant access, porn)+(instant access,
slut)+(instant access, twat)+(instant access, xxx)+(latex, bondage)+(models,
appearing, 18 or older)+(naughty, horny )+(naughty, slut)+(naughty, xxx
)+(naughty, fuck)+(porn star, horny )+(porn star, hot )+(porn star,
slut)+(porn star, fuck)+(porn star, pussies)+(pornstar, horny )+(pornstar,
hot )+(pornstar, slut)+(pornstar, fuck)+(pornstar, pussies)+(pussies,
slut)+(pussies, xxx)+(pussies, horny)+(teen, horny )+(teen, porn)+ boob+
girl + hardcore + lesbian + nasty + porn+ sex + slut+ xxx +all
models+amateur+babes+barely legal+barely legal babes+big dick+big
tits+blowjob+bondage+boobs+breast+busty+-careers+centerfold+employment+fuck+-genre+hardcore sex+horny+hot and horny+hot
lesbian+hottest+hustler mag+instant access+join now+lesbian porn+live sex+main+naughty+-newsletter+party slut+porn star+pussies+ready to fuck+sexy+social+-test +-transparent+-travel+-treatment+whips and chains) GET 55523
4926 Pornography 1 403 text/html
2011.11.15 11:25:26 - 10.0.0.20 http://hustler.com/favicon.ico GET 247 0 1
302 2011.11.15 11:25:27 - 10.0.0.20
http://hustlercash.com/signup/joinform.php?site=9&cp=_newstatic GET 0 0 1
302 2011.11.15 11:25:29 - 10.0.0.20 http://hustler.com/favicon.ico GET 247 0 1
302 2011.11.15 11:25:30 - 10.0.0.20
http://hustlercash.com/signup/joinform.php?site=9&cp=_newstatic GET 0 0 1
302 -
Links
Zurück zum Kapitel >>Proxyserver Squid mit Web-Contentfilter Dansguardian und
Virenfilter ClamAV unter CentOS 6.x<<
Zurück zu >>Projekte und Themenkapitel<<
Zurück zur Startseite
From:
https://dokuwiki.nausch.org/ - Linux - Wissensdatenbank
Permanent link:
https://dokuwiki.nausch.org/doku.php/centos:dansg:install
Last update: 22.11.2013 15:32.
Printed on 22.12.2016 06:28.

Installation und Konfiguration unter CentOS 6.x

Transcription

Documents pareils

Le reggae

Sun Microsystems, Inc. 2550 Garcia Avenue Mountain View, CA

Mise à jour Centreon 2.1.11 vers 12

i`m marissa - JDRF Tell Your Story

Fax-Server mit HylaFAX+ unter CentOS5 - Linux

AGOPIAN Mathieu

Groupe Tribute Français et Européen SAVOR Tribute Santana https

An angler´s paradise

Erklärung über Vordienstzeiten zur Stufenfestsetzung nach § 16 TV-L