To have a proper understanding of how Dansguardian works and the importance of certain configuration settings you should visit the Dansguardian web site at

http://dansguardian.org

and also see the detailed installation notes at

http://dansguardian.org/downloads/detailedinstallation2.4.html#further

Some of the information on the dansguardian website is of a generic nature and is NOT applicable to sme server installations, refer to the instructions in this HOWTO in preference.

The following instructions are based on these rpms, which can be downloaded from:

http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/rmitchell/smeserver/contribs/dansguardian/rpms/2.8.0.6/

dansguardian-2.8.0.6-1.2.el4.rf.i386.rpm

smeserver-dansguardian-1.2-4.noarch.rpm

dungog-blacklists-1.0-20061002.noarch.rpm

Download the required rpms into an empty folder on your sme server using the Linux wget command

wget http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/rmitchell/smeserver/contribs/dansguardian/rpms/2.8.0.6/dansguardian-2.8.0.6-1.2.el4.rf.i386.rpm

wget http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/rmitchell/smeserver/contribs/dansguardian/rpms/2.8.0.6/smeserver-dansguardian-1.2-4.noarch.rpm

wget http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/rmitchell/smeserver/contribs/dansguardian/rpms/2.8.0.6/dungog-blacklists-1.0-20061002.noarch.rpm

Instal the rpms

rpm -Uvh *.rpm

You need to manually modify two configuration files

/etc/dansguardian/dansguardian.conf

and

/etc/dansguardian/dansguardianf1.conf

pico -w /etc/dansguardian/dansguardian.conf

You will initially need to change:

accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl'

for example to

accessdeniedaddress = 'http://www.mydomain.com/cgi-bin/dansguardian.pl'

Make any other required changes to suit your situation by carefully reviewing the other setting possibilities

Ctrl o

Ctrl x

pico -w /etc/dansguardian/dansguardianf1.conf

You may initially need to change (to suit adult level of protection)

naughtynesslimit = 50

to

naughtynesslimit = 160 (or even 250 or 300 depending on your sensitivity requirements)

Make any other required changes to suit your situation by carefully reviewing the other setting possibilities

Ctrl o

Ctrl x

You will need to change other config files to suit your requirements:

You can read information in the beginning of each config file that explains usage & syntax

These are located in /etc/dansguardian/.....

eg

pico -w /etc/dansguardian/bannedextensionlist

make the required changes

then do

Ctrl o (to save your changes)

then do

Ctrl x (to exit)

Most users will need to change these 4 files as a minimum

exceptionsitelist

bannedsitelist

bannedurllist

bannedextensionlist

You should review ALL the dansguardian config files as part of your initial Dansguardian setup.

Some of the default settings in these files will prevent access to certain web sites and file types which may conflict with your site requirements.

See detailed information about these files in the "Further customisation" section at the end of this Howto or at http://dansguardian.org

You will also want to tailor the html template for the error message displayed when Dansguardian blocks a site, see

/etc/dansguardian/languages/(languagename)/template.html

eg

pico -w /etc/dansguardian/languages/ukenglish/template.html

After install & initial configuration you must manually start Dansguardian to enable web content filtering

(Note that suitable links to start dansguardian at reboot are setup when the rpm is installed)

/etc/init.d/dansguardian start

If you need to stop Dansguardian (ie to disable filtering or test your system without dansguardian running)

/etc/init.d/dansguardian stop

You will need to restart Dansguardian after making any configuration changes (so they can take effect)

/etc/init.d/dansguardian restart

If you need to check that Dansguardian is running

/etc/init.d/dansguardian status

Dansguardian uses port 8080 for web proxy requests. If your browser does not use port 8080 then Dansguardian filtering will be bypassed. To force this usage you should do the following:

Change the default transparent proxy port on your sme server.

Set your browser to auto detect the proxy server port.

Block direct access to the squid proxy port.

It would also be prudent to prevent users from changing the proxy port settings in their browsers, so that the browser is always forced to use the transparent proxy port 8080, although with the preceeding settings in place this should not be strictly necessary.

By default the proxy server is on port 3128

To change the Transparent proxy port setting to port 8080 permanently, do the following (on sme server)

db configuration setprop squid TransparentPort 8080

signal-event post-upgrade

reboot

Go to your workstation and open your browser

eg Internet Explorer or Firefox or your browser

Change the settings for Connections to LAN

Preferably select Auto detect proxy

Alternatively use the server IP 192.168.1.1 (or whatever yours is)

and use a port of 8080 (instead of 3128)

Knowledgable users can change the setting in the browser to bypass Dansguardian filtering by changing the proxy port specifically to port 3128, as the squid proxy port is still accessible.

You can control Windows/Web browser configuration using security policies eg gpedit.msc (Group Policy Editor) to block access to IE configuration menus etc.

You can also control settings in Firefox using appropriate tweaks.

Alternatively (& perhaps a better approach) is to block access to the sme server proxy port 3128, as follows. 

From a forum post by cheezeweeze - http://forums.contribs.org/viewtopic.php?p=144542

Note that this may affect programs that require direct access to the squid proxy port.

To block access to the full squid proxy on port 3128

Create a custom squid.conf template

To save editing & mistakes, you can download a modified custom template fragment (20ACL10localhost ) from here:

http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/rmitchell/smeserver/contribs/dansguardian/templates/squid.conf/

Copy this to the custom template folder specified below, then skip the following editing steps & do the expand template & restart instructions.

mkdir -p /etc/e-smith/templates-custom/etc/squid/squid.conf/

cp -pR /etc/e-smith/templates/etc/squid/squid.conf/20ACL10localhost /etc/e-smith/templates-custom/etc/squid/squid.conf/20ACL10localhost

(above command all on one line, note spaces)

Edit the custom template 20ACL10localhost

pico -w /etc/e-smith/templates-custom/etc/squid/squid.conf/20ACL10localhost

Make changes so your contents look like this:

{

use esmith::NetworksDB;

my $ndb = esmith::NetworksDB->open_ro();

$localAccess = $ndb->local_access_spec();

$OUT .= "acl localsrc src 127.0.0.1\n";

$OUT .= "acl localdst dst 127.0.0.1";

}

Ctrl o (to save)

Ctrl x (to exit)

Expand squid.conf template:

expand-template /etc/squid/squid.conf

Restart squid

svc -t /service/squid

From a workstation web browser go to the site of

www.sex.com

You should receive a message advising the site is blocked

Try browsing to other sites with inappropriate content or a site on your banned site list and you should also receive a site blocked message.

Remember that access to sites is controlled by settings in the config files mentioned above.

If you wish to make dansguardian use squidguard blocking rules & have them updated weekly then ad the following to /etc/cron.weekly/dansguardian

Please check the location of the blacklists is still current, if necessary search Google on "squidGuard blacklists" to find a current location.

You can also download the blacklist from this archive:

http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/rmitchell/smeserver/contribs/dansguardian/rpms/2.8.0.6/

cd /etc/dansguardian

rm -r blacklists.tar.gz

wget -qnv http://ftp.teledanmark.no/pub/www/proxy/squidGuard/contrib/blacklists.tar.gz -O blacklists.tar.gz

tar -zxf blacklists.tar.gz

chown -R root.root blacklists

chmod -R 640 blacklists

find blacklists -name new\* -exec rm {} \;

rm blacklists/README

chmod ug+x blacklists

chmod ug+x blacklists/*

At the time of writing of this revised Howto (6 July 2007), newer rpms than those referred to in these instructions are available at dungog.net

Please note that the newer version of Dansguardian incorporates new functionality, and configuration of that functionality is not covered in this Howto.

You can download the following rpms

dansguardian-2.9.8-2.noarch.rpm

smeserver-dansguardian-2.9-2.noarch.rpm

dungog-blacklists-1.0-20061002.noarch.rpm

from

http://distro.ibiblio.org/pub/linux/distributions/smeserver//contribs/dungog/packages/smeserver/7.0/i386/RPMS.dungog/

or from archives at

http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/rmitchell/smeserver/contribs/dansguardian/rpms/2.9.8-2/ 

Please be aware that this newer version of dansguardian supports a significantly different feature set, and requires different configuration steps than those referred to in this Howto.

There are various db commands to configure some of the new features. Search the contribs.org forums and dungog.net web site for these.

DansGuardian is highly configurable. The source code is available so you have the ultimate in configurability, although most people will be content with modifying the configuration files.

After you have modified any configuration file, to apply the changes you will need to restart DansGuardian.

There are two main configuration files, several banned lists and exception lists. These are all explained below:

This contains a list of domain endings that if found in the requested URL, DansGuardian will not filter the page. Note that you should not put the http:// or the www. at the beginning of the entries.

This contains a list of client IPs who you want to bypass the filtering. For example, the network administrator's computer's IP.

Usernames who will not be filtered (basic authentication or ident must be enabled).

If any of the phrases listed here appear in a web page then the filtering is bypassed. Care should be taken adding phrases to this file as they can easily stop many pages from being blocked. It would be better to put a negative value in the weightedphraselist.

URLs in here are for parts of sites that filtering should be switched off for.

IP addresses of client machines to disallow web access to. Only put IP addresses here, not host names.

This contains a list of banned phrases. The phrases must be enclosed between < and >. DansGuardian is supplied with an example list. You can not use phrases such as <sex> as this will block sites such as Middlesex University. The phrases can contain spaces. Use them to your advantage. This is the most useful part of DansGuardian and will catch more pages than PICS and URL filtering put together.

Combinations of phrases can also be used, which if they are all found in a page, it is blocked. Exception phrases are no longer listed in this file - see exceptionphraselist.

Users names, who, if basic proxy authentication is enabled, will automatically be denied web access.

This contains a list of banned MIME-types. If a URL request returns a MIME-type that is in this list, DansGuardian will block it. DansGuardian comes with some example MIME-types to deny. This is a good way of blocking inappropriate movies for example. It is obviously unwise to ban the MIME-types text/html or image/*.

This contains a list of banned file extensions. If a URL ends in an extension that is in this list, DansGuardian will block it. DansGuardian comes with some example file extensions to deny. This is a good way of blocking kiddies from downloading those lovely screen savers and hacking tools. You are a fool if you ban the file extension .html, or .jpg etc.

This contains a list of banned regular expression URLs. For more information on regular expressions, see http://www.opengroup.org/onlinepubs/7908799/xbd/re.html

Regular expressions are a very powerful pattern matching system. This file allows you to match URLs using this method.

This file contains a list of banned sites. Entering a domain name here bans the entire site. For banning specific parts of a site, see bannedurllist. Also, you can have a blanket ban all sites except those specifically excluded in exceptionsitelist. You can also block sites specified only as an IP address, and include a stock squidGuard blacklists collection. To enable these blacklists, download them from the extras section http://dansguardian.org/?page=extras

Simply put them somewhere appropriate, un-comment the squidGuard blacklists collection lines at the bottom of the bannedsitelist file, and check the paths are correct. For URL blacklists, edit the bannedurllist in a similar way.

This allows you to block specific parts of a site rather than the whole site. To block an entire site, see bannedsitelist. To enable squidGuard blacklists for URLs, you will need to download the blacklists and edit the squidGuard blacklists collection section at the bottom (as for bannedsitelist above).

Each phrase is given a value either positive or negative and the values are added up. Phrases to do with good subjects will have negative values, and bad subjects will have positive values. Once the naughtyness limit is reached (within dansguardian.conf), the page is blocked. See the Naughtyness Limit description within the dansguardian.conf section below.

This file allows you to finely tune the PICS filtering. Each PICS section comes with a description of the allowed settings and what they represent. The default settings with DansGuardian are set for youngish children, for example mild profanities and artistic nudity are allowed. PICS filtering can also be totally disabled / enabled using the enablePICS = on | off option.

contentregexplist

The ICRA section is fairly self-explanatory. A value of 0 means nothing of that category is allowed, whereas a value of 1 allows it. For example,

ICRAnudityartistic = 1

allows nude art. For more in-depth information see http://www.rsac.org/

RSAC is an older version of ICRA. The values here range from 0 meaning none allowed, through 2 (the default value), to 4, which allows wanton and gratuitous amounts of the given category. For more in-depth information see http://www.rsac.org/

evaluWEB rating uses a system similar to the British Film classification system:

0 = U (Universal, ie. suitable for even the youngest viewer)

1 = PG (Parental Guidance recommended)

2 = 18 (Only suitable for viewers aged 18 and over)

Similar to RSAC, but containing a larger range of categories with the range from 0 = full filtering to 9 = wanton and gratuitous. For more in-depth information, see http://www.safesurf.com

See evaluWEB. For more in-depth information, see http://www.weburbia.com/safe/index.shtml

This is yet another ratings scheme. See http://vancouver-webpages.com/VWP1.0/

for more information.

The only setting that is vital for you to configure in the dansguardian.conf file is the accessdeniedaddress setting. You should set this to the address (not the file path) of your Apache server with the perl access denied reporting script. For most people this will be the same server as squid and DansGuardian. If you really want you can change this address to a normal html static page on any server.

You can change the reporting level for when a page gets denied. It can say just 'Access Denied', or report why, or report why and what the denied phrase is. The latter may be more useful for testing, but the middler would be more useful in a school environment. Stealth mode logs what would be denied but doesn't do any blocking.

This setting lets you configure the logging level. You can log nothing, just denied pages, text based and all requests. HTTPS requests only get logged when the logging is set to 3 - all requests.

Log if an exception (user, ip, URL, or phrase) is matched and so the page gets let through. This can be useful for diagnosing why a site gets through the filter.

This setting alters the format of the DansGuardian log file. Please note option 3 (standard log format) is not yet unimplemented.

These allow you to modify the IP address that DansGuardian is listening on, the port DansGuardian listens on, the IP address of the server running squid as well as the squid port. It is possible to configure the Access Denied reporting page here also.

Here you can modify the location of the list files. Adjusting these locations is not recommended.

This setting refers to the weighted phrase limit over which the page will be blocked. Each weighted phrase is given a value either positive or negative and the values added up. Phrases to do with good subjects will have negative values, and bad subjects will have positive values. See the weightedphraselist file for examples. As a rough guide, a value of 50 is for young children, 100 for older children, 160 for young adults.

If enabled then the phrases found that made up the total which exceeds the naughtyness limit will be logged and, if the reporting level is high enough, reported.

If set to on, DansGuardian will look up the forward DNS for an IP URL address and search for both in the banned site and URL lists. This would prevent a user from simply entering the IP for a banned address. It will reduce searching speed somewhat so unless you have a local caching DNS server, leave it off and use the Blanket IP Block option in the bannedsitelist file instead.

This will compare the date stamp of the list file with the date stamp of the cache file and will recreate as needed. If a bsl or bul .processed file exists, then that will be used instead. It will increase process start speed by 300%. On slow computers this will be significant. Fast computers do not need this option.

This is for blocking or limiting uploads, not for blocking forms without any file upload. The value is given in kilobytes after MIME encoding and header information.

The proxyauth option is for when basic proxy authentication is used (obviously no good for transparent proxying). The ntlm option is for when the proxy supports the MS NTLM authentication. This only works with IE5.5 sp1 and later, and has not been implemented yet. The ident option causes DansGuardian to try to connect to an identd server on the computer originating the request.

This option adds an X-Forwarded-For: <clientIP> to the HTTP request header. This may help solve some problem sites that need to know the source IP.

This sets the maximum number of processes to spawn to handle the incoming connections. This will prevent DoS attacks killing the server with too many spawned processes. On large sites you might want to double or triple this number.

This option logs some debug info regarding fork()ing and accept()ing which can usually be ignored. These are logged by syslog. It is safe to leave this setting on or off.