1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
|
[1][squidGuard.gif] The squidGuard FAQ [faq.gif]
[2]squidGuard is an ultrafast and free filter, redirector and access
controller for [3]Squid
By [4]Pl Baltzersen and [5]Lars Erik Hland
[6]Copyright 1999-2000, [7]ElTele st AS
This page was last modified 2000-08-23
[arrow-red.gif] FAQ - Frequently Asked/Answered Questions
Currently in semirandom order:
1.
Is there a mailing list for squidGuard?
[8]Yes!.
2.
I have db3.x.x installed and squidGuard won't compile?
Only [9]db2.x.x versions are supported. We are working on
db3.x.x support, but the API has changed so it may take a
while to fix.
3.
squidGuard does not block?
There my be at least 2 reasons for this:
1. You didn't end your pass rules with "none". Pass rules
ends with an implicit "all". It is good practice to
allways en the pass rules with either "all" or "none" to
make them clear. Ie. use:
pass good none
or
pass good !bad all
2. squidGuard goes into emergency mode. Reasons may be
syntax errors in the config file, reference to non
existing database files, filprotection problems or
missing directories. Check the squidGuard log.
Note:When run under Squid, squidGuard is run with the
same user and group ID as Squid (cache_effective_user
and cache_effective_group in squid.conf). The squidGuard
configuration and database files must be readable for
this user and/or group and the squidGuard log directory
must be writable for this user and/or group. If not
squidGuard will go into the "pass all for all" emergency
mode.
4.
How do I debug squidGuard?
Do something like this:
echo "http://foo/bar 10.0.0.1/- - GET" | /usr/local/bin/s
quidGuard -c /tmp/test.cfg -d
This redirects the log to stderr. The response is either
a blank line (pass on) or a the input with the URL part
rewritten (redirect).
5.
How can I block audio and video?
Use an [10]expressionlist with something like this:
\.(ra?m|mpe?g?|mov|movie|qt|avi|dif|dvd?|mpv2|mp3)($|\?)
6.
Are there any blacklist exchange plans?
Yes, we plan to add an interface to the new web site to
allow proxyadministrators to indirectly add and remove
URLs from the robot config. Though there are still some
practical issues to solve.
7.
How can I contribute to the blacklists?
If you have lists of links that would map to missing
blacklist entries, or lists of exceptions/errors, please
send them to [11]blacklist@squidguard.org
Note: The link list must consist of fully qualified URLs,
ie. http://... (not the blacklist format).
The exception/error lists must consist of domains and
urls as (potentially) found in the blacklists.
Direct additions to the domain and url lists are not very
usefull, since they are the output from the robot; not
the input. Though if you have a long list that would have
been usefull you may of course reverse engineer it
through:
sed 's@^@http://www.@;s@$@/@' domains urls >links
8.
How can I test timeconstraints
You can set a simulated start time with the
-t yyyy-mm-ddTHH:MM:SS option:
squidGuard -c test.conf -t 1999-12-31T23:59:30 -d <test.in>
test.out 2>test.log
With the -t option squidGuard parses the given date&time
and calculates an offset from the current time at startup
and then adds this offset to all timevalues during
runtime.
9.
squidGuard compiles fine and the tests succeed, but it seems to
pass all when run under Squid
There may be at leaste two reasons for this:
o Some versions of Squid (supposedly 2.2.*) silently
ignores argumets to the right of
redirect_program prefix/bin/squidGuard. Solutions are
one of:
# Set the actual config file location at
[12]compiletime with --with-sg-config
# Use a shell wraper with
redirect_program prefix/bin/squidGuard.sh and make
prefix/bin/squidGuard.sh an executable shell like:
#! /bin/sh -
exec prefix/bin/squidGuard -c whatever/
squidGuard.conf
o When run under Squid, squidGuard is run with the same
user and group ID as Squid (cache_effective_user and
cache_effective_group in squid.conf). The squidGuard
configuration and database files must be readable for
this user and/or group and the squidGuard log directory
must be writable for this user and/or group. If not
squidGuard will go into the "pass all for all" emergency
mode.
10.
compilation of sg.l on fails with "sg.l:line ...: Error: Too many
positions" with native lex
Some native versions of lex have problems with sg.l. The
solution is to use [13]GNU flex wich is better anyway. Do
"setenv LEX flex" if configure selects the native lex
before flex. Flex should compile right out of the box
similar to other GNU programs. (Thanks to
laurent.foulonneau@mail.loyalty.nc).
11.
Can I use proxy authenticated user the same way as RFC931/Ident
user?
Yes, if you patch Squid < 2.3 with this simple [14]diff,
kindly contributed by [15]Antony T Curtis, the
authenticated user will be passed from Squid to
squidGuard. This patch has apparently already been
incorporated in squid-2.3:
A useful patch to Squid 2.2STABLE which fixes per-user redirection wher
e
the user is authenticated using proxy-auth...
*** src/redirect.c.orig Tue Jun 22 14:04:43 1999
--- src/redirect.c Tue Jun 22 15:46:41 1999
***************
*** 103,108 ****
--- 103,110 ----
cbdataAdd(r, cbdataXfree, 0);
r->orig_url = xstrdup(http->uri);
r->client_addr = conn->log_addr;
+ if (http->request->user_ident[0])
+ r->client_ident = http->request->user_ident; else
if (conn->ident == NULL || *conn->ident == '\0') {
r->client_ident = dash_str;
} else {
12.
Can I manipulate domains.db and urls.db from Perl?
Yes, but you must bind custom comparefunctions. Also note
the domains are stored with a leading ".":
use DB_File;
sub mirror($) {
scalar(reverse(shift));
}
sub domainmatch($$) {
my $search = mirror(lc(shift));
my $found = mirror(lc(shift));
if ("$search." eq $found) {
return(0);
} else {
return(substr($search,0,length($found)) cmp $found);
}
}
sub urlmatch($$) {
my $search = lc(shift) . "/";
my $found = lc(shift) . "/";
if ($search eq $found) {
return(0);
} else {
return(substr($search,0,length($found)) cmp $found);
}
}
my (%url,%domain);
$DB_BTREE->{compare} = \&urlmatch;
my $url_db = tie(%url, "DB_File", "urls.db", O_CREAT|O_RDWR, 0664, $DB_
BTREE)
|| die("urls.db: $!\n");
$DB_BTREE->{compare} = \&domainmatch;
my $domain_db = tie(%domain, "DB_File", "domains.db", O_CREAT|O_RDWR, 0
664, $DB_BTREE)
|| die("domains.db: $!\n");
# Now you can operate on %url and %domain just as normal perl hashes:)
# Add "playboy.com" to the domainlist unless it's already there:
$domain{".playboy.com"} = "" unless(exists($domain{"playboy.com"}));
# or use the DB_File functions put, get, del and seq:
# Add "sex.com" and "dir.yahoo.com/business_and_economy/companies/sex"
# and delete "cnn.com":
$domain_db->put(".sex.com","") unless(exists($domain{"sex.com"}));
$domain_db->sync; # Seems to only sync the last change.
$domain_db->del("cnn.com") if(exists($domain{"cnn.com"}));
$domain_db->sync; # Seems to only sync the last change.
$url_db->put("xyz.com/~sex","") unless(exists($url{"xyz.com/~sex"}));
$url_db->sync; # Seems to only sync the last change.
$url_db->sync; # Seems to only sync the last change.
$domain_db->sync; # Seems to only sync the last change.
undef($url_db); # Destroy the object
undef($domain_db); # Destroy the object
untie(%url); # Sync and close the file and undef the hash
untie(%domain); # Sync and close the file and undef the hash
See the perltie(1) and DB_File(3) man pages that comes
with Perl for more info.
13.
How can I list domains.db or urls.db from Perl?
Use a script like this:
#!/local/bin/perl -w
use strict;
use DB_File;
foreach (@ARGV) {
my (%db, $key, $val);
die("$_: $!\n") unless(-f);
tie(%db, "DB_File", $_, O_RDONLY, 0664, $DB_BTREE) || die("$_: $!\n")
;
foreach $key (keys(%db)) {
if($val = $db{$key}) {
$val = "\"$val\"";
} else {
$val = "undef";
}
print "$key -> $val\n";
}
untie(%db);
}
See the perltie(1) and DB_File(3) man pages that comes
with Perl for more info.
14.
How can I get around "make: don't know how to make /bin/false.
Stop"?
Your system does not have lynx and not /bin/false either:
If it has /usr/bin/false do:
# ln -s ../usr/bin/false /bin/.
Alternatively:
# echo exit 255 >/bin/false
# chmod a+rx /bin/false
If you have questions and/or answers that should be on the FAQ list
please send them to [16]squidguard@squidguard.org
____________________________
[17][gnu-logo.gif] [18][perl-logo.gif] [19][solaris-logo.gif]
[20][sun-logo.gif] [21][eltele-logo.gif]
[22][apache-logo.gif] [23][squid-logo.gif] [24][squidGuard.gif]
[25][identd.gif]
References
1. http://ftp.ost.eltele.no/pub/www/proxy/squidGuard/
2. http://www.squidguard.org/
3. http://www.squid-cache.org/
4. http://www.squidguard.org/authors/
5. http://www.squidguard.org/authors/
6. http://www.squidguard.org/copyright/
7. http://www.ost.eltele.no/
8. http://www.squidguard.org/contact/
9. http://ftp.ost.eltele.no/pub/db/
10. http://www.squidguard.org/config/#Expressionlists
11. mailto:blacklist@squidguard.org
12. http://www.squidguard.org/install/#Defaultconfigfile
13. http://www.squidguard.org/links/#Flex
14. http://ftp.ost.eltele.no/pub/www/proxy/squidGuard/contrib/squid-2.2-authuser.patch
15. mailto:antony@abacus.co.uk
16. mailto:squidguard@squidguard.org?subject=SquidGuard%20FAQ?
17. http://www.gnu.org/
18. http://www.perl.com/pub/
19. http://www.sun.com/solaris/
20. http://www.sun.com/servers/
21. http://www.ost.eltele.no/
22. http://www.apache.org/httpd.html
23. http://www.squid-cache.org/
24. http://www.squidguard.org/
25. http://info.ost.eltele.no/freeware/identd/
|
