[K12OSN] Enabling Dansguardian on Beta 5

[Eric Harrison]

On Sun, 7 May 2006 dackerman at apnts.org wrote:

> In addition to my earlier question about bandwidth, I have been searching the
> internet for hours with no clear answers about the following.  How can I enable
> Dansguardian and Squidguard on 5.0 beta 5?

One of my goals for K12LTSP 5.0 was to integrate DansGuardian into K12LTSP
to the same degree that squidGuard is. It is mostly done, I'll see if I can
finish it off this morning. I'll post a short HOWTO when it is done (but
don't hold your breath that it will be done today ;-)

> Squidguard works by default but
> Dansguardian fails to start.  I have read something about ports and iptables,
> but several different things.  Can anyone just layout the commands simple and
> clear?  I need it so any computer using the internet through the k12 server
> will be filtered (not just thin clients).  As far as I read, it takes ip
> forwarding (so I don't have to configure browsers or have people bypass proxy).

Here is the K12LTSP wiki page on transparent proxying:

http://www.k12ltsp.org/phpwiki/index.php/WebFiltering%3AIntegration

> I found notes on the following:
> 1.  httpd.conf Listen 8080

This is definately wrong, no modifications to Apache (httpd) are needed.
You can not have two services listening on the same port, this is probably
why DansGuardian will not start.

> 2.  dansguardian.conf  filterport=8080
> 3.  squid.conf Listen 3128

These are defaults.

> 4.  iptables -t nat -A PREROUTING -i eth0 -p tcp --d port 3128 -j REDIRECT
> --to-port 8080

This is the command that I will add to the K12LTSP DansGuardian package:

    /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

Be sure to read the web filtering integration page for all of the gotchas
and limitations of transparent proxies:

http://www.k12ltsp.org/phpwiki/index.php/WebFiltering%3AIntegration

> I am not sure if this is all I need to do or if the above are the right
> commands.  Help . . .
> Is it really necessary to run both filters, or is Squidguard good enough for
> most schools?

The current stable version of DansGuardian is only missing one feature from
K12LTSP: the ability to force on "safe mode" for Google searches. This will
change in the near future, the development version of DansGuardian adds this
feature.

The SquidGuard vs DansGuardian wiki page is a bit aged, but still mostly
accurate:

http://www.k12ltsp.org/phpwiki/index.php/WebFiltering%3ASquidGuardVsDansGuardian

-Eric