I don’t have that location, could it be in a different location.
[root@AMANOSRV03 squid]# /var/log/squid/
m.traeumner
August 1, 2017, 10:00am
22
try
cd /
The G of Guard has to be upper case.
m.traeumner
August 1, 2017, 10:34am
24
Sorry, it is at your config:
/var/log/ufdbguard
2017-08-01 13:42:46 [2099] BLOCK acs-t16$ 192.168.2.116 default in-addr http://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GETsettings-win.data.microsoft.com:443 CONNECTsecurepubads.g.doubleclick.net:443 CONNECTsettings-win.data.microsoft.com:443 CONNECThttp://edge.quantserve.com/quant.js GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://secure-us.imrworldwide.com/cgi-bin/m … GEThttp://wms.assoc-amazon.com/20070822/US/js/auto-tagger.js … GETaus5.mozilla.org:443 CONNECTsettings-win.data.microsoft.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GETconnect.facebook.net:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://cdn.optimizely.com/js/574841135.js GETregistrar-rr.prod.registrar.skype.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://native.sharethrough.com/assets/sfp.js GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://script.crazyegg.com/pages/scripts/0013/8759.js GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://cdn-gl.imrworldwide.com/novms/js/2/nlsDcrLite510.min.js GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://b.scorecardresearch.com/beacon.js GETz.moatads.com:443 CONNECThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GETconnect.facebook.net:443 CONNECThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GETwww.google-analytics.com:443 CONNECT
m.traeumner
August 1, 2017, 11:58am
26
Didn’t you see something about your groups at the log? I don’t have groups, but I get info about categories at the log file for example.
2017-07-30 03:46:28 [15373] loading URL table from “/var/squidGuard/blacklists/aggressive/domains”
Not directly related to your problem, but you may reduce logging by unselecting Block access to web sites using ip address in the filter profile (it’s the topmost option).
I don’t see any of that unfortunately
Thanks Filipo,
"http://192.168.2.202/cgi-bin/nethserver-block.cgi?clientaddr=%a&clientname=%n&clientident=%i&srcclass=%s&targetgroup=%t&url=%u "
2017-08-01 15:27:34 [7980] BLOCK prudencem 192.168.2.115 default adv ir2.beap.gemini.yahoo.com:443 CONNECThttp://play.pokemonshowdown.com/audio/xy-rival.mp3 GETna.ads.yahoo.com:443 CONNECTna.ads.yahoo.com:443 CONNECTna.ads.yahoo.com:443 CONNECThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://play.pokemonshowdown.com/audio/cries/muk.mp3 GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://play.pokemonshowdown.com/audio/cries/ninjask.mp3 GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GETir2.beap.gemini.yahoo.com:443 CONNECTna.ads.yahoo.com:443 CONNECTna.ads.yahoo.com:443 CONNECTna.ads.yahoo.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETid.google.com:443 CONNECThttp://play.pokemonshowdown.com/audio/cries/mewtwo.mp3 GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://play.pokemonshowdown.com/audio/cries/mewtwo-megax.mp3 GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GETsettings-win.data.microsoft.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETsettings-win.data.microsoft.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECThttp://play.pokemonshowdown.com/audio/cries/rattata.mp3 GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GETsettings-win.data.microsoft.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://play.pokemonshowdown.com/audio/cries/arcanine.mp3 GEThttp://192.168.2.202/cgi-bin/nethserver-block.cgi … GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETp2.keywee.co:443 CONNECThttp://play.pokemonshowdown.com/audio/cries/primarina.mp3 GEThttp://192.168.2.202/cgi-bin/nethserver- http://yourdictionaryltk.disqus.com/embed.js GETassets.pinterest.com:443 CONNECTwww.google-analytics.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECTplatform.twitter.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECTwww.facebook.com:443 CONNECThttp://b.scorecardresearch.com/b … GETwww.facebook.com:443 CONNECTwww.facebook.com:443 CONNECTwww.facebook.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GEThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETsettings-win.data.microsoft.com:443 CONNECTb.config.skype.com:443 CONNECTapps.skype.com:443 CONNECTapi.mcr.skype.com:443 CONNECTregistrar-rr.prod.registrar.skype.com:443 CONNECTa.config.skype.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETsettings-win.data.microsoft.com:443 CONNECTb.config.skype.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETregistrar-rr.prod.registrar.skype.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETapi.mcr.skype.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECTsettings-win.data.microsoft.com:443 CONNECTwww.google-analytics.com:443 CONNECThttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab … GETregistrar-rr.prod.registrar.skype.com:443 CONNECT
The bottom threads with user Prudence and Cecilia are part of Finance and Teacher Groups and yet it’s retrieving the info from the default filter group instead of staff…
m.traeumner
August 2, 2017, 7:37am
33
What is about your squid.log? Do you see the usernames in it?
Can you post your squid.conf too please.
I see usernames ok… and all my users just access the default profile…
[root@AMANOSRV03 ~]# cd /
# ================= DO NOT MODIFY THIS FILE =================
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at https://dev.nethesis.it/projects/nethserver/wiki/NethServer
# original work from http://www.contribs.org/development/
#
# Copyright (C) 2013 Nethesis S.r.l.
# http://www.nethesis.it - support@nethesis.it
#
# Uncomment this to enable debug
#debug_options ALL,1 33,2 28,9
# Sites not cached
acl no_cache dstdomain "/etc/squid/acls/no_cache.acl"
no_cache deny no_cache
# Allow access from green and trusted networks.
acl localnet src 192.168.2.0/24
acl localnet_dst src 192.168.2.0/24
# Allow access from blue: ens34
acl blue src 192.168.8.0/24
# Safe ports
acl SSL_ports port 443
acl SSL_ports port 980 # httpd-admin (server-manager)
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 980 # httpd-admin (server-manager)
acl CONNECT method CONNECT
#
# 20acl_00_portscustom
#
acl Safe_ports port 2083
acl SSL_ports port 2083
acl Safe_ports port 2096
acl SSL_ports port 2096
acl Safe_ports port 8443
acl SSL_ports port 8443
acl Safe_ports port 5000
acl SSL_ports port 5000
# Authentication required
# GSSAPI auth in ADS mode
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -i
auth_param negotiate children 10
auth_param negotiate keep_alive on
# BASIC PAM auth (fallback)
auth_param basic program /usr/lib64/squid/basic_pam_auth
auth_param basic children 5
auth_param basic realm amanocs.local
auth_param basic credentialsttl 1 hours
auth_param basic casesensitive on
acl authenticated proxy_auth REQUIRED
# Allow access from localhost
http_access allow localhost
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
#
# Skip URL rewriter for local addresses
#
acl self dst 192.168.2.202
acl self dst 192.168.8.202
acl self_port port 80
acl self_port port 443
url_rewrite_access deny self localnet blue self_port
# Block access to green from other networks
http_access deny self blue localnet_dst
# Authentication required on green and trusted networks
http_access allow localnet authenticated
# Authentication required on blue
http_access allow blue authenticated
# And finally deny all other access to this proxy
http_access deny all
cache_mem 256 MB
# Enable disk cache
minimum_object_size 0 KB
maximum_object_size 4096 KB
cache_dir aufs /var/spool/squid 2048 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
refresh_pattern ([^.]+.|)(download|(windows|)update|).(microsoft.|)com/.*\.(cab|exe|msi|msp) 4320 100% 43200 reload-into-ims
# Always enable manual proxy
http_port 3128
acl https_proto proto https
always_direct allow https_proto
ssl_bump none localhost
sslproxy_options NO_SSLv2,NO_SSLv3,No_Compression
sslproxy_cipher ALL:!SSLv2:!ADH:!DSS:!MD5:!EXP:!DES:!PSK:!SRP:!RC4:!IDEA:!SEED:!aNULL:!eNULL
# TLS/SSL bumping definitions
acl tls_s1_connect at_step SslBump1
acl tls_s2_client_hello at_step SslBump2
acl tls_s3_server_hello at_step SslBump3
# TLS/SSL bumping steps
ssl_bump peek tls_s1_connect all
ssl_bump splice all
# peek at TLS/SSL connect data
# splice: no active bumping
#
# 45marks
#
# Enable squidGuard
url_rewrite_program /usr/sbin/ufdbgclient -l /var/log/squid
url_rewrite_children 20 startup=5 idle=5 concurrency=0
url_rewrite_extras "%>a/%>A %un %>rm bump_mode=%ssl::bump_mode sni=\"%ssl::>sni\" referer=\"%{Referer}>h\""
#
# 90options
#
forward_max_tries 25
shutdown_lifetime 1 seconds
buffered_logs on
max_filedesc 16384
logfile_rotate 0
#
# 90squidclamav
#
ecap_enable on
# Bypass scan mime-types
acl bypass_scan_types_req req_mime_type -i ^text/
acl bypass_scan_types_req req_mime_type -i ^application/x-javascript
acl bypass_scan_types_req req_mime_type -i ^application/x-shockwave-flash
acl bypass_scan_types_req req_mime_type -i ^image/
acl bypass_scan_types_req req_mime_type -i ^video
acl bypass_scan_types_req req_mime_type -i ^audio
acl bypass_scan_types_req req_mime_type -i ^application/x-mms-framed.*$
acl bypass_scan_types_rep rep_mime_type -i ^text/
acl bypass_scan_types_rep rep_mime_type -i ^application/x-javascript
acl bypass_scan_types_rep rep_mime_type -i ^application/x-shockwave-flash
acl bypass_scan_types_rep rep_mime_type -i ^image/
acl bypass_scan_types_rep rep_mime_type -i ^video
acl bypass_scan_types_rep rep_mime_type -i ^audio
acl bypass_scan_types_rep rep_mime_type -i ^application/x-mms-framed.*$
loadable_modules /usr/lib64/ecap_clamav_adapter.so
ecap_service clamav_service_req reqmod_precache uri=ecap://e-cap.org/ecap/services/clamav?mode=REQMOD bypass=off message_size_max=5000000
ecap_service clamav_service_resp respmod_precache uri=ecap://e-cap.org/ecap/services/clamav?mode=RESPMOD bypass=on message_size_max=5000000
adaptation_access clamav_service_req allow !bypass_scan_types_req all
adaptation_access clamav_service_resp allow !bypass_scan_types_rep all
m.traeumner
August 2, 2017, 8:40am
35
Please have a look at your ufdbguard.conf. The “all” at the pass acl is missing by some groups. Is it a copy paste error too?
PS: For posting a conf I use
[code]
[/code]
in square brackets.
[root@AMANOSRV03 ~]# cd /ufdbguard.co
# ================= DO NOT MODIFY THIS FILE =================
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at https://dev.nethesis.it/projects/nethserver/wiki/NethServer
# original work from http://www.contribs.org/development/
#
# Copyright (C) 2013 Nethesis S.r.l.
# http://www.nethesis.it - support@nethesis.it
#
# ufdbGuard.conf - default configuration file for use with URLfilterDB
# #
# # The Reference Manual has detailed information about the configuration
# # of ufdbGuard. It is highly recommended to read it before using ufdbGuard.
# #
# # Make sure that you edit the 4 lines that are marked with
# # 'EDIT THE NEXT LINE...' to adapt this file to your environment.
#
logdir "/var/log/ufdbguard"
dbhome "/var/squidGuard/blacklists"
squid-version "3.5"
analyse-uncategorised-urls off
upload-crash-reports off
# slow replies when reloading db to decrease the number of passed urls
url-lookup-delay-during-database-reload on
logblock on
# Always strip domain from squid username
strip-domain-from-username on
redirect-https "blocked.nethserver.org:443"
category "gamble" {
domainlist /var/squidGuard/blacklists/gamble/domains
}
category "chemistry" {
domainlist /var/squidGuard/blacklists/science/chemistry/domains
}
category "files" {
expressionlist /var/squidGuard/blacklists/custom/files/expressions
}
category "pets" {
domainlist /var/squidGuard/blacklists/hobby/pets/domains
}
category "bikes" {
domainlist /var/squidGuard/blacklists/automobile/bikes/domains
}
category "aggressive" {
domainlist /var/squidGuard/blacklists/aggressive/domains
}
category "radiotv" {
domainlist /var/squidGuard/blacklists/radiotv/domains
}
category "violence" {
domainlist /var/squidGuard/blacklists/violence/domains
}
category "cars" {
domainlist /var/squidGuard/blacklists/automobile/cars/domains
}
category "travel" {
domainlist /var/squidGuard/blacklists/recreation/travel/domains
}
category "martialarts" {
domainlist /var/squidGuard/blacklists/recreation/martialarts/domains
}
category "webradio" {
domainlist /var/squidGuard/blacklists/webradio/domains
}
category "wellness" {
domainlist /var/squidGuard/blacklists/recreation/wellness/domains
}
category "movies" {
domainlist /var/squidGuard/blacklists/movies/domains
}
category "politics" {
domainlist /var/squidGuard/blacklists/politics/domains
}
category "military" {
domainlist /var/squidGuard/blacklists/military/domains
}
category "ringtones" {
domainlist /var/squidGuard/blacklists/ringtones/domains
}
category "dynamic" {
domainlist /var/squidGuard/blacklists/dynamic/domains
}
category "astronomy" {
domainlist /var/squidGuard/blacklists/science/astronomy/domains
}
category "redirector" {
domainlist /var/squidGuard/blacklists/redirector/domains
}
category "dating" {
domainlist /var/squidGuard/blacklists/dating/domains
}
category "alcohol" {
domainlist /var/squidGuard/blacklists/alcohol/domains
}
category "gardening" {
domainlist /var/squidGuard/blacklists/hobby/gardening/domains
}
category "trading" {
domainlist /var/squidGuard/blacklists/finance/trading/domains
}
category "hacking" {
domainlist /var/squidGuard/blacklists/hacking/domains
}
category "adv" {
domainlist /var/squidGuard/blacklists/adv/domains
}
category "updatesites" {
domainlist /var/squidGuard/blacklists/updatesites/domains
}
category "tracker" {
domainlist /var/squidGuard/blacklists/tracker/domains
}
category "humor" {
domainlist /var/squidGuard/blacklists/recreation/humor/domains
}
category "shopping" {
domainlist /var/squidGuard/blacklists/shopping/domains
}
category "costtraps" {
domainlist /var/squidGuard/blacklists/costtraps/domains
}
category "forum" {
domainlist /var/squidGuard/blacklists/forum/domains
}
category "weapons" {
domainlist /var/squidGuard/blacklists/weapons/domains
}
category "sports" {
domainlist /var/squidGuard/blacklists/recreation/sports/domains
}
category "education" {
domainlist /var/squidGuard/blacklists/sex/education/domains
}
category "webmail" {
domainlist /var/squidGuard/blacklists/webmail/domains
}
category "moneylending" {
domainlist /var/squidGuard/blacklists/finance/moneylending/domains
}
category "cooking" {
domainlist /var/squidGuard/blacklists/hobby/cooking/domains
}
category "hospitals" {
domainlist /var/squidGuard/blacklists/hospitals/domains
}
category "searchengines" {
domainlist /var/squidGuard/blacklists/searchengines/domains
}
category "schools" {
domainlist /var/squidGuard/blacklists/education/schools/domains
}
category "downloads-1" {
domainlist /var/squidGuard/blacklists/custom/downloads-1/domains
}
category "audio-video" {
domainlist /var/squidGuard/blacklists/custom/audio-video/domains
}
category "remotecontrol" {
domainlist /var/squidGuard/blacklists/remotecontrol/domains
}
category "realestate" {
domainlist /var/squidGuard/blacklists/finance/realestate/domains
}
category "spyware" {
domainlist /var/squidGuard/blacklists/spyware/domains
}
category "drugs" {
domainlist /var/squidGuard/blacklists/drugs/domains
}
category "music" {
domainlist /var/squidGuard/blacklists/music/domains
}
category "government" {
domainlist /var/squidGuard/blacklists/government/domains
}
category "downloads" {
domainlist /var/squidGuard/blacklists/downloads/domains
}
category "models" {
domainlist /var/squidGuard/blacklists/models/domains
}
category "urlshortener" {
domainlist /var/squidGuard/blacklists/urlshortener/domains
}
category "builtin" {
domainlist /var/squidGuard/blacklists/custom/builtin/domains
expressionlist /var/squidGuard/blacklists/custom/builtin/expressions
}
category "imagehosting" {
domainlist /var/squidGuard/blacklists/imagehosting/domains
}
category "webphone" {
domainlist /var/squidGuard/blacklists/webphone/domains
}
category "insurance" {
domainlist /var/squidGuard/blacklists/finance/insurance/domains
}
category "socialnetworks" {
domainlist /var/squidGuard/blacklists/custom/socialnetworks/domains
}
category "planes" {
domainlist /var/squidGuard/blacklists/automobile/planes/domains
}
category "games-online" {
domainlist /var/squidGuard/blacklists/hobby/games-online/domains
}
category "warez" {
domainlist /var/squidGuard/blacklists/warez/domains
}
category "other" {
domainlist /var/squidGuard/blacklists/finance/other/domains
}
category "nh_blacklist" {
domainlist /var/squidGuard/blacklists/custom/blacklist/domains
}
category "lingerie" {
domainlist /var/squidGuard/blacklists/sex/lingerie/domains
}
category "homestyle" {
domainlist /var/squidGuard/blacklists/homestyle/domains
}
category "games-misc" {
domainlist /var/squidGuard/blacklists/hobby/games-misc/domains
}
category "podcasts" {
domainlist /var/squidGuard/blacklists/podcasts/domains
}
category "library" {
domainlist /var/squidGuard/blacklists/library/domains
}
category "jobsearch" {
domainlist /var/squidGuard/blacklists/jobsearch/domains
}
category "anonvpn" {
domainlist /var/squidGuard/blacklists/anonvpn/domains
}
category "socialnet" {
domainlist /var/squidGuard/blacklists/socialnet/domains
}
category "porn" {
domainlist /var/squidGuard/blacklists/porn/domains
}
category "webtv" {
domainlist /var/squidGuard/blacklists/webtv/domains
}
category "religion" {
domainlist /var/squidGuard/blacklists/religion/domains
}
category "fortunetelling" {
domainlist /var/squidGuard/blacklists/fortunetelling/domains
}
category "chat" {
domainlist /var/squidGuard/blacklists/chat/domains
}
category "restaurants" {
domainlist /var/squidGuard/blacklists/recreation/restaurants/domains
}
category "nh_whitelist" {
domainlist /var/squidGuard/blacklists/custom/whitelist/domains
}
category "banking" {
domainlist /var/squidGuard/blacklists/finance/banking/domains
}
category "boats" {
domainlist /var/squidGuard/blacklists/automobile/boats/domains
}
category "news" {
domainlist /var/squidGuard/blacklists/news/domains
}
category "isp" {
domainlist /var/squidGuard/blacklists/isp/domains
}
category "security" {
cacerts "/var/ufdbguard/blacklists/security/cacerts"
option enforce-https-with-hostname off
option enforce-https-official-certificate off
option allow-skype-over-https on
option allow-gtalk-over-https on
option allow-yahoomsg-over-https on
option allow-aim-over-https on
option allow-fb-chat-over-https on
option allow-citrixonline-over-https on
option allow-anydesk-over-https on
option allow-teamviewer-over-https on
option allow-unknown-protocol-over-https on
option https-prohibit-insecure-sslv2 off
option https-prohibit-insecure-sslv3 off
}
src src_all_students {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members all student"
}
src src_dorm {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members dorm"
}
src src_finance {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members finance"
}
src src_heads {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members heads"
}
src src_itprofile {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members it"
}
src src_management {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members management"
}
src src_newitgroup {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members it"
}
src src_office {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members office management"
}
src src_primary_teacher {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members primary teacher"
}
src src_secondary_teacher {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members secondary teacher"
}
src src_teacher_admin {
execuserlist "/usr/libexec/nethserver/ufdbguard-list-group-members teacher administration"
}
time weekdays_students {
weekly mtwhf 08:00-20:30
}
acl {
# Profile: all_students
src_all_students within weekdays_students {
pass !security !nh_blacklist !files !builtin !"adv" !"aggressive" !"alcohol" !"anonvpn" !"audio-video" !"cars" !"chat" !"costtraps" !"dating" !"downloads" !"downloads-1" !"fortunetelling" !"gamble" !"games-misc" !"games-online" !"hacking" !"lingerie" !"models" !"movies" !"music" !"pets" !"porn" !"remotecontrol" !"ringtones" !"socialnet" !"socialnetworks" !"tracker" !"updatesites" !"violence" !"warez" !"webphone" !"webradio" !"webtv" all
}
# Profile: dorm
src_dorm {
pass !security !nh_blacklist !files !builtin !"adv" !"audio-video" !"chat" !"costtraps" !"dating" !"downloads" !"downloads-1" !"gamble" !"games-misc" !"games-online" !"hacking" !"lingerie" !"movies" !"music" !"porn" !"ringtones" !"socialnet" !"socialnetworks" !"spyware" !"tracker" !"violence" !"warez" !"webphone" !"webradio" !"webtv" all
}
# Profile: finance
src_finance {
pass !security !nh_blacklist !files !builtin !"adv" !"audio-video" !"chat" !"costtraps" !"dating" !"downloads" !"downloads-1" !"gamble" !"games-misc" !"games-online" !"hacking" !"lingerie" !"movies" !"music" !"porn" !"ringtones" !"socialnet" !"socialnetworks" !"spyware" !"tracker" !"violence" !"warez" !"webphone" !"webradio" !"webtv" all
}
# Profile: heads
src_heads {
pass !security nh_whitelist !nh_blacklist !builtin !"downloads-1" !"hacking" all
}
# Profile: itprofile
src_itprofile {
pass !security nh_whitelist !builtin all
}
# Profile: management
src_management {
pass !security nh_whitelist !nh_blacklist !builtin !"downloads-1" !"hacking" all
}
# Profile: newitgroup
src_newitgroup {
pass !security nh_whitelist !builtin all
}
# Profile: office
src_office {
pass !security !nh_blacklist !files !builtin !"adv" !"audio-video" !"chat" !"costtraps" !"dating" !"downloads" !"downloads-1" !"gamble" !"games-misc" !"games-online" !"hacking" !"lingerie" !"movies" !"music" !"porn" !"ringtones" !"socialnet" !"socialnetworks" !"spyware" !"tracker" !"violence" !"warez" !"webphone" !"webradio" !"webtv" all
}
# Profile: primary_teacher
src_primary_teacher {
pass !security !nh_blacklist !files !builtin !"adv" !"audio-video" !"chat" !"costtraps" !"dating" !"downloads" !"downloads-1" !"gamble" !"games-misc" !"games-online" !"hacking" !"lingerie" !"movies" !"music" !"porn" !"ringtones" !"socialnet" !"socialnetworks" !"spyware" !"tracker" !"violence" !"warez" !"webphone" !"webradio" !"webtv" all
}
# Profile: secondary_teacher
src_secondary_teacher {
pass !security !nh_blacklist !files !builtin !"adv" !"audio-video" !"chat" !"costtraps" !"dating" !"downloads" !"downloads-1" !"gamble" !"games-misc" !"games-online" !"hacking" !"lingerie" !"movies" !"music" !"porn" !"ringtones" !"socialnet" !"socialnetworks" !"spyware" !"tracker" !"violence" !"warez" !"webphone" !"webradio" !"webtv" all
}
# Profile: teacher_admin
src_teacher_admin {
pass !security nh_whitelist !nh_blacklist !builtin !"downloads-1" !"hacking" all
}
default {
pass !security !nh_blacklist !files !builtin !"adv" !"aggressive" !"alcohol" !"anonvpn" !"audio-video" !"cars" !"chat" !"costtraps" !"dating" !"downloads" !"downloads-1" !"fortunetelling" !"gamble" !"games-misc" !"games-online" !"hacking" !"lingerie" !"models" !"movies" !"music" !"pets" !"porn" !"remotecontrol" !"ringtones" !"socialnet" !"socialnetworks" !"tracker" !"updatesites" !"violence" !"warez" !"webphone" !"webradio" !"webtv" all
redirect http://192.168.2.202/cgi-bin/nethserver-block.cgi?clientaddr=%a&clientname=%n&clientident=%i&srcclass=%s&targetgroup=%t&url=%u
}
}
I have a temporary fix for the issue. The not very pleased with it. Have a feeling problem is originating from the windows AD. What i have done is created a new OU called Proxy and then created a group called proxies under the Proxy OU. Thrown all my teachers in that group. When i check the Users list under
m.traeumner
August 2, 2017, 12:23pm
38
I think you should have an “else” here like the following example from http://www.squidguard.org/Doc/sourceacl.html
minor within nonworkhours {
pass !porn !spyware !tracker !banking !webtv !webradio !banking all
} else {
pass !porn !spyware !tracker !banking !webtv !webradio !shopping !banking !games allWere all groups of users listed in the same OU. I ask because I have had problems with multiple branches, I only could connect to one.
Well i have a top level OU called School then under that there is Education/Student/Grades…,etc
m.traeumner
August 8, 2017, 12:44pm
40
Sorry for late response,
I think it’s not wrong to have the firewall installed. For example, I’ve added some firewallobjects to bypass the proxy for some sites.
Could you try to create all OU’s you need this way and have a look if it works for all users in there.