
   [1][squidGuard.gif] The squidGuard FAQ [faq.gif]
   [2]squidGuard is an ultrafast and free filter, redirector and access
   controller for [3]Squid
   By [4]Pl Baltzersen and [5]Lars Erik Hland
   [6]Copyright  1999-2000, [7]ElTele st AS
   This page was last modified 2000-03-17
   
[arrow-red.gif] FAQ - Frequently Asked/Answered Questions

   Currently in semirandom order:
    1.
       
        Is there a mailing list for squidGuard? 
                [8]Yes!.
                
    2.
       
        I have db3.x.x installed and squidGuard won't compile? 
                Only [9]db2.x.x versions are supported. We are working on
                db3.x.x support, but the API has changed so it may take a
                while to fix.
                
    3.
       
        squidGuard does not block? 
                There my be at least 2 reasons for this:
                
              1. You didn't end your pass rules with "none". Pass rules
                 ends with an implicit "all". It is good practice to
                 allways en the pass rules with either "all" or "none" to
                 make them clear. Ie. use:
                 pass good none
                 or
                 pass good !bad all
              2. squidGuard goes into emergency mode. Reasons may be
                 syntax errors in the config file, reference to non
                 existing database files, filprotection problems or
                 missing directories. Check the squidGuard log.
                 Note:When run under Squid, squidGuard is run with the
                 same user and group ID as Squid (cache_effective_user
                 and cache_effective_group in squid.conf). The squidGuard
                 configuration and database files must be readable for
                 this user and/or group and the squidGuard log directory
                 must be writable for this user and/or group. If not
                 squidGuard will go into the "pass all for all" emergency
                 mode.
                 
    4.
       
        How can I block audio and video? 
                Use an [10]expressionlist with something like this:
                \.(ra?m|mpe?g?|mov|movie|qt|avi|dif|dvd?|mpv2|mp3)($|\?)
                
    5.
       
        Are there any blacklist exchange plans? 
                Yes, we plan to add an interface to the new web site to
                allow proxyadministrators to indirectly add and remove
                URLs from the robot config. Though there are still some
                practical issues to solve.
                
    6.
       
        How can I test timeconstraints 
                You can set a simulated start time with the
                -t yyyy-mm-ddTHH:MM:SS option:
                
              squidGuard -c test.conf -t 1999-12-31T23:59:30 -d <test.in>
                      test.out 2>test.log 
                      
                With the -t option squidGuard parses the given date&time
                and calculates an offset from the current time at startup
                and then adds this offset to all timevalues during
                runtime.
                
    7.
       
        squidGuard compiles fine and the tests succeed, but it seems to
                pass all when run under Squid 
                There may be at leaste two reasons for this:
                
               o Some versions of Squid (supposedly 2.2.*) silently
                 ignores argumets to the right of
                 redirect_program prefix/bin/squidGuard. Solutions are
                 one of:
                    # Set the actual config file location at
                      [11]compiletime with --with-sg-config
                    # Use a shell wraper with
                      redirect_program prefix/bin/squidGuard.sh and make
                      prefix/bin/squidGuard.sh an executable shell like:
                      
                          #! /bin/sh -
                                  exec prefix/bin/squidGuard -c whatever/
                                  squidGuard.conf 
                                  
               o When run under Squid, squidGuard is run with the same
                 user and group ID as Squid (cache_effective_user and
                 cache_effective_group in squid.conf). The squidGuard
                 configuration and database files must be readable for
                 this user and/or group and the squidGuard log directory
                 must be writable for this user and/or group. If not
                 squidGuard will go into the "pass all for all" emergency
                 mode.
                 
    8.
       
        compilation of sg.l on fails with "sg.l:line ...: Error: Too many
                positions" with native lex 
                Some native versions of lex have problems with sg.l. The
                solution is to use [12]GNU flex wich is better anyway. Do
                "setenv LEX flex" if configure selects the native lex
                before flex. Flex should compile right out of the box
                similar to other GNU programs. (Thanks to
                laurent.foulonneau@mail.loyalty.nc).
                
    9.
       
        Can I use proxy authenticated user the same way as RFC931/Ident
                user? 
                If you patch Squid with this simple [13]diff, kindly
                contributed by [14]Antony T Curtis, the authenticated
                user will be passed from Squid to squidGuard and the
                answer will be yes, otherwise no:
                
        A useful patch to Squid 2.2STABLE which fixes per-user redirection wher
e
        the user is authenticated using proxy-auth...

        *** src/redirect.c.orig Tue Jun 22 14:04:43 1999
        --- src/redirect.c      Tue Jun 22 15:46:41 1999
        ***************
        *** 103,108 ****
        --- 103,110 ----
              cbdataAdd(r, cbdataXfree, 0);
              r->orig_url = xstrdup(http->uri);
              r->client_addr = conn->log_addr;
        +     if (http->request->user_ident[0])
        +       r->client_ident = http->request->user_ident; else
              if (conn->ident == NULL || *conn->ident == '\0') {
                r->client_ident = dash_str;
              } else {

   10.
       
        Can I manipulate domains.db and urls.db from Perl? 
                Yes, but you must bind custom comparefunctions. Also note
                the domains are stored with a leading ".":
                
        use DB_File;

        sub mirror($) {
          scalar(reverse(shift));
        }

        sub domainmatch($$) {
          my $search = mirror(lc(shift));
          my $found = mirror(lc(shift));
          if ($search . "." eq $found) {
            return(0);
          } else {
            return(substr($search,0,length($found)) cmp $found);
          }
        }

        sub urlmatch($$) {
          my $search = lc(shift) . "/";
          my $found = lc(shift) . "/";
          if ($search eq $found) {
            return(0);
          } else {
            $search = substr($search,0,length($found));
            return($search cmp $found);
          }
        }

        my (%url,%domain);

        $DB_BTREE->{compare} = \&urlmatch;
        my $url_db = tie(%url, "DB_File", "urls.db", O_CREAT|O_RDWR, 0664, $DB_
BTREE)
        || die("urls.db: $!\n");

        $DB_BTREE->{compare} = \&domainmatch;
        my $domain_db = tie(%domain, "DB_File", "domains.db", O_CREAT|O_RDWR, 0
664, $DB_BTREE)
        || die("domains.db: $!\n");

        # Now you can operate on %url and %domain just as normal perl hashes:)
        $domain{".playboy.com"} = "" unless(exists($domain{"playboy.com"}));

        $url_db->sync;
        $domain_db->sync;

                See the perltie(1) and DB_File(3) man pages that comes
                with Perl for more info.
                
   11.
       
        How can I list domains.db or urls.db from Perl? 
                Use a script like this:
                
        #!/local/bin/perl -w
        use strict;
        use DB_File;

        foreach (@ARGV) {
          my (%db, $key, $val);
          die("$_: $!\n") unless(-f);
          tie(%db, "DB_File", $_, O_RDONLY, 0664, $DB_BTREE) || die("$_: $!\n")
;
          foreach $key (keys(%db)) {
            if($val = $db{$key}) {
              $val = "\"$val\"";
            } else {
              $val = "undef";
            }
            print "$key -> $val\n";
          }
          untie(%db);
        }

                See the perltie(1) and DB_File(3) man pages that comes
                with Perl for more info.
                
   If you have questions and/or answers that should be on the FAQ list
   please send them to [15]squidguard@squidguard.org
                        ____________________________
   
       [16][gnu-logo.gif] [17][perl-logo.gif] [18][solaris-logo.gif]
                 [19][sun-logo.gif] [20][eltele-logo.gif] 
                                      
      [21][apache-logo.gif] [22][squid-logo.gif] [23][squidGuard.gif] 
                                      
                             [24][identd.gif] 

References

   1. http://ftp.ost.eltele.no/pub/www/proxy/squidGuard/
   2. http://www.squidguard.org/
   3. http://www.squid-cache.org/
   4. http://www.squidguard.org/authors/
   5. http://www.squidguard.org/authors/
   6. http://www.squidguard.org/copyright/
   7. http://www.ost.eltele.no/
   8. http://www.squidguard.org/contact/
   9. http://ftp.ost.eltele.no/pub/db/
  10. http://www.squidguard.org/config/#Expressionlists
  11. http://www.squidguard.org/install/#Defaultconfigfile
  12. http://www.squidguard.org/links/#Flex
  13. http://ftp.ost.eltele.no/pub/www/proxy/squidGuard/contrib/squid-2.2-authuser.patch
  14. mailto:antony@abacus.co.uk
  15. mailto:squidguard@squidguard.org?subject=SquidGuard%20FAQ?
  16. http://www.gnu.org/
  17. http://www.perl.com/pub/
  18. http://www.sun.com/solaris/
  19. http://www.sun.com/servers/
  20. http://www.ost.eltele.no/
  21. http://www.apache.org/httpd.html
  22. http://www.squid-cache.org/
  23. http://www.squidguard.org/
  24. http://info.ost.eltele.no/freeware/identd/
