Nachdem wir nun im ersten Schritt die Erstinstallation und Grundkonfiguration von unserem Web-Content-Filter Dansguardian erfolgreich abgeschlossen haben, machen wir uns nun in diesem Kapitel daran, die Installation unseren Bedürfnissen hin antzupassen und zu optimieren.

Nach der erfolgten Inbetriebnahme drehen wir dem Dansguardian etwas die Luft ab, was heissen will, wir lassen uns nur noch die geblockten Seiten reporten, da das Logfile ggf. etwas arg überschwemmt wird mit Informationen, die uns eh' nicht interessieren.

 # vim /etc/dansguardian/dansguardian.conf

# Logging Settings
#
# 0 = none  1 = just denied  2 = all text based  3 = all requests
# Django 2011-11-15 Anpassen des Log-Levels
# default : loglevel = 2
loglevel = 1

Damit in den Logfiles die User angezeigt werden können, aktivieren wir noch die Option Auth plugins in der Konfigurationsdatei /etc/dansguardian/dansguardian.conf.

 # vim /etc/dansguardian/dansguardian.conf

# Auth plugins
# These replace the usernameidmethod* options in previous versions. They
# handle the extraction of client usernames from various sources, such as
# Proxy-Authorisation headers and ident servers, enabling requests to be
# handled according to the settings of the user's filter group.
# Multiple plugins can be specified, and will be queried in order until one
# of them either finds a username or throws an error. For example, if Squid
# is configured with both NTLM and Basic auth enabled, and both the 'proxy-basic'
# and 'proxy-ntlm' auth plugins are enabled here, then clients which do not support
# NTLM can fall back to Basic without sacrificing access rights.
#
# If you do not use multiple filter groups, you need not specify this option.
#
authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'

An der aktiverten proxy-basic.conf ist weiter nichts zu ändern.

/etc/dansguardian/authplugins/proxy-basic.conf

# Proxy-Basic auth plugin
# Identifies usernames in "Proxy-Authorization: Basic" headers;
# relies upon the upstream proxy (squid) to perform the actual password check.
 
plugname = 'proxy-basic'

Ein anschließender Restart aktiviert unsere Änderungen.

 # service dansguardian restart

Somit werden nunmehr die Usernamen im Logfile mit ausgegeben und wir können später nach Bedarf, nach einzelnen Usern greppen.

 2011.11.15 13:18:52 django 10.0.0.20 http://www.playboy.com *DENIED* Gewichtete Ausdrucksbeschränkung von 100 : 168 ((-article, social)+(free tour, girls)+(free tour, sex)+(member,  galler)+ girl + nude+amateur+babes+breast+busty+-commerce+free tour+hottest+-interview+join now+-librar+-main+naked+nude girl+playboy+playmate+posing nude+-semester +sexy+-social+-test +-transparent) GET 33414 168 Pornography 1 403 text/html   -

Die Hauptkonfigurationsdatei /etc/dansguardian/dansguardian.conf hat somit folgenden Zwischenstand:

/etc/dansguardian/dansguardian.conf

# DansGuardian config file for version 2.10.1.1
 
# **NOTE** as of version 2.7.5 most of the list files are now in dansguardianf1.conf
 
 
# Web Access Denied Reporting (does not affect logging)
#
# -1 = log, but do not block - Stealth mode
#  0 = just say 'Access Denied'
#  1 = report why but not what denied phrase
#  2 = report fully
#  3 = use HTML template file (accessdeniedaddress ignored) - recommended
#
reportinglevel = 3
 
# Language dir where languages are stored for internationalisation.
# The HTML template within this dir is only used when reportinglevel
# is set to 3. When used, DansGuardian will display the HTML file instead of
# using the perl cgi script.  This option is faster, cleaner
# and easier to customise the access denied page.
# The language file is used no matter what setting however.
#
languagedir = '/usr/share/dansguardian/languages'
 
# language to use from languagedir.
# Django 2011-11-15
# Default: language = 'ukenglish'
language = 'german'
 
# Logging Settings
#
# 0 = none  1 = just denied  2 = all text based  3 = all requests
# Django 2011-11-15 Anpassen des Log-Levels
# default : loglevel = 2
loglevel = 1
 
# Log Exception Hits
# Log if an exception (user, ip, URL, phrase) is matched and so
# the page gets let through.  Can be useful for diagnosing
# why a site gets through the filter.
# 0 = never log exceptions
# 1 = log exceptions, but do not explicitly mark them as such
# 2 = always log & mark exceptions (default)
logexceptionhits = 2
 
# Log File Format
# 1 = DansGuardian format (space delimited)
# 2 = CSV-style format
# 3 = Squid Log File Format
# 4 = Tab delimited
logfileformat = 1
 
# truncate large items in log lines
#maxlogitemlength = 400
 
# anonymize logs (blank out usernames & IPs)
#anonymizelogs = on
 
 
# Syslog logging
#
# Use syslog for access logging instead of logging to the file
# at the defined or built-in "loglocation"
#syslog = on
 
# Log file location
# 
# Defines the log directory and filename.
#loglocation = '/var/log/dansguardian/access.log'
 
 
# Statistics log file location
#
# Defines the stat file directory and filename.
# Only used in conjunction with maxips > 0
# Once every 3 minutes, the current number of IPs in the cache, and the most
# that have been in the cache since the daemon was started, are written to this
# file. IPs persist in the cache for 7 days.
#statlocation = '/var/log/dansguardian/stats'
 
 
# Network Settings
# 
# the IP that DansGuardian listens on.  If left blank DansGuardian will
# listen on all IPs.  That would include all NICs, loopback, modem, etc.
# Normally you would have your firewall protecting this, but if you want
# you can limit it to a certain IP. To bind to multiple interfaces,
# specify each IP on an individual filterip line.
filterip =
 
# the port that DansGuardian listens to.
filterport = 8080
 
# the ip of the proxy (default is the loopback - i.e. this server)
proxyip = 127.0.0.1
 
# the port DansGuardian connects to proxy on
proxyport = 3128
 
# Whether to retrieve the original destination IP in transparent proxy
# setups and check it against the domain pulled from the HTTP headers.
#
# Be aware that when visiting sites which use a certain type of round-robin
# DNS for load balancing, DG may mark requests as invalid unless DG gets
# exactly the same answers to its DNS requests as clients.  The chances of
# this happening can be increased if all clients and servers on the same LAN
# make use of a local, caching DNS server instead of using upstream DNS
# directly.
#
# See http://www.kb.cert.org/vuls/id/435052
# on (default) | off
#!! Not compiled !! originalip = on
 
# accessdeniedaddress is the address of your web server to which the cgi
# dansguardian reporting script was copied. Only used in reporting levels 1 and 2.
#
# This webserver must be either:
#  1. Non-proxied. Either a machine on the local network, or listed as an exception
#     in your browser's proxy configuration.
#  2. Added to the exceptionsitelist. Option 1 is preferable; this option is
#     only for users using both transparent proxying and a non-local server
#     to host this script.
#
# Individual filter groups can override this setting in their own configuration.
#
# Django 2011-11-15
# default : accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl'
# accessdeniedaddress = 'http://nausch.org/cgi-bin/dansguardian.pl'
 
 
# Non standard delimiter (only used with accessdeniedaddress)
# To help preserve the full banned URL, including parameters, the variables
# passed into the access denied CGI are separated using non-standard
# delimiters. This can be useful to ensure correct operation of the filter
# bypass modes. Parameters are split using "::" in place of "&", and "==" in
# place of "=".
# Default is enabled, but to go back to the standard mode, disable it.
nonstandarddelimiter = on
 
 
 
# Banned image replacement
# Images that are banned due to domain/url/etc reasons including those
# in the adverts blacklists can be replaced by an image.  This will,
# for example, hide images from advert sites and remove broken image
# icons from banned domains.
# on (default) | off
usecustombannedimage = on
custombannedimagefile = '/usr/share/dansguardian/transparent1x1.gif'
 
 
 
# Filter groups options
# filtergroups sets the number of filter groups. A filter group is a set of content
# filtering options you can apply to a group of users.  The value must be 1 or more.
# DansGuardian will automatically look for dansguardianfN.conf where N is the filter
# group.  To assign users to groups use the filtergroupslist option.  All users default
# to filter group 1.  You must have some sort of authentication to be able to map users
# to a group.  The more filter groups the more copies of the lists will be in RAM so
# use as few as possible.
filtergroups = 1
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'
 
 
 
# Authentication files location
bannediplist = '/etc/dansguardian/lists/bannediplist'
exceptioniplist = '/etc/dansguardian/lists/exceptioniplist'
 
 
 
# Show weighted phrases found
# If enabled then the phrases found that made up the total which excedes
# the naughtyness limit will be logged and, if the reporting level is
# high enough, reported. on | off
showweightedfound = on
 
# Weighted phrase mode
# There are 3 possible modes of operation:
# 0 = off = do not use the weighted phrase feature.
# 1 = on, normal = normal weighted phrase operation.
# 2 = on, singular = each weighted phrase found only counts once on a page.
#
weightedphrasemode = 2
 
 
 
# Positive (clean) result caching for URLs
# Caches good pages so they don't need to be scanned again.
# It also works with AV plugins.
# 0 = off (recommended for ISPs with users with disimilar browsing)
# 1000 = recommended for most users
# 5000 = suggested max upper limit
# If you're using an AV plugin then use at least 5000.
urlcachenumber = 1000
#
# Age before they are stale and should be ignored in seconds
# 0 = never
# 900 = recommended = 15 mins
urlcacheage = 900
 
 
 
# Clean cache for content (AV) scan results
# By default, to save CPU, files scanned and found to be
# clean are inserted into the clean cache and NOT scanned
# again for a while.  If you don't like this then choose
# to disable it.
# (on|off) default = on.
scancleancache = on
 
 
 
# Smart, Raw and Meta/Title phrase content filtering options
# Smart is where the multiple spaces and HTML are removed before phrase filtering
# Raw is where the raw HTML including meta tags are phrase filtered
# Meta/Title is where only meta and title tags are phrase filtered (v. quick)
# CPU usage can be effectively halved by using setting 0 or 1 compared to 2
# 0 = raw only
# 1 = smart only
# 2 = both of the above (default)
# 3 = meta/title
phrasefiltermode = 2
 
# Lower casing options
# When a document is scanned the uppercase letters are converted to lower case
# in order to compare them with the phrases.  However this can break Big5 and
# other 16-bit texts.  If needed preserve the case.  As of version 2.7.0 accented
# characters are supported.
# 0 = force lower case (default)
# 1 = do not change case
# 2 = scan first in lower case, then in original case
preservecase = 0
 
# Note:
# If phrasefiltermode and preserve case are both 2, this equates to 4 phrase
# filtering passes. If you have a large enough userbase for this to be a
# worry, and need to filter pages in exotic character encodings, it may be
# better to run two instances on separate servers: one with preservecase 1
# (and possibly forcequicksearch 1) and non ASCII/UTF-8 phrase lists, and one
# with preservecase 0 and ASCII/UTF-8 lists.
 
 
 
# Hex decoding options
# When a document is scanned it can optionally convert %XX to chars.
# If you find documents are getting past the phrase filtering due to encoding
# then enable.  However this can break Big5 and other 16-bit texts.
# off = disabled (default)
# on = enabled
hexdecodecontent = off
 
 
 
# Force Quick Search rather than DFA search algorithm
# The current DFA implementation is not totally 16-bit character compatible
# but is used by default as it handles large phrase lists much faster.
# If you wish to use a large number of 16-bit character phrases then
# enable this option.
# off (default) | on (Big5 compatible)
forcequicksearch = off
 
 
 
# Reverse lookups for banned site and URLs.
# If set to on, DansGuardian will look up the forward DNS for an IP URL
# address and search for both in the banned site and URL lists.  This would
# prevent a user from simply entering the IP for a banned address.
# It will reduce searching speed somewhat so unless you have a local caching
# DNS server, leave it off and use the Blanket IP Block option in the
# bannedsitelist file instead.
reverseaddresslookups = off
 
 
 
# Reverse lookups for banned and exception IP lists.
# If set to on, DansGuardian will look up the forward DNS for the IP
# of the connecting computer.  This means you can put in hostnames in
# the exceptioniplist and bannediplist.
# If a client computer is matched against an IP given in the lists, then the
# IP will be recorded in any log entries; if forward DNS is successful and a
# match occurs against a hostname, the hostname will be logged instead.
# It will reduce searching speed somewhat so unless you have a local DNS server, 
# leave it off.
reverseclientiplookups = off
 
 
# Perform reverse lookups on client IPs for successful requests.
# If set to on, DansGuardian will look up the forward DNS for the IP
# of the connecting computer, and log host names (where available) rather than
# IPs against requests.
# This is not dependent on reverseclientiplookups being enabled; however, if it
# is, enabling this option does not incur any additional forward DNS requests.
logclienthostnames = off
 
 
# Build bannedsitelist and bannedurllist cache files.
# This will compare the date stamp of the list file with the date stamp of
# the cache file and will recreate as needed.
# If a bsl or bul .processed file exists, then that will be used instead.
# It will increase process start speed by 300%.  On slow computers this will
# be significant.  Fast computers do not need this option. on | off
createlistcachefiles = on
 
 
 
# POST protection (web upload and forms)
# does not block forms without any file upload, i.e. this is just for
# blocking or limiting uploads
# measured in kibibytes after MIME encoding and header bumph
# use 0 for a complete block
# use higher (e.g. 512 = 512Kbytes) for limiting
# use -1 for no blocking
#maxuploadsize = 512
#maxuploadsize = 0
maxuploadsize = -1
 
 
 
# Max content filter size
# Sometimes web servers label binary files as text which can be very
# large which causes a huge drain on memory and cpu resources.
# To counter this, you can limit the size of the document to be
# filtered and get it to just pass it straight through.
# This setting also applies to content regular expression modification.
# The value must not be higher than maxcontentramcachescansize
# The size is in Kibibytes - eg 2048 = 2Mb
# use 0 to set it to maxcontentramcachescansize
maxcontentfiltersize = 256
 
 
 
# Max content ram cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size of file that DG will download and cache
# in RAM.  After this limit is reached it will cache to disk
# This value must be less than or equal to maxcontentfilecachescansize.
# The size is in Kibibytes - eg 10240 = 10Mb
# use 0 to set it to maxcontentfilecachescansize
# This option may be ignored by the configured download manager.
maxcontentramcachescansize = 2000
 
 
 
# Max content file cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size file that DG will download
# so that it can be scanned or virus checked.
# This value must be greater or equal to maxcontentramcachescansize.
# The size is in Kibibytes - eg 10240 = 10Mb
maxcontentfilecachescansize = 20000
 
 
 
# File cache dir
# Where DG will download files to be scanned if too large for the
# RAM cache.
filecachedir = '/tmp'
 
 
 
# Delete file cache after user completes download
# When a file gets save to temp it stays there until it is deleted.
# You can choose to have the file deleted when the user makes a sucessful
# download.  This will mean if they click on the link to download from
# the temp store a second time it will give a 404 error.
# You should configure something to delete old files in temp to stop it filling up.
# on|off (defaults to on)
deletedownloadedtempfiles = on
 
 
 
# Initial Trickle delay
# This is the number of seconds a browser connection is left waiting
# before first being sent *something* to keep it alive.  The
# *something* depends on the download manager chosen.
# Do not choose a value too low or normal web pages will be affected.
# A value between 20 and 110 would be sensible
# This may be ignored by the configured download manager.
initialtrickledelay = 20
 
 
 
# Trickle delay
# This is the number of seconds a browser connection is left waiting
# before being sent more *something* to keep it alive.  The
# *something* depends on the download manager chosen.
# This may be ignored by the configured download manager.
trickledelay = 10
 
 
 
# Download Managers
# These handle downloads of files to be filtered and scanned.
# They differ in the method they deal with large downloads.
# Files usually need to be downloaded 100% before they can be
# filtered and scanned before being sent on to the browser.
# Normally the browser can just wait, but with content scanning,
# for example to AV, the browser may timeout or the user may get
# confused so the download manager has to do some sort of
# 'keep alive'.
#
# There are various methods possible but not all are included.
# The author does not have the time to write them all so I have
# included a plugin systam.  Also, not all methods work with all
# browsers and clients.  Specifically some fancy methods don't
# work with software that downloads updates.  To solve this,
# each plugin can support a regular expression for matching
# the client's user-agent string, and lists of the mime types
# and extensions it should manage.
#
# Note that these are the matching methods provided by the base plugin
# code, and individual plugins may override or add to them.
# See the individual plugin conf files for supported options.
#
# The plugins are matched in the order you specify and the last
# one is forced to match as the default, regardless of user agent
# and other matching mechanisms.
#
downloadmanager = '/etc/dansguardian/downloadmanagers/fancy.conf'
#downloadmanager = '/etc/dansguardian/downloadmanagers/trickle.conf'
downloadmanager = '/etc/dansguardian/downloadmanagers/default.conf'
 
 
 
# Content Scanners (Also known as AV scanners)
# These are plugins that scan the content of all files your browser fetches
# for example to AV scan.  The options are limitless.  Eventually all of
# DansGuardian will be plugin based.  You can have more than one content
# scanner. The plugins are run in the order you specify.
# This is one of the few places you can have multiple options of the same name.
#
# Some of the scanner(s) require 3rd party software and libraries eg clamav.
# See the individual plugin conf file for more options (if any).
#
#!! Not compiled !! contentscanner = '/etc/dansguardian/contentscanners/clamav.conf'
#contentscanner = '/etc/dansguardian/contentscanners/clamdscan.conf'
#!! Unimplemented !! contentscanner = '/etc/dansguardian/contentscanners/kavav.conf'
#contentscanner = '/etc/dansguardian/contentscanners/kavdscan.conf'
#contentscanner = '/etc/dansguardian/contentscanners/icapscan.conf'
#contentscanner = '/etc/dansguardian/contentscanners/commandlinescan.conf'
 
 
 
# Content scanner timeout
# Some of the content scanners support using a timeout value to stop
# processing (eg AV scanning) the file if it takes too long.
# If supported this will be used.
# The default of 60 seconds is probably reasonable.
contentscannertimeout = 60
 
 
 
# Content scan exceptions
# If 'on' exception sites, urls, users etc will be scanned
# This is probably not desirable behavour as exceptions are
# supposed to be trusted and will increase load.
# Correct use of grey lists are a better idea.
# (on|off) default = off
contentscanexceptions = off
 
 
 
# Auth plugins
# These replace the usernameidmethod* options in previous versions. They
# handle the extraction of client usernames from various sources, such as
# Proxy-Authorisation headers and ident servers, enabling requests to be
# handled according to the settings of the user's filter group.
# Multiple plugins can be specified, and will be queried in order until one
# of them either finds a username or throws an error. For example, if Squid
# is configured with both NTLM and Basic auth enabled, and both the 'proxy-basic'
# and 'proxy-ntlm' auth plugins are enabled here, then clients which do not support
# NTLM can fall back to Basic without sacrificing access rights.
#
# If you do not use multiple filter groups, you need not specify this option.
#
#authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'
#authplugin = '/etc/dansguardian/authplugins/proxy-digest.conf'
#authplugin = '/etc/dansguardian/authplugins/proxy-ntlm.conf'
#authplugin = '/etc/dansguardian/authplugins/ident.conf'
#authplugin = '/etc/dansguardian/authplugins/ip.conf'
# Django 2011-11-15 Username im Logfile mit ausgeben
# default : NULL
authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'
 
# Re-check replaced URLs
# As a matter of course, URLs undergo regular expression search/replace (urlregexplist)
# *after* checking the exception site/URL/regexpURL lists, but *before* checking against
# the banned site/URL lists, allowing certain requests that would be matched against the
# latter in their original state to effectively be converted into grey requests.
# With this option enabled, the exception site/URL/regexpURL lists are also re-checked
# after replacement, making it possible for URL replacement to trigger exceptions based
# on them.
# Defaults to off.
recheckreplacedurls = off
 
 
 
# Misc settings
 
# if on it adds an X-Forwarded-For: <clientip> to the HTTP request
# header.  This may help solve some problem sites that need to know the
# source ip. on | off
forwardedfor = off
 
 
# if on it uses the X-Forwarded-For: <clientip> to determine the client
# IP. This is for when you have squid between the clients and DansGuardian.
# Warning - headers are easily spoofed. on | off
usexforwardedfor = off
 
 
# if on it logs some debug info regarding fork()ing and accept()ing which
# can usually be ignored.  These are logged by syslog.  It is safe to leave
# it on or off
logconnectionhandlingerrors = on
 
 
 
# Fork pool options
 
# If on, this causes DG to write to the log file whenever child processes are
# created or destroyed (other than by crashes). This information can help in
# understanding and tuning the following parameters, but is not generally
# useful in production.
logchildprocesshandling = off
 
# sets the maximum number of processes to spawn to handle the incoming
# connections.  Max value usually 250 depending on OS.
# On large sites you might want to try 180.
maxchildren = 120
 
 
# sets the minimum number of processes to spawn to handle the incoming connections.
# On large sites you might want to try 32.
minchildren = 8
 
 
# sets the minimum number of processes to be kept ready to handle connections.
# On large sites you might want to try 8.
minsparechildren = 4
 
 
# sets the minimum number of processes to spawn when it runs out
# On large sites you might want to try 10.
preforkchildren = 6
 
 
# sets the maximum number of processes to have doing nothing.
# When this many are spare it will cull some of them.
# On large sites you might want to try 64.
maxsparechildren = 32
 
 
# sets the maximum age of a child process before it croaks it.
# This is the number of connections they handle before exiting.
# On large sites you might want to try 10000.
maxagechildren = 500
 
 
# Sets the maximum number client IP addresses allowed to connect at once.
# Use this to set a hard limit on the number of users allowed to concurrently
# browse the web. Set to 0 for no limit, and to disable the IP cache process.
maxips = 0
 
 
 
# Process options
# (Change these only if you really know what you are doing).
# These options allow you to run multiple instances of DansGuardian on a single machine.
# Remember to edit the log file path above also if that is your intention.
 
# IPC filename
# 
# Defines IPC server directory and filename used to communicate with the log process.
ipcfilename = '/tmp/.dguardianipc'
 
# URL list IPC filename
# 
# Defines URL list IPC server directory and filename used to communicate with the URL
# cache process.
urlipcfilename = '/tmp/.dguardianurlipc'
 
# IP list IPC filename
#
# Defines IP list IPC server directory and filename, for communicating with the client
# IP cache process.
ipipcfilename = '/tmp/.dguardianipipc'
 
# PID filename
# 
# Defines process id directory and filename.
#pidfilename = '/var/run/dansguardian.pid'
 
# Disable daemoning
# If enabled the process will not fork into the background.
# It is not usually advantageous to do this.
# on|off (defaults to off)
nodaemon = off
 
# Disable logging process
# on|off (defaults to off)
nologger = off
 
# Enable logging of "ADs" category blocks
# on|off (defaults to off)
logadblocks = off
 
# Enable logging of client User-Agent
# Some browsers will cause a *lot* of extra information on each line!
# on|off (defaults to off)
loguseragent = off
 
# Daemon runas user and group
# This is the user that DansGuardian runs as.  Normally the user/group nobody.
# Uncomment to use.  Defaults to the user set at compile time.
# Temp files created during virus scanning are given owner and group read
# permissions; to use content scanners based on external processes, such as
# clamdscan, the two processes must run with either the same group or user ID.
#daemonuser = 'dansguardian'
#daemongroup = 'dansguardian'
 
# Soft restart
# When on this disables the forced killing off all processes in the process group.
# This is not to be confused with the -g run time option - they are not related.
# on|off (defaults to off)
softrestart = off
 
# Mail program
# Path (sendmail-compatible) email program, with options.
# Not used if usesmtp is disabled (filtergroup specific).
mailer = '/usr/sbin/sendmail -t'

Von Haus aus, ist der „ausgelieferte“ Dansguardian doch recht aggressiv eingestellt; d.h. viele doch erwünschten Seiten werden geblockt. Zum Erlauben dieser Seiten bearbeiten wir die Konfigurationsdatei /etc/dansguardian/lists/exceptionsitelist für die Ausnahmeseiten.

 # vim /etc/dansguardian/lists/exceptionsitelist

/etc/dansguardian/lists/exceptionsitelist

#Sites in exception list
#Don't bother with the www. or
#the http://
#
#These are specifically domains and are not URLs.
#For example 'foo.bar/porn/' is no good, you need
#to just have 'foo.bar'.
#
#You can also match IPs here too.
#
#As of DansGuardian 2.7.3 you can now include
#.tld so for example you can match .gov for example
 
 
# Time limiting syntax:
# #time: <start hour> <start minute> <end hour> <end minute> <days>
# Example:
##time: 9 0 17 0 01234
# Remove the first # from the line above to enable this list only from
# 9am to 5pm, Monday to Friday.
 
 
# Blanket exception.  To allow all sites except those in the
# exceptionsitelist and greysitelist files, remove
# the # from the next line to leave only a '**':
#**
 
# Blanket SSL/CONNECT exception.  To allow all SSL 
# and CONNECT tunnels except to addresses in the
# exceptionsitelist and greysitelist files, remove
# the # from the next line to leave only a '**s':
#**s
 
# Blanket IP exception.  To allow all sites specified only as an IP,
# remove the # from the next line to leave only a '*ip':
#*ip
 
# Blanket SSL/CONNECT IP exception.  To allow all SSL and CONNECT
# tunnels to sites specified only as an IP,
# remove the # from the next line to leave only a '*ips':
#*ips
 
 
windowsupdate.microsoft.com
# Django 2011-11-15
# Nutzerindividuelle Seiten
nausch.org
urlblacklist.com
ebay.de
bay.com

Genauso kann man natürlich auch unerwünschte Seiten komplett sperren. Hierzu bearbeiten wir die Konfigurationsdatei /etc/dansguardian/lists/bannedsitelist für diese Seiten.

 # vim /etc/dansguardian/lists/bannedsitelist

/etc/dansguardian/lists/bannedsitelist

#domains in banned list
#Don't bother with the www. or the http://
 
#The bannedurllist is for blocking PART of a site
#The bannedsitelist is for blocking ALL of a site
 
#As of DansGuardian 2.7.3 you can now include
#.tld so for example you can match .gov for example
 
#The 'grey' lists override the 'banned' lists.
#The 'exception' lists override the 'banned' lists also.
#The difference is that the 'exception' lists completely switch
#off *all* other filtering for the match.  'grey' lists only
#stop the URL filtering and allow the normal filtering to work.
 
#An example of grey list use is when in Blanket Block (whitelist)
#mode and you want to allow some sites but still filter as normal
#on their content
 
#Another example of grey list use is when you ban a site but want
#to allow part of it.
 
#To include additional files in this list use this example:
#.Include</etc/dansguardian/anotherbannedurllist>
 
#You can have multiple .Includes.
 
# Time limiting syntax:
# #time: <start hour> <start minute> <end hour> <end minute> <days>
# Example:
##time: 9 0 17 0 01234
# Remove the first # from the line above to enable this list only from
# 9am to 5pm, Monday to Friday.
 
# List categorisation
#listcategory: "Banned Sites"
 
#List other sites to block:
 
badboys.com
 
# Django 2011-11-15
# Nutzerindividuelle gesperrte Seiten blocklists
 
microsoft.com
cdu.de
csu.de
spd.de
ftp.de
 
#Blanket Block.  To block all sites except those in the
#exceptionsitelist and greysitelist files, remove
#the # from the next line to leave only a '**':
#**
 
#Blanket SSL/CONNECT Block.  To block all SSL 
#and CONNECT tunnels except to addresses in the
#exceptionsitelist and greysitelist files, remove
#the # from the next line to leave only a '**s':
#**s
 
#Blanket IP Block.  To block all sites specified only as an IP,
#remove the # from the next line to leave only a '*ip':
#*ip
 
#Blanket SSL/CONNECT IP Block.  To block all SSL and CONNECT
#tunnels to sites specified only as an IP,
#remove the # from the next line to leave only a '*ips':
#*ips
 
 
# The squidGuard advert domain/URL lists are now included by default.
# To work with advanced ad blocking & the logadblocks option, advert
# phrase/site/URL lists should have the string "ADs" in their listcategory.
.Include</etc/dansguardian/lists/blacklists/ads/domains>
 
#Remove the # from the following and edit as needed to use a stock
#squidGuard/urlblacklists collection.
#.Include</etc/dansguardian/lists/blacklists/adult/domains>
#.Include</etc/dansguardian/lists/blacklists/aggressive/domains>
#.Include</etc/dansguardian/lists/blacklists/artnudes/domains>
#.Include</etc/dansguardian/lists/blacklists/audio-video/domains>
#.Include</etc/dansguardian/lists/blacklists/beerliquorinfo/domains>
#.Include</etc/dansguardian/lists/blacklists/beerliquorsale/domains>
#.Include</etc/dansguardian/lists/blacklists/chat/domains>
#.Include</etc/dansguardian/lists/blacklists/childcare/domains>
#.Include</etc/dansguardian/lists/blacklists/clothing/domains>
#.Include</etc/dansguardian/lists/blacklists/culinary/domains>
#.Include</etc/dansguardian/lists/blacklists/dialers/domains>
#.Include</etc/dansguardian/lists/blacklists/drugs/domains>
#.Include</etc/dansguardian/lists/blacklists/entertainment/domains>
#.Include</etc/dansguardian/lists/blacklists/forums/domains>
#.Include</etc/dansguardian/lists/blacklists/frencheducation/domains>
#.Include</etc/dansguardian/lists/blacklists/gambling/domains>
#.Include</etc/dansguardian/lists/blacklists/government/domains>
#.Include</etc/dansguardian/lists/blacklists/hacking/domains>
#.Include</etc/dansguardian/lists/blacklists/homerepair/domains>
#.Include</etc/dansguardian/lists/blacklists/hygiene/domains>
#.Include</etc/dansguardian/lists/blacklists/jewelry/domains>
#.Include</etc/dansguardian/lists/blacklists/jobsearch/domains>
#.Include</etc/dansguardian/lists/blacklists/kidstimewasting/domains>
#.Include</etc/dansguardian/lists/blacklists/mail/domains>
#.Include</etc/dansguardian/lists/blacklists/news/domains>
#.Include</etc/dansguardian/lists/blacklists/onlineauctions/domains>
#.Include</etc/dansguardian/lists/blacklists/onlinegames/domains>
#.Include</etc/dansguardian/lists/blacklists/onlinepayment/domains>
#.Include</etc/dansguardian/lists/blacklists/personalfinance/domains>
#.Include</etc/dansguardian/lists/blacklists/pets/domains>
#.Include</etc/dansguardian/lists/blacklists/porn/domains>
#.Include</etc/dansguardian/lists/blacklists/proxy/domains>
#.Include</etc/dansguardian/lists/blacklists/publicite/domains>
#.Include</etc/dansguardian/lists/blacklists/redirector/domains>
#.Include</etc/dansguardian/lists/blacklists/ringtones/domains>
#.Include</etc/dansguardian/lists/blacklists/sportnews/domains>
#.Include</etc/dansguardian/lists/blacklists/sports/domains>
#.Include</etc/dansguardian/lists/blacklists/vacation/domains>
#.Include</etc/dansguardian/lists/blacklists/violence/domains>
#.Include</etc/dansguardian/lists/blacklists/virusinfected/domains>
#.Include</etc/dansguardian/lists/blacklists/warez/domains>
 
# You will need to edit to add and remove categories you want

Möchte man einen Host im Netz gänzlich von der Bewertung ausnehmen, so z.B. für die Geschäftsleitung und/oder Betriebs-/Personalrat, trägt man diese IP-Adressen dieser Hosts in die Konfigurationsdatei /etc/dansguardian/lists/exceptioniplist ein.

 # vim /etc/dansguardian/lists/exceptioniplist

/etc/dansguardian/lists/exceptioniplist

# IP addresses of computers from which
# web access should not be filtered.
#
# These would be servers which
# need unfiltered access for
# updates.  Also administrator
# workstations which need to
# download programs and check
# out blocked sites should be
# put here.
#
# Hostnames are allowed here, provided you
# enable the reverseclientlookups option.
#
# This is not the IP of web servers
# you don't want to filter.
 
#192.168.0.1
#192.168.0.2
#192.168.42.2
 
# Ranges and subnets can also be used,
# e.g.
# 10.0.0.1-10.0.0.3
# 10.0.0.0/24
#
# Hostnames can also be used, provided
# you cater for reverse DNS lookups
# on your LAN and enable the
# "reverseclientiplookups" option in
# dansguardian.conf
#
# Django 2011-11-15
# BOfH's Workstation bei der Bewertung ausnehmen
10.10.10.10

Im Gegensatz zur Vorgenannten Ausnahmeregelung kann man natürlich auch einem Host den Zugriff zum Web gänzlich blocken, hierzu trägt man dessen IP-Adresse in die Konfigurationsdatei /etc/dansguardian/lists/bannediplist ein.

 # vim /etc/dansguardian/lists/bannediplist

/etc/dansguardian/lists/bannediplist

# IP addresses of client machines to
# disallow web access to.
#
# Hostnames are also allowed here, provided you
# enable the reverseclientlookups option.
#
# This is not the IP of web servers
# you want to filter.
 
#192.168.0.1
#192.168.0.2
#192.168.42.2
 
# Ranges and subnets can also be used,
# e.g.
# 10.0.0.1-10.0.0.3
# 10.0.0.0/24
#
# Hostnames can also be used, provided
# you cater for reverse DNS lookups
# on your LAN and enable the
# "reverseclientiplookups" option in
# dansguardian.conf
 
# Django 2011-11-15
# Workstation der Ferienwohnung komplett den Web-Zugriff sperren
10.10.10.100

Über die /etc/dansguardian/lists/bannedregexpurllist haben wir die Möglichkeit, einzelne Seiten an Hand ihrer URL, bzw. Teilbreiche einer URL zu sperren. Hierzu Nutzen wir geeignete REGEX um die URLs zu definieren, welche wir (aus)sperren wollen:

 # vim /etc/dansguardian/lists/bannedregexpurllist

/etc/dansguardian/lists/bannedregexpurllist

#Banned URLs based on Regular Expressions
#
# E.g. 'sex' would block sex.com and middlesex.com etc
 
#listcategory: "Banned Regular Expression URLs"
 
#Banned URLs based on Regular Expressions
 
######################################################
#
# Django 2011-11-15
# SOHO-spezifische Anpassungen für nausch.org
#
######################################################
 
# Onlinegaming
(gladiatus|4story|gameforge|ikariam|pog.com|cracymonkeygames|poissonrouge)
 
# Musikmaffia
(musicload|musikload)
 
# videoportale
(vo.llnwd)
 
# Werbemüll
(Standardteaser|sponsorads|google-analytics)
 
# Schnacksl-Anbahnungsportale
(facebook|lokalisten|myspace|friendscout)
 
######################################################
# Pornography, Modelling and Adult Sites
######################################################
 
# The following two lines may work better than the above - Philip Pearce 9/11/2004
(big|cyber|hard|huge|mega|small|soft|super|tiny|bare|naked|nude|anal|oral|topp?les|sex|phone)+.*(anal|babe|bharath|boob|breast|busen|busty|clit|cum|cunt|dick|fetish|fuck|girl|hooter|lez|lust|naked|nude|oral|orgy|penis|porn|porno|pupper|pussy|rotten|sex|shit|smutpump|teen|tit|topp?les|xxx)s?
(anal|babe|bharath|boob|breast|busen|busty|clit|cum|cunt|dick|fetish|fuck|girl|hooter|lez|lust|naked|nude|oral|orgy|penis|porn|porno|pupper|pussy|rotten|sex|shit|smutpump|teen|tit|topp?les|xxx)+.*(big|cyber|hard|huge|mega|small|soft|super|tiny|bare|naked|nude|anal|oral|topp?les|sex)+
 
#HardCore phrases
(adultsight|adultsite|adultsonly|adultweb|blowjob|bondage|centerfold|cumshot|cyberlust|cybercore|hardcore|masturbat)
(bangbros|pussylip|playmate|pornstar|sexdream|showgirl|softcore|striptease)
 
#SoftCore phrases - more likely to overblock - possibly on news sites
#(incest|obscene|pedophil|pedofil)
 
#Photo Modeling - supplied by David Burkholder
#(male|m[ae]n|boy|girl|beaut|agen[ct]|glam)+.*(model|talent)
 
# The following will help to block explicit media files (images and video)
(sex|fuck|boob|cunt|fetish|tits|anal|hooter|asses|shemale|submission|porn|xxx|busty|knockers|slut|nude|naked|pussy)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)
(girls|babes|bikini|model)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)
 
#Block Naturism and Nudist sites
#(naturism|naturist|nude|nudist|nudism|nekkid|nakt|naakt)
 
 
######################################################
# Search Engine and Related
######################################################
 
#Block unfiltered options on various search engines
#(^|[\?+=&/])(.*\.google\..*/.*\?.*safe=off)([\?+=&/]|$)
#(^|[\?+=&/])(.*\.alltheweb.com/customize\?.*copt_offensive=off)([\?+=&/]|$)
 
#Block images and video on altavista, alltheweb, yahoo etc - as they are anonomised
#(yahoo.com\/image\/)
#(yimg.com\/image\/)
#(altavista.com\/image\/)
#(altavista.com\/video\/)
#(picsearch.com\/is)
 
#Block images and video on google
#(images.google)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov) 
#(google.com\/video) #block all video
#(google.com\/ThumbnailServer) #block video thumbnails
#(google.com\/videoplay) #block only playing the video
 
 
######################################################
# Proxy Sites
######################################################
 
#Block Cgiproxy, Poxy, PHProxy and other Web-based proxies
(cecid.php|nph-webpr|nph-pro|/dmirror|cgiproxy|phpwebproxy|__proxy_url|proxy.php)
 
#Block websites containing proxy lists
(anonymizer|proxify|megaproxy)
 
#AGRESSIVE blocking of all URLs containing proxy - WARNING - this WILL overblock!!
#(proxy)
 
 
######################################################
# Gambling - supplied by David Burkholder
######################################################
#(casino|bet(ting|s)|lott(ery|o)|gam(e[rs]|ing|bl(e|ing))|sweepstake|poker)
 
 
######################################################
# Sport - supplied by David Burkholder
######################################################
#(bowling|badminton|box(e[dr]|ing)|skat(e[rs]|ing)|hockey|soccer|nascar|wrest|rugby|tennis|sports|cheerlead|rodeo|cricket|badminton|stadium|derby)
#((paint|volley|bas(e|ket)|foot|quet)ball|/players[/\.]?|(carn|fest)ival)
 
#Racing - supplied by David Burkholder
#(speed(st|wa|y)|corvette|rac[eiy]|wrest|harley|motorcycle|nascar)
 
 
######################################################
# News sites - supplied by David Burkholder
######################################################
#(news(watch|pap|cast)|herald|sentinel|courier|gazet|tribune|chronicle|daily|ning)news)
 
 
######################################################
# Dating Sites - supplied by David Burkholder
######################################################
#(meet|hook|mailord|latin|(asi|mexic|dominic|russi|kore|colombi|balk)an|brazil|filip|french|chinese|ukrain|thai|tour|foreign|date)+.*(dar?[lt]ing|(sing|coup)le|m[ae]n|girl|boy|guy|mat(e|ing)|l[ou]ve?|partner|meet)
#(marr(y|i[ae])|roman(ce|tic)|fiance|bachelo|dating|affair|personals)
 
 
######################################################
# Miscellaneous - Productivity etc.
######################################################
 
#Use this to block web counters:
#(adlog.php|cnt.cgi|count.cgi|count.dat|count.jsp|count.pl|count.php|counter.cgi|counter.js|counter.pl|countlink.cgi|fpcount.exe|logitpro.cgi|rcounter.dll|track.pl|w_counter.js)
#Contributed by proxy@barendse.to
 
#Free stuff - supplied by David Burkholder
#(free|phone|mobile)+.*(love|music|movie|dvd|video|stuff|site|arcade|wallpaper|mp3)
#((ring|real)tone)
 
#Music - supplied by David Burkholder
#(rock|pop|jazz|rap|punk)+.*(cult|roll|geek|drum|music|history|band)
 
# WARNING: This is part of the URL for the dansguardian.org sample virus archive.
# You probably don't want to go there unintentionally.
(Variants/AVTest)

Will man bestimmte MIME-Typen generell nicht zulassen, trägt man diese in die Konfigurationsdatei /etc/dansguardian/lists/bannedmimetypelist ein.

 # vim /etc/dansguardian/lists/bannedmimetypelist

/etc/dansguardian/lists/bannedmimetypelist

# banned MIME types
 
audio/mpeg
audio/x-mpeg
audio/x-pn-realaudio
audio/x-wav
video/mpeg
video/x-mpeg2
video/acorn-replay
video/quicktime
video/x-msvideo
video/msvideo
application/gzip
application/x-gzip
application/zip
application/compress
application/x-compress
application/java-vm

Über die /etc/dansguardian/bannedextensionlist stellen wir dann bei Bedarf noch ein, welche Datei-Extensions wird generell erlauben und welche wir (aus)sperren wollen:

 # vim /etc/dansguardian/lists/bannedextensionlist

/etc/dansguardian/lists/bannedextensionlist

#Banned extension list
 
# File extensions with executable code 
 
# The following file extensions can contain executable code.
# This means they can potentially carry a virus to infect your computer.
 
.ade  # Microsoft Access project extension
.adp  # Microsoft Access project
.asx  # Windows Media Audio / Video
.bas  # Microsoft Visual Basic class module
.bat  # Batch file
.cab  # Windows setup file
.chm  # Compiled HTML Help file
.cmd  # Microsoft Windows NT Command script
.com  # Microsoft MS-DOS program
.cpl  # Control Panel extension
.crt  # Security certificate 
.dll  # Windows system file
.exe  # Program
.hlp  # Help file
.ini  # Windows system file
.hta  # HTML program
.inf  # Setup Information
.ins  # Internet Naming Service
.isp  # Internet Communication settings
# .js   # JScript file - often needed in web pages
# .jse  # Jscript Encoded Script file - often needed in web pages
.lnk  # Windows Shortcut
.mda  # Microsoft Access add-in program 
.mdb  # Microsoft Access program
.mde  # Microsoft Access MDE database
.mdt  # Microsoft Access workgroup information 
.mdw  # Microsoft Access workgroup information 
.mdz  # Microsoft Access wizard program 
.msc  # Microsoft Common Console document
.msi  # Microsoft Windows Installer package
.msp  # Microsoft Windows Installer patch
.mst  # Microsoft Visual Test source files
.pcd  # Photo CD image, Microsoft Visual compiled script
.pif  # Shortcut to MS-DOS program
.prf  # Microsoft Outlook profile settings
.reg  # Windows registry entries
.scf  # Windows Explorer command
.scr  # Screen saver
.sct  # Windows Script Component
.sh   # Shell script
.shs  # Shell Scrap object
.shb  # Shell Scrap object
.sys  # Windows system file
.url  # Internet shortcut
.vb   # VBScript file
.vbe  # VBScript Encoded script file
.vbs  # VBScript file
.vxd  # Windows system file
.wsc  # Windows Script Component
.wsf  # Windows Script file
.wsh  # Windows Script Host Settings file
.otf  # Font file - can be used to instant reboot 2k and xp
.ops  # Office XP settings 
 
 
 
# Files which one normally things as non-executable but
# can contain harmful macros and viruses
 
.doc  # Word document
.xls  # Excel document
.pps
 
 
# Other files which may contain files with executable code
 
.gz   # Gziped file
.tar  # Tape ARchive file
.zip  # Windows compressed file
.tgz  # Unix compressed file
.bz2  # Unix compressed file
.cdr  # Mac disk image
.dmg  # Mac disk image
.smi  # Mac self mounting disk image
.sit  # Mac compressed file
.sea  # Mac compressed file, self extracting
.bin  # Mac binary compressed file
.hqx  # Mac binhex encoded file
.rar  # Similar to zip
 
 
# Time/bandwidth wasting files
 
.mp3  # Music file
.mpeg # Movie file
.mpg  # Movie file
.avi  # Movie file
.asf  # this can also exploit a security hole allowing virus infection
.iso  # CD ISO image
.ogg  # Music file
.wmf  # Movie file
.bin # CD ISO image
.cue # CD ISO image
 
# Banned Media extension list (Audio , Video , Streaming)
# Arrange Alphabetically
# Some have no Description
#.3g2    #
#.3gp      # Nokia Movie File
#.3gp2
#.3gpp
#.3gpp2
#.aac    # AAC Audio
#.acp    # AAC for SD Media
#.adts
#.aif
#.aifc
#.aiff    # AIFF Audio
#.amc    # AMC Media
#.amr    # narrow-Band Content
#.asf      # Media / this can also exploit a security hole allowing virus infection
#.asx      # Windows Media Audio / Video
#.au    # uLaw/AU Audio
#.avi      # Movie file
#.awb    # AMR Wide-Band Content
#.bwf
#.caf    # CAF Audio
#.cda    # Audio CD File
#.cdda    # Audio CD File
#.cel
#.cue     # CD ISO image
#.dif
#.divx    # Compress Movie
#.dv    # Video Format used in Portable Camera
#.flc      # Autodesk Animator
#.fli
#.flv      # Internet Movies
#.gsm
#.ivf
#.kar    # Karaoke Media Files
#.m15
#.m1a
#.m1s
#.m1v
#.m2v
#.m3u    # MP3 Playlist
#.m4a    # AAC Audio
#.m4b
#.m4e
#.m4p    # AAC Audio (Protected)
#.m4v    # Video (Protected)
#.m75
#.mid    # Midi Audio Files
#.midi    # Midi Audio Files
#.mjpg
#.mov    # Movie Files
#.mp1
#.mp2
#.mp3      # Music file
#.mp4    # Mpeg-4 Media
#.mpa
#.mpe
#.mpeg     # Movie file
#.mpg      # Movie file
#.mpga
#.mpm
#.mps
#.mpv
#.mpv2
#.mqv      # Quicktime Movies
#.mv
#.ogg      # Music file
#.ogm      # Ogg Based Movie Files
#.pls      # Shoutcast type of radio
#.qcp    # Qualcomm Purevoice Audio
#.qt    # Quicktime File
#.qtc
#.qtl      # Quicktime Movies
#.ra    # Real Audio
#.ram    # Real Audio Media
#.rm       # Real Media Files
#.rmi
#.rmm
#.rmp
#.rmvb    # Real Media Video
#.rnx
#.rp    # Real Player Files
#.rt
#.rts
#.rtsp
#.rv
#.sd2    # Sound Designer II
#.sdp      # Stream Descriptor
#.sdv    # SD Video
#.sf
#.smf
#.smi    #
#.smil     # SMIL Multimedia Presentation (Video and Audio Presentation
#.snd
#.ssm      # Streaming Media Metafile
#.swa    # MP3 Audio
#.swf      # Shockwave Streaming files
#.ulw
#.vfw       # Video for Windows
#.wav
#.wax
#.wm
#.wma
#.wmf      # Movie file
#.wmp
#.wmv     # Windows Media Video
#.wmx
#.wvx
#.xpl

Wem die grundlegenden Möglichkeiten von Dansguardian noch nicht ausreichen, dem sind separate blacklists ans Herz zu legen.

Ein kostenpflichige Sammlung von Blacklists¹⁾ kann bei Bedarf von nachfolgender Adresse heruntergeladen werden. Ob sich diese Investition lohnt, muss jeder für sich selbst entscheiden!

Nachdem wir das Archiv bigblacklist.tar.gz heruntergeladen haben, entpacken wir den Inhalt kurzerhand nach /tmp/.

 # tar xzfv bigblacklist.tar.gz

Anschließend kopieren wir das Verzeichnis mit samt seinem Inhalt in unsere Dansguardian-Konfigurationsverzeichnis /etc/dansguardian/lists/.

 # cp -fr /tmp/blacklists/ /etc/dansguardian/lists/

 cp: overwrite `/etc/dansguardian/lists/blacklists/ads/expressions'? y
 cp: overwrite `/etc/dansguardian/lists/blacklists/ads/urls'? y
 cp: overwrite `/etc/dansguardian/lists/blacklists/ads/domains'? y

Eine detaillierte Beschreibung der einzelnen Listen ist in folgender Datei enthalten:

• /etc/dansguardian/lists/blacklists/CATEGORIES enthalten.

Eine Aufstellung von positiven Seiten, solche, die also keiner Sperre unterworfen werden sollen finden sich in den beiden Verzeichnissen:

• /etc/dansguardian/lists/blacklists/whitelist/domains
• /etc/dansguardian/lists/blacklists/whitelist/urls

Die Konfiguration bzw. das Einbinden der Domain-Listen aus den einzelnen Verzeichnissen erfolgt in der Konfigurationsdatei /etc/dansguardian/lists/bannedsitelist . Hier ist ebenfalls schon eine etwas kleinere Liste enthalten, welche aber aufgrund des neuen und aktuelleren Umfangs ignoriert werden sollte, jedoch als Vorlage dienen kann, wie die einzelnen Domain-Listen eingebunden werden können.

In der Konfigurationsdatei /etc/dansguardian/lists/bannedsitelist haben wir nun die Möglichkeit einzelne Einträge zu aktivieren, in dem wir das Zeichen # vor einer Zeile löschen, welche wir aktivieren möchten. Im nachfolgendem Beispiel haben wir folgende beiden Zeilen aktiviert:

• .Include</etc/dansguardian/lists/blacklists/sexuality/domains>
• .Include</etc/dansguardian/lists/blacklists/spyware/domains>

 # vim /etc/dansguardian/lists/bannedsitelist

/etc/dansguardian/lists/bannedsitelist

#domains in banned list
#Don't bother with the www. or the http://
 
#The bannedurllist is for blocking PART of a site
#The bannedsitelist is for blocking ALL of a site
 
#As of DansGuardian 2.7.3 you can now include
#.tld so for example you can match .gov for example
 
#The 'grey' lists override the 'banned' lists.
#The 'exception' lists override the 'banned' lists also.
#The difference is that the 'exception' lists completely switch
#off *all* other filtering for the match.  'grey' lists only
#stop the URL filtering and allow the normal filtering to work.
 
#An example of grey list use is when in Blanket Block (whitelist)
#mode and you want to allow some sites but still filter as normal
#on their content
 
#Another example of grey list use is when you ban a site but want
#to allow part of it.
 
#To include additional files in this list use this example:
#.Include</etc/dansguardian/anotherbannedurllist>
 
#You can have multiple .Includes.
 
# Time limiting syntax:
# #time: <start hour> <start minute> <end hour> <end minute> <days>
# Example:
##time: 9 0 17 0 01234
# Remove the first # from the line above to enable this list only from
# 9am to 5pm, Monday to Friday.
 
# List categorisation
#listcategory: "Banned Sites"
 
#List other sites to block:
 
badboys.com
 
# Django 2011-11-15
# Nutzerindividuelle gesperrte Seiten blocklists
 
microsoft.com
cdu.de
csu.de
spd.de
ftp.de
 
#Blanket Block.  To block all sites except those in the
#exceptionsitelist and greysitelist files, remove
#the # from the next line to leave only a '**':
#**
 
#Blanket SSL/CONNECT Block.  To block all SSL 
#and CONNECT tunnels except to addresses in the
#exceptionsitelist and greysitelist files, remove
#the # from the next line to leave only a '**s':
#**s
 
#Blanket IP Block.  To block all sites specified only as an IP,
#remove the # from the next line to leave only a '*ip':
#*ip
 
#Blanket SSL/CONNECT IP Block.  To block all SSL and CONNECT
#tunnels to sites specified only as an IP,
#remove the # from the next line to leave only a '*ips':
#*ips
 
 
# The squidGuard advert domain/URL lists are now included by default.
# To work with advanced ad blocking & the logadblocks option, advert
# phrase/site/URL lists should have the string "ADs" in their listcategory.
.Include</etc/dansguardian/lists/blacklists/ads/domains>
 
#Remove the # from the following and edit as needed to use a stock
#squidGuard/urlblacklists collection.
#.Include</etc/dansguardian/lists/blacklists/adult/domains>
#.Include</etc/dansguardian/lists/blacklists/aggressive/domains>
#.Include</etc/dansguardian/lists/blacklists/artnudes/domains>
#.Include</etc/dansguardian/lists/blacklists/audio-video/domains>
#.Include</etc/dansguardian/lists/blacklists/beerliquorinfo/domains>
#.Include</etc/dansguardian/lists/blacklists/beerliquorsale/domains>
#.Include</etc/dansguardian/lists/blacklists/chat/domains>
#.Include</etc/dansguardian/lists/blacklists/childcare/domains>
#.Include</etc/dansguardian/lists/blacklists/clothing/domains>
#.Include</etc/dansguardian/lists/blacklists/culinary/domains>
#.Include</etc/dansguardian/lists/blacklists/dialers/domains>
#.Include</etc/dansguardian/lists/blacklists/drugs/domains>
#.Include</etc/dansguardian/lists/blacklists/entertainment/domains>
#.Include</etc/dansguardian/lists/blacklists/forums/domains>
#.Include</etc/dansguardian/lists/blacklists/frencheducation/domains>
#.Include</etc/dansguardian/lists/blacklists/gambling/domains>
#.Include</etc/dansguardian/lists/blacklists/government/domains>
#.Include</etc/dansguardian/lists/blacklists/hacking/domains>
#.Include</etc/dansguardian/lists/blacklists/homerepair/domains>
#.Include</etc/dansguardian/lists/blacklists/hygiene/domains>
#.Include</etc/dansguardian/lists/blacklists/jewelry/domains>
#.Include</etc/dansguardian/lists/blacklists/jobsearch/domains>
#.Include</etc/dansguardian/lists/blacklists/kidstimewasting/domains>
#.Include</etc/dansguardian/lists/blacklists/mail/domains>
#.Include</etc/dansguardian/lists/blacklists/news/domains>
#.Include</etc/dansguardian/lists/blacklists/onlineauctions/domains>
#.Include</etc/dansguardian/lists/blacklists/onlinegames/domains>
#.Include</etc/dansguardian/lists/blacklists/onlinepayment/domains>
#.Include</etc/dansguardian/lists/blacklists/personalfinance/domains>
#.Include</etc/dansguardian/lists/blacklists/pets/domains>
#.Include</etc/dansguardian/lists/blacklists/porn/domains>
#.Include</etc/dansguardian/lists/blacklists/proxy/domains>
#.Include</etc/dansguardian/lists/blacklists/publicite/domains>
#.Include</etc/dansguardian/lists/blacklists/redirector/domains>
#.Include</etc/dansguardian/lists/blacklists/ringtones/domains>
#.Include</etc/dansguardian/lists/blacklists/sportnews/domains>
#.Include</etc/dansguardian/lists/blacklists/sports/domains>
#.Include</etc/dansguardian/lists/blacklists/vacation/domains>
#.Include</etc/dansguardian/lists/blacklists/violence/domains>
#.Include</etc/dansguardian/lists/blacklists/virusinfected/domains>
#.Include</etc/dansguardian/lists/blacklists/warez/domains>
 
# You will need to edit to add and remove categories you want
 
# Django : 2011-11-15 
# BigBlacklist vom 2011-11-15 von Seite http://urlblacklist.com/ übernommen
 
#.Include</etc/dansguardian/lists/blacklists/abortion/domains>
#.Include</etc/dansguardian/lists/blacklists/ads/domains>
#.Include</etc/dansguardian/lists/blacklists/adult/domains>
#.Include</etc/dansguardian/lists/blacklists/aggressive/domains>
#.Include</etc/dansguardian/lists/blacklists/alcohol/domains>
#.Include</etc/dansguardian/lists/blacklists/antispyware/domains>
#.Include</etc/dansguardian/lists/blacklists/artnudes/domains>
#.Include</etc/dansguardian/lists/blacklists/astrology/domains>
#.Include</etc/dansguardian/lists/blacklists/audio-video/domains>
#.Include</etc/dansguardian/lists/blacklists/banking/domains>
#.Include</etc/dansguardian/lists/blacklists/beerliquorinfo/domains>
#.Include</etc/dansguardian/lists/blacklists/beerliquorsale/domains>
#.Include</etc/dansguardian/lists/blacklists/blog/domains>
#.Include</etc/dansguardian/lists/blacklists/books/domains>
#.Include</etc/dansguardian/lists/blacklists/celebrity/domains>
#.Include</etc/dansguardian/lists/blacklists/cellphones/domains>
#.Include</etc/dansguardian/lists/blacklists/chat/domains>
#.Include</etc/dansguardian/lists/blacklists/child/domains>
#.Include</etc/dansguardian/lists/blacklists/childcare/domains>
#.Include</etc/dansguardian/lists/blacklists/cleaning/domains>
#.Include</etc/dansguardian/lists/blacklists/clothing/domains>
#.Include</etc/dansguardian/lists/blacklists/contraception/domains>
#.Include</etc/dansguardian/lists/blacklists/culinary/domains>
#.Include</etc/dansguardian/lists/blacklists/dating/domains>
#.Include</etc/dansguardian/lists/blacklists/desktopsillies/domains>
#.Include</etc/dansguardian/lists/blacklists/dialers/domains>
#.Include</etc/dansguardian/lists/blacklists/drugs/domains>
#.Include</etc/dansguardian/lists/blacklists/ecommerce/domains>
#.Include</etc/dansguardian/lists/blacklists/entertainment/domains>
#.Include</etc/dansguardian/lists/blacklists/filehosting/domains>
#.Include</etc/dansguardian/lists/blacklists/filesharing/domains>
#.Include</etc/dansguardian/lists/blacklists/financial/domains>
#.Include</etc/dansguardian/lists/blacklists/frencheducation/domains>
#.Include</etc/dansguardian/lists/blacklists/gambling/domains>
#.Include</etc/dansguardian/lists/blacklists/games/domains>
#.Include</etc/dansguardian/lists/blacklists/gardening/domains>
#.Include</etc/dansguardian/lists/blacklists/government/domains>
#.Include</etc/dansguardian/lists/blacklists/guns/domains>
#.Include</etc/dansguardian/lists/blacklists/hacking/domains>
#.Include</etc/dansguardian/lists/blacklists/homerepair/domains>
#.Include</etc/dansguardian/lists/blacklists/humor/domains>
#.Include</etc/dansguardian/lists/blacklists/hunting/domains>
#.Include</etc/dansguardian/lists/blacklists/hygiene/domains>
#.Include</etc/dansguardian/lists/blacklists/instantmessaging/domains>
#.Include</etc/dansguardian/lists/blacklists/jewelry/domains>
#.Include</etc/dansguardian/lists/blacklists/jobsearch/domains>
#.Include</etc/dansguardian/lists/blacklists/kidstimewasting/domains>
#.Include</etc/dansguardian/lists/blacklists/magazines/domains>
#.Include</etc/dansguardian/lists/blacklists/mail/domains>
#.Include</etc/dansguardian/lists/blacklists/malware/domains>
#.Include</etc/dansguardian/lists/blacklists/manga/domains>
#.Include</etc/dansguardian/lists/blacklists/marketingware/domains>
#.Include</etc/dansguardian/lists/blacklists/medical/domains>
#.Include</etc/dansguardian/lists/blacklists/mixed_adult/domains>
#.Include</etc/dansguardian/lists/blacklists/mobile-phone/domains>
#.Include</etc/dansguardian/lists/blacklists/naturism/domains>
#.Include</etc/dansguardian/lists/blacklists/news/domains>
#.Include</etc/dansguardian/lists/blacklists/onlineauction/domains>s
#.Include</etc/dansguardian/lists/blacklists/onlinegames/domains>
#.Include</etc/dansguardian/lists/blacklists/onlinepayment/domains>
#.Include</etc/dansguardian/lists/blacklists/personalfinance/domains>
#.Include</etc/dansguardian/lists/blacklists/pets/domains>
#.Include</etc/dansguardian/lists/blacklists/phishing/domains>
#.Include</etc/dansguardian/lists/blacklists/porn/domains>
#.Include</etc/dansguardian/lists/blacklists/press/domains>
#.Include</etc/dansguardian/lists/blacklists/proxy/domains>
#.Include</etc/dansguardian/lists/blacklists/radio/domains>
#.Include</etc/dansguardian/lists/blacklists/reaffected/domains>
#.Include</etc/dansguardian/lists/blacklists/religion/domains>
#.Include</etc/dansguardian/lists/blacklists/ringtones/domains>
#.Include</etc/dansguardian/lists/blacklists/searchengines/domains>
#.Include</etc/dansguardian/lists/blacklists/sect/domains>
.Include</etc/dansguardian/lists/blacklists/sexuality/domains>
#.Include</etc/dansguardian/lists/blacklists/shopping/domains>
#.Include</etc/dansguardian/lists/blacklists/socialnetworking/domains>
#.Include</etc/dansguardian/lists/blacklists/sportnews/domains>
#.Include</etc/dansguardian/lists/blacklists/sports/domains>
.Include</etc/dansguardian/lists/blacklists/spyware/domains>
#.Include</etc/dansguardian/lists/blacklists/tobacco/domains>
#.Include</etc/dansguardian/lists/blacklists/updatesites/domains>
#.Include</etc/dansguardian/lists/blacklists/vacation/domains>
#.Include</etc/dansguardian/lists/blacklists/verisign/domains>
#.Include</etc/dansguardian/lists/blacklists/violence/domains>
#.Include</etc/dansguardian/lists/blacklists/virusinfected/domains>
#.Include</etc/dansguardian/lists/blacklists/warez/domains>
#.Include</etc/dansguardian/lists/blacklists/weapons/domains>
#.Include</etc/dansguardian/lists/blacklists/weather/domains>
#.Include</etc/dansguardian/lists/blacklists/webmail/domains>

Unter Umständen werdedn nun eine ganze Reihe von Seiten plötzlich nicht mehr erreichbar sein, weil diese eben auf eine der besagten blacklists steht (warum auch immer!).

Hier hilft dann nur eine Detailsuche wo überall die Seite geblockt werden könnte.

 # grep webmail.trachtler.net /etc/dansguardian/lists/blacklists/* -r

 /etc/dansguardian/lists/blacklists/mail/domains:webmail.trachtler.net

Bei Bedarf muss also in der Datei /etc/dansguardian/lists/blacklists/mail/domains einfach ein # vor der Zeile webmail.trachtler.net gemacht werden und die Seite ist wieder erreichbar.

Steuert ein Nutzer eine Seite an, deren Inhalte nicht mit den auf Grund unserer Definitionen nicht als geeignet erscheint, wird eine Sperrseite eingeblendet. In der Konfigurationsdatei /etc/dansguardian/dansguardian.conf haben wir den den Reportinglevel auf 3 gesetzt reportinglevel = 3. Daher wird aus dem Verzeichnis /usr/share/dansguardian/languages/german/ die Datei template.html angezeigt.

/usr/share/dansguardian/languages/german/template.html

<html>
 
<head>
<title>DansGuardian - Zugriff verweigert</title>
<meta http-equiv="content-type"  content="text/html; charset=utf-8">
</head>
 
<body bgcolor=#FFFFFF>
 
<center>
<table border=0 cellspacing=0 cellpadding=2 height=540 width=700>
<tr>
	<td colspan=2 bgcolor=#FEA700 height=100 align=center>
	<font face=arial,helvetica size=6>
	<b>Zugriff verweigert!</b>
	</td>
</tr>
<tr>
	<td colspan=2 bgcolor=#FFFACD height=30 align=right>
	<font face=arial,helvetica size=3 color=black>
	<b>-USER-&nbsp;</b>
	</td>
</tr>
<tr>
	<td align=center valign=bottom width=150 bgcolor=#B0C4DE>
	<font face=arial,helvetica size=1 color=black>
	IHRE FIRMA
	</td>
	<td width=550 bgcolor=#FFFFFF align=center valign=center>
	<font face=arial,helvetica color=black>
	<font size=4>
	Der Zugriff auf die Seite
	<br><br>
	<a href="-URL-" target="_blank">-URL-</a>
	<br><br>
	<font size=3>
	wurde mit folgender Begründung verweigert:
	<br><br>
	<font color=red>
	<b>-REASONLOGGED-</b>
	<font color=black>
	<br><br><br><br>
	Sie sehen diese Fehlermeldung, weil die von Ihnen gewünschte Seite unangebrachte Inhalte aufweist oder als solche gekennzeichnet ist.
	<br><br>
	Bei Fragen oder Beschwerden wenden Sie sich bitte an Ihren Netzwerkadministrator.
	<br><br><br><br>
	<font size=1>
	Powered by <a href="http://www.dansguardian.org" target="_blank">DansGuardian</a>
	</td>
</tr>
</table>
 
</body>
 
</html>
 
<!--
Translated and adapted for Unicode by Peter Vollmar
The available variables are as follows:
- URL- gives the URL the user was trying to get to.
- REASONGIVEN- gives the nice reason (i.e. not quoting the banned phrase).
- REASONLOGGED- gives the reason that gets logged including full details.
- USER- gives the username if known.
- IP- gives the originating IP.
- FILTERGROUP- gives the group number.
- BYPASS- gives URL which allows temporary bypass of denied page
 
You need to remove the space between the - and the variable to use them
in your HTML.  They are there above so extra processing is not required.
 
More example templates are likely to be found on the DansGuardian web site
on the Extras page.
 
This page was designed by Paul Richards.  (http://www.ridney.com/)
 
Daniel Barron 2003-09-01
--!>

Die angezeigte Seite zeigt im Detail die exakte Beschreibung, warum die Seite nicht angezeigt wurde. Ferner ist diese nicht gerade für unseren Anwenderkreis individualisiert.

Neben der Formulierung werden wird neben dem richtigen Firmennamen auch noch beim Usernamen seinen zugehörigen Usergruppennamen anzeigen lassen. Darüber hinaus soll nur noch der Grund, warum eine Seite gesperrt wurde, angegeben werden, nicht aber im Detail die genaue Ursache. Dies erreichen wir mit dem Schlüsselwort -REASONGIVEN- erreicht.

Entsprechen bearbeiten wir nun die HTML-Vorgabedatei /usr/share/dansguardian/languages/german/template.html.

 # vim /usr/share/dansguardian/languages/german/template.html

/usr/share/dansguardian/languages/german/template.html

<html>
 
<head>
<title>DansGuardian - Zugriff verweigert</title>
<meta http-equiv="content-type"  content="text/html; charset=utf-8">
</head>
 
<body bgcolor=#FFFFFF>
 
<center>
<table border=0 cellspacing=0 cellpadding=2 height=540 width=700>
<tr>
	<td colspan=2 bgcolor=#FEA700 height=100 align=center>
	<font face=arial,helvetica size=6>
	<b>Zugriff verweigert!</b>
	</td>
</tr>
<tr>
	<td colspan=2 bgcolor=#FFFACD height=30 align=right>
	<font face=arial,helvetica size=3 color=black>
	<b>User: -USER-&nbsp; Gruppe: -FILTERGROUP-</b>
	</td>
</tr>
<tr>
	<td align=center valign=bottom width=150 bgcolor=#B0C4DE>
	<font face=arial,helvetica size=1 color=black>
	NAUSCH.ORG
	</td>
	<td width=550 bgcolor=#FFFFFF align=center valign=center>
	<font face=arial,helvetica color=black>
	<font size=4>
	Der Zugriff auf die Seite
	<br><br>
	<a href="-URL-" target="_blank">-URL-</a>
	<br><br>
	<font size=3>
	wurde mit folgender Begründung verweigert:
	<br><br>
	<font color=red>
	<b>-REASONGIVEN-</b>
	<font color=black>
	<br><br><br><br>
	Du siehst diese Fehlermeldung, weil die von Dir gewünschte Seite unangebrachte Inhalte aufweist oder als solche gekennzeichnet ist.
	<br><br>
	Bei Fragen oder Beschwerden wende Dich bitte an Deinen Netzwerkadministrator, aka BOfH, aka PaPa!
	<br><br><br><br>
	<font size=1>
	Powered by <a href="http://www.dansguardian.org" target="_blank">DansGuardian</a>
	</td>
</tr>
</table>
 
</body>
 
</html>
 
<!--
Translated and adapted for Unicode by Peter Vollmar
The available variables are as follows:
- URL- gives the URL the user was trying to get to.
- REASONGIVEN- gives the nice reason (i.e. not quoting the banned phrase).
- REASONLOGGED- gives the reason that gets logged including full details.
- USER- gives the username if known.
- IP- gives the originating IP.
- FILTERGROUP- gives the group number.
- BYPASS- gives URL which allows temporary bypass of denied page
 
You need to remove the space between the - and the variable to use them
in your HTML.  They are there above so extra processing is not required.
 
More example templates are likely to be found on the DansGuardian web site
on the Extras page.
 
This page was designed by Paul Richards.  (http://www.ridney.com/)
 
Daniel Barron 2003-09-01
--!>

Das Ergebnis der oben gezeigten HTML-Vorgabedatei sieht dann schon etwas ansprechender aus, oder?

Die Standardeinstellungen, die Dansguardian aus dem RPM-Paket mitbringt, führen durchaus zu nicht unerheblichen RAM-Speicherverbrauch. Je nach Einsatz des Web-Contentscanners und der zu versorgenden Clients kann es zweckmäßig sein, die Systemparameter etwas anzupassen.

In der zentralen Konfigurationsdatei /etc/dansguardian/dansguardian.conf passen wir die Werte beim Bereich Fork pool options die Parameter unserer Umgebung entsprechend an.

 # vim /etc/dansguardian/dansguardian.conf

/etc/dansguardian/dansguardian.conf

# DansGuardian config file for version 2.10.1.1
 
# **NOTE** as of version 2.7.5 most of the list files are now in dansguardianf1.conf
 
 
# Web Access Denied Reporting (does not affect logging)
#
# -1 = log, but do not block - Stealth mode
#  0 = just say 'Access Denied'
#  1 = report why but not what denied phrase
#  2 = report fully
#  3 = use HTML template file (accessdeniedaddress ignored) - recommended
#
reportinglevel = 3
 
# Language dir where languages are stored for internationalisation.
# The HTML template within this dir is only used when reportinglevel
# is set to 3. When used, DansGuardian will display the HTML file instead of
# using the perl cgi script.  This option is faster, cleaner
# and easier to customise the access denied page.
# The language file is used no matter what setting however.
#
languagedir = '/usr/share/dansguardian/languages'
 
# language to use from languagedir.
# Django 2011-11-15
# Default: language = 'ukenglish'
language = 'german'
 
# Logging Settings
#
# 0 = none  1 = just denied  2 = all text based  3 = all requests
# Django 2011-11-15 Anpassen des Log-Levels
# default : loglevel = 2
loglevel = 1
 
# Log Exception Hits
# Log if an exception (user, ip, URL, phrase) is matched and so
# the page gets let through.  Can be useful for diagnosing
# why a site gets through the filter.
# 0 = never log exceptions
# 1 = log exceptions, but do not explicitly mark them as such
# 2 = always log & mark exceptions (default)
logexceptionhits = 2
 
# Log File Format
# 1 = DansGuardian format (space delimited)
# 2 = CSV-style format
# 3 = Squid Log File Format
# 4 = Tab delimited
logfileformat = 1
 
# truncate large items in log lines
#maxlogitemlength = 400
 
# anonymize logs (blank out usernames & IPs)
#anonymizelogs = on
 
 
# Syslog logging
#
# Use syslog for access logging instead of logging to the file
# at the defined or built-in "loglocation"
#syslog = on
 
# Log file location
# 
# Defines the log directory and filename.
#loglocation = '/var/log/dansguardian/access.log'
 
 
# Statistics log file location
#
# Defines the stat file directory and filename.
# Only used in conjunction with maxips > 0
# Once every 3 minutes, the current number of IPs in the cache, and the most
# that have been in the cache since the daemon was started, are written to this
# file. IPs persist in the cache for 7 days.
#statlocation = '/var/log/dansguardian/stats'
 
 
# Network Settings
# 
# the IP that DansGuardian listens on.  If left blank DansGuardian will
# listen on all IPs.  That would include all NICs, loopback, modem, etc.
# Normally you would have your firewall protecting this, but if you want
# you can limit it to a certain IP. To bind to multiple interfaces,
# specify each IP on an individual filterip line.
filterip =
 
# the port that DansGuardian listens to.
filterport = 8080
 
# the ip of the proxy (default is the loopback - i.e. this server)
proxyip = 127.0.0.1
 
# the port DansGuardian connects to proxy on
proxyport = 3128
 
# Whether to retrieve the original destination IP in transparent proxy
# setups and check it against the domain pulled from the HTTP headers.
#
# Be aware that when visiting sites which use a certain type of round-robin
# DNS for load balancing, DG may mark requests as invalid unless DG gets
# exactly the same answers to its DNS requests as clients.  The chances of
# this happening can be increased if all clients and servers on the same LAN
# make use of a local, caching DNS server instead of using upstream DNS
# directly.
#
# See http://www.kb.cert.org/vuls/id/435052
# on (default) | off
#!! Not compiled !! originalip = on
 
# accessdeniedaddress is the address of your web server to which the cgi
# dansguardian reporting script was copied. Only used in reporting levels 1 and 2.
#
# This webserver must be either:
#  1. Non-proxied. Either a machine on the local network, or listed as an exception
#     in your browser's proxy configuration.
#  2. Added to the exceptionsitelist. Option 1 is preferable; this option is
#     only for users using both transparent proxying and a non-local server
#     to host this script.
#
# Individual filter groups can override this setting in their own configuration.
#
# Django 2011-11-15
# default : accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl'
# accessdeniedaddress = 'http://nausch.org/cgi-bin/dansguardian.pl'
 
 
# Non standard delimiter (only used with accessdeniedaddress)
# To help preserve the full banned URL, including parameters, the variables
# passed into the access denied CGI are separated using non-standard
# delimiters. This can be useful to ensure correct operation of the filter
# bypass modes. Parameters are split using "::" in place of "&", and "==" in
# place of "=".
# Default is enabled, but to go back to the standard mode, disable it.
nonstandarddelimiter = on
 
 
 
# Banned image replacement
# Images that are banned due to domain/url/etc reasons including those
# in the adverts blacklists can be replaced by an image.  This will,
# for example, hide images from advert sites and remove broken image
# icons from banned domains.
# on (default) | off
usecustombannedimage = on
custombannedimagefile = '/usr/share/dansguardian/transparent1x1.gif'
 
 
 
# Filter groups options
# filtergroups sets the number of filter groups. A filter group is a set of content
# filtering options you can apply to a group of users.  The value must be 1 or more.
# DansGuardian will automatically look for dansguardianfN.conf where N is the filter
# group.  To assign users to groups use the filtergroupslist option.  All users default
# to filter group 1.  You must have some sort of authentication to be able to map users
# to a group.  The more filter groups the more copies of the lists will be in RAM so
# use as few as possible.
filtergroups = 1
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'
 
 
 
# Authentication files location
bannediplist = '/etc/dansguardian/lists/bannediplist'
exceptioniplist = '/etc/dansguardian/lists/exceptioniplist'
 
 
 
# Show weighted phrases found
# If enabled then the phrases found that made up the total which excedes
# the naughtyness limit will be logged and, if the reporting level is
# high enough, reported. on | off
showweightedfound = on
 
# Weighted phrase mode
# There are 3 possible modes of operation:
# 0 = off = do not use the weighted phrase feature.
# 1 = on, normal = normal weighted phrase operation.
# 2 = on, singular = each weighted phrase found only counts once on a page.
#
weightedphrasemode = 2
 
 
 
# Positive (clean) result caching for URLs
# Caches good pages so they don't need to be scanned again.
# It also works with AV plugins.
# 0 = off (recommended for ISPs with users with disimilar browsing)
# 1000 = recommended for most users
# 5000 = suggested max upper limit
# If you're using an AV plugin then use at least 5000.
urlcachenumber = 1000
#
# Age before they are stale and should be ignored in seconds
# 0 = never
# 900 = recommended = 15 mins
urlcacheage = 900
 
 
 
# Clean cache for content (AV) scan results
# By default, to save CPU, files scanned and found to be
# clean are inserted into the clean cache and NOT scanned
# again for a while.  If you don't like this then choose
# to disable it.
# (on|off) default = on.
scancleancache = on
 
 
 
# Smart, Raw and Meta/Title phrase content filtering options
# Smart is where the multiple spaces and HTML are removed before phrase filtering
# Raw is where the raw HTML including meta tags are phrase filtered
# Meta/Title is where only meta and title tags are phrase filtered (v. quick)
# CPU usage can be effectively halved by using setting 0 or 1 compared to 2
# 0 = raw only
# 1 = smart only
# 2 = both of the above (default)
# 3 = meta/title
phrasefiltermode = 2
 
# Lower casing options
# When a document is scanned the uppercase letters are converted to lower case
# in order to compare them with the phrases.  However this can break Big5 and
# other 16-bit texts.  If needed preserve the case.  As of version 2.7.0 accented
# characters are supported.
# 0 = force lower case (default)
# 1 = do not change case
# 2 = scan first in lower case, then in original case
preservecase = 0
 
# Note:
# If phrasefiltermode and preserve case are both 2, this equates to 4 phrase
# filtering passes. If you have a large enough userbase for this to be a
# worry, and need to filter pages in exotic character encodings, it may be
# better to run two instances on separate servers: one with preservecase 1
# (and possibly forcequicksearch 1) and non ASCII/UTF-8 phrase lists, and one
# with preservecase 0 and ASCII/UTF-8 lists.
 
 
 
# Hex decoding options
# When a document is scanned it can optionally convert %XX to chars.
# If you find documents are getting past the phrase filtering due to encoding
# then enable.  However this can break Big5 and other 16-bit texts.
# off = disabled (default)
# on = enabled
hexdecodecontent = off
 
 
 
# Force Quick Search rather than DFA search algorithm
# The current DFA implementation is not totally 16-bit character compatible
# but is used by default as it handles large phrase lists much faster.
# If you wish to use a large number of 16-bit character phrases then
# enable this option.
# off (default) | on (Big5 compatible)
forcequicksearch = off
 
 
 
# Reverse lookups for banned site and URLs.
# If set to on, DansGuardian will look up the forward DNS for an IP URL
# address and search for both in the banned site and URL lists.  This would
# prevent a user from simply entering the IP for a banned address.
# It will reduce searching speed somewhat so unless you have a local caching
# DNS server, leave it off and use the Blanket IP Block option in the
# bannedsitelist file instead.
reverseaddresslookups = off
 
 
 
# Reverse lookups for banned and exception IP lists.
# If set to on, DansGuardian will look up the forward DNS for the IP
# of the connecting computer.  This means you can put in hostnames in
# the exceptioniplist and bannediplist.
# If a client computer is matched against an IP given in the lists, then the
# IP will be recorded in any log entries; if forward DNS is successful and a
# match occurs against a hostname, the hostname will be logged instead.
# It will reduce searching speed somewhat so unless you have a local DNS server, 
# leave it off.
reverseclientiplookups = off
 
 
# Perform reverse lookups on client IPs for successful requests.
# If set to on, DansGuardian will look up the forward DNS for the IP
# of the connecting computer, and log host names (where available) rather than
# IPs against requests.
# This is not dependent on reverseclientiplookups being enabled; however, if it
# is, enabling this option does not incur any additional forward DNS requests.
logclienthostnames = off
 
 
# Build bannedsitelist and bannedurllist cache files.
# This will compare the date stamp of the list file with the date stamp of
# the cache file and will recreate as needed.
# If a bsl or bul .processed file exists, then that will be used instead.
# It will increase process start speed by 300%.  On slow computers this will
# be significant.  Fast computers do not need this option. on | off
createlistcachefiles = on
 
 
 
# POST protection (web upload and forms)
# does not block forms without any file upload, i.e. this is just for
# blocking or limiting uploads
# measured in kibibytes after MIME encoding and header bumph
# use 0 for a complete block
# use higher (e.g. 512 = 512Kbytes) for limiting
# use -1 for no blocking
#maxuploadsize = 512
#maxuploadsize = 0
maxuploadsize = -1
 
 
 
# Max content filter size
# Sometimes web servers label binary files as text which can be very
# large which causes a huge drain on memory and cpu resources.
# To counter this, you can limit the size of the document to be
# filtered and get it to just pass it straight through.
# This setting also applies to content regular expression modification.
# The value must not be higher than maxcontentramcachescansize
# The size is in Kibibytes - eg 2048 = 2Mb
# use 0 to set it to maxcontentramcachescansize
maxcontentfiltersize = 256
 
 
 
# Max content ram cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size of file that DG will download and cache
# in RAM.  After this limit is reached it will cache to disk
# This value must be less than or equal to maxcontentfilecachescansize.
# The size is in Kibibytes - eg 10240 = 10Mb
# use 0 to set it to maxcontentfilecachescansize
# This option may be ignored by the configured download manager.
maxcontentramcachescansize = 2000
 
 
 
# Max content file cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size file that DG will download
# so that it can be scanned or virus checked.
# This value must be greater or equal to maxcontentramcachescansize.
# The size is in Kibibytes - eg 10240 = 10Mb
maxcontentfilecachescansize = 20000
 
 
 
# File cache dir
# Where DG will download files to be scanned if too large for the
# RAM cache.
filecachedir = '/tmp'
 
 
 
# Delete file cache after user completes download
# When a file gets save to temp it stays there until it is deleted.
# You can choose to have the file deleted when the user makes a sucessful
# download.  This will mean if they click on the link to download from
# the temp store a second time it will give a 404 error.
# You should configure something to delete old files in temp to stop it filling up.
# on|off (defaults to on)
deletedownloadedtempfiles = on
 
 
 
# Initial Trickle delay
# This is the number of seconds a browser connection is left waiting
# before first being sent *something* to keep it alive.  The
# *something* depends on the download manager chosen.
# Do not choose a value too low or normal web pages will be affected.
# A value between 20 and 110 would be sensible
# This may be ignored by the configured download manager.
initialtrickledelay = 20
 
 
 
# Trickle delay
# This is the number of seconds a browser connection is left waiting
# before being sent more *something* to keep it alive.  The
# *something* depends on the download manager chosen.
# This may be ignored by the configured download manager.
trickledelay = 10
 
 
 
# Download Managers
# These handle downloads of files to be filtered and scanned.
# They differ in the method they deal with large downloads.
# Files usually need to be downloaded 100% before they can be
# filtered and scanned before being sent on to the browser.
# Normally the browser can just wait, but with content scanning,
# for example to AV, the browser may timeout or the user may get
# confused so the download manager has to do some sort of
# 'keep alive'.
#
# There are various methods possible but not all are included.
# The author does not have the time to write them all so I have
# included a plugin systam.  Also, not all methods work with all
# browsers and clients.  Specifically some fancy methods don't
# work with software that downloads updates.  To solve this,
# each plugin can support a regular expression for matching
# the client's user-agent string, and lists of the mime types
# and extensions it should manage.
#
# Note that these are the matching methods provided by the base plugin
# code, and individual plugins may override or add to them.
# See the individual plugin conf files for supported options.
#
# The plugins are matched in the order you specify and the last
# one is forced to match as the default, regardless of user agent
# and other matching mechanisms.
#
downloadmanager = '/etc/dansguardian/downloadmanagers/fancy.conf'
#downloadmanager = '/etc/dansguardian/downloadmanagers/trickle.conf'
downloadmanager = '/etc/dansguardian/downloadmanagers/default.conf'
 
 
 
# Content Scanners (Also known as AV scanners)
# These are plugins that scan the content of all files your browser fetches
# for example to AV scan.  The options are limitless.  Eventually all of
# DansGuardian will be plugin based.  You can have more than one content
# scanner. The plugins are run in the order you specify.
# This is one of the few places you can have multiple options of the same name.
#
# Some of the scanner(s) require 3rd party software and libraries eg clamav.
# See the individual plugin conf file for more options (if any).
#
#!! Not compiled !! contentscanner = '/etc/dansguardian/contentscanners/clamav.conf'
#contentscanner = '/etc/dansguardian/contentscanners/clamdscan.conf'
#!! Unimplemented !! contentscanner = '/etc/dansguardian/contentscanners/kavav.conf'
#contentscanner = '/etc/dansguardian/contentscanners/kavdscan.conf'
#contentscanner = '/etc/dansguardian/contentscanners/icapscan.conf'
#contentscanner = '/etc/dansguardian/contentscanners/commandlinescan.conf'
 
 
 
# Content scanner timeout
# Some of the content scanners support using a timeout value to stop
# processing (eg AV scanning) the file if it takes too long.
# If supported this will be used.
# The default of 60 seconds is probably reasonable.
contentscannertimeout = 60
 
 
 
# Content scan exceptions
# If 'on' exception sites, urls, users etc will be scanned
# This is probably not desirable behavour as exceptions are
# supposed to be trusted and will increase load.
# Correct use of grey lists are a better idea.
# (on|off) default = off
contentscanexceptions = off
 
 
 
# Auth plugins
# These replace the usernameidmethod* options in previous versions. They
# handle the extraction of client usernames from various sources, such as
# Proxy-Authorisation headers and ident servers, enabling requests to be
# handled according to the settings of the user's filter group.
# Multiple plugins can be specified, and will be queried in order until one
# of them either finds a username or throws an error. For example, if Squid
# is configured with both NTLM and Basic auth enabled, and both the 'proxy-basic'
# and 'proxy-ntlm' auth plugins are enabled here, then clients which do not support
# NTLM can fall back to Basic without sacrificing access rights.
#
# If you do not use multiple filter groups, you need not specify this option.
#
#authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'
#authplugin = '/etc/dansguardian/authplugins/proxy-digest.conf'
#authplugin = '/etc/dansguardian/authplugins/proxy-ntlm.conf'
#authplugin = '/etc/dansguardian/authplugins/ident.conf'
#authplugin = '/etc/dansguardian/authplugins/ip.conf'
# Django 2011-11-15 Username im Logfile mit ausgeben
# default : NULL
authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'
 
# Re-check replaced URLs
# As a matter of course, URLs undergo regular expression search/replace (urlregexplist)
# *after* checking the exception site/URL/regexpURL lists, but *before* checking against
# the banned site/URL lists, allowing certain requests that would be matched against the
# latter in their original state to effectively be converted into grey requests.
# With this option enabled, the exception site/URL/regexpURL lists are also re-checked
# after replacement, making it possible for URL replacement to trigger exceptions based
# on them.
# Defaults to off.
recheckreplacedurls = off
 
 
 
# Misc settings
 
# if on it adds an X-Forwarded-For: <clientip> to the HTTP request
# header.  This may help solve some problem sites that need to know the
# source ip. on | off
forwardedfor = off
 
 
# if on it uses the X-Forwarded-For: <clientip> to determine the client
# IP. This is for when you have squid between the clients and DansGuardian.
# Warning - headers are easily spoofed. on | off
usexforwardedfor = off
 
 
# if on it logs some debug info regarding fork()ing and accept()ing which
# can usually be ignored.  These are logged by syslog.  It is safe to leave
# it on or off
logconnectionhandlingerrors = on
 
 
 
# Fork pool options
 
# If on, this causes DG to write to the log file whenever child processes are
# created or destroyed (other than by crashes). This information can help in
# understanding and tuning the following parameters, but is not generally
# useful in production.
logchildprocesshandling = off
 
# sets the maximum number of processes to spawn to handle the incoming
# connections.  Max value usually 250 depending on OS.
# On large sites you might want to try 180.
# Django 2011-11-15
# default maxchildren = 120
maxchildren = 80
 
 
# sets the minimum number of processes to spawn to handle the incoming connections.
# On large sites you might want to try 32.
# Django 2011-11-15
# default minchildren = 8
minchildren = 4
 
 
# sets the minimum number of processes to be kept ready to handle connections.
# On large sites you might want to try 8.
# Django 2011-11-15
# default minsparechildren = 4
minsparechildren = 2
 
 
# sets the minimum number of processes to spawn when it runs out
# On large sites you might want to try 10.
# Django 2011-11-15
# default preforkchildren = 6
preforkchildren = 4
 
 
# sets the maximum number of processes to have doing nothing.
# When this many are spare it will cull some of them.
# On large sites you might want to try 64.
# Django 2011-11-15
# default maxsparechildren = 32
maxsparechildren = 8
 
 
# sets the maximum age of a child process before it croaks it.
# This is the number of connections they handle before exiting.
# On large sites you might want to try 10000.
maxagechildren = 500
 
 
# Sets the maximum number client IP addresses allowed to connect at once.
# Use this to set a hard limit on the number of users allowed to concurrently
# browse the web. Set to 0 for no limit, and to disable the IP cache process.
maxips = 0
 
 
 
# Process options
# (Change these only if you really know what you are doing).
# These options allow you to run multiple instances of DansGuardian on a single machine.
# Remember to edit the log file path above also if that is your intention.
 
# IPC filename
# 
# Defines IPC server directory and filename used to communicate with the log process.
ipcfilename = '/tmp/.dguardianipc'
 
# URL list IPC filename
# 
# Defines URL list IPC server directory and filename used to communicate with the URL
# cache process.
urlipcfilename = '/tmp/.dguardianurlipc'
 
# IP list IPC filename
#
# Defines IP list IPC server directory and filename, for communicating with the client
# IP cache process.
ipipcfilename = '/tmp/.dguardianipipc'
 
# PID filename
# 
# Defines process id directory and filename.
#pidfilename = '/var/run/dansguardian.pid'
 
# Disable daemoning
# If enabled the process will not fork into the background.
# It is not usually advantageous to do this.
# on|off (defaults to off)
nodaemon = off
 
# Disable logging process
# on|off (defaults to off)
nologger = off
 
# Enable logging of "ADs" category blocks
# on|off (defaults to off)
logadblocks = off
 
# Enable logging of client User-Agent
# Some browsers will cause a *lot* of extra information on each line!
# on|off (defaults to off)
loguseragent = off
 
# Daemon runas user and group
# This is the user that DansGuardian runs as.  Normally the user/group nobody.
# Uncomment to use.  Defaults to the user set at compile time.
# Temp files created during virus scanning are given owner and group read
# permissions; to use content scanners based on external processes, such as
# clamdscan, the two processes must run with either the same group or user ID.
#daemonuser = 'dansguardian'
#daemongroup = 'dansguardian'
 
# Soft restart
# When on this disables the forced killing off all processes in the process group.
# This is not to be confused with the -g run time option - they are not related.
# on|off (defaults to off)
softrestart = off
 
# Mail program
# Path (sendmail-compatible) email program, with options.
# Not used if usesmtp is disabled (filtergroup specific).
mailer = '/usr/sbin/sendmail -t'

Anschließend müssen wir useren Dansguardian Daemon einmal durchstarten, damit die Änderungen greifen.

 # service dansguardian restart

 Shutting down Web Content Filter (dansguardian):           [  OK  ]
 Starting Web Content Filter (dansguardian):                [  OK  ]

• Zurück zum Kapitel >>Proxyserver Squid mit Web-Contentfilter Dansguardian und Virenfilter ClamAV unter CentOS 6.x<<
• Zurück zu >>Projekte und Themenkapitel<<
• Zurück zur Startseite