Squidguard vs Dansguardian

[Pete Clarke]

Hi there,

OK, so I have not got broadband (yea!) and have got my firewall etc. in
place.
The next thing for me to sort out is the proxy ... Squid is my first
choice - simply because it's the only one I have any experience of..
I also want to install content-filtering for the kids (rightly or wrongly -
I have decided it's a good option) and started with squidGuard.
The problem with that is that as soon as it starts, it consumes 100% of all
resources (CPU and disk thrash like crazy) making the system unresponsive
and eventually requiring a reboot just to be able to log into the console.
I put the redirector entry into squid.conf and it did indeed appear to
work - just *extremely* slowly. OK .. so then I decided to try
DansGuardian - much better, system load stay's around 0.4 - 0.15 under heavy
usage. The problem is that I like the flexibility of squidGuard (acl's
etc.) and the speed of DansGuardian - the latter is a little too strict in
it's filtering policy for my liking...

My (rather drawn out) question is this:

Does anyone have experience of SquidGuard running on Debian (fully patched,
stable Woody system) - if so, what are the gotcha's regarding performance
etc.
The system it's running on is:

Compaq Presario 850r Dual Pentium Pro 200;
512mb Ram;
18gb SCSI Disc.

The squid cache (/var/spool/squid) is on a seperate physical disc,
everything else is just a partition on the 1st SCSI disc.

I am using the blacklist from DansGuardian site, it's quite large but
comprehensive.


Cheers,


Pete.

[Mark McRitchie]

Heya,

Post by Pete Clarke
I have decided it's a good option) and started with squidGuard.
The problem with that is that as soon as it starts, it consumes 100%
of all resources (CPU and disk thrash like crazy) making the system
unresponsive and eventually requiring a reboot just to be able to log into
the console.

Squid + SquidGuard, Friday lunchtime userbase of approx 150.

moonraker:/var/log/squid# uptime
13:03:43 up 307 days, 23:50, 1 user, load average: 0.00, 0.00, 0.00

Post by Pete Clarke
Does anyone have experience of SquidGuard running on Debian
(fully patched, stable Woody system) - if so, what are the gotcha's

regarding

Post by Pete Clarke
performance etc.

Fully up to date Woody box, but I backported my squid from testing I think
it was - at the time we were considering integrated auth for all our clients
(windows). In the end we just let everybody have access out and ditched the
integreated auth, never rolled back squid to the version in woody though (if
it ain't broke...)

Relevant dpkg output:
hi squid 2.5.1-4 Internet Object Cache (WWW proxy cache)
ii squidguard 1.2.0-1 filter, redirector and access controller
plu

That said, I never had an issue running the stock version of squid +
squidguard initially.

Post by Pete Clarke
Compaq Presario 850r Dual Pentium Pro 200;
512mb Ram;
18gb SCSI Disc.

Our (dedicated) squid box has about half that ram and is roughly a 400Mhz
pentium thingy.
A single much larger drive, but not using much of it.

Post by Pete Clarke
The squid cache (/var/spool/squid) is on a seperate physical disc,
everything else is just a partition on the 1st SCSI disc.
I am using the blacklist from DansGuardian site, it's quite large but
comprehensive.

Our blacklists dir totals to about 24MB - I'd suggest that squidGuard rather
than squid could be your problem.

Have the blacklists converted into dbm format?


Regards,
Mark.








Salamis Group of Companies - WWW.SALAMISGROUP.COM

This communication contains information which is confidential and may
also be privileged. It is for the exclusive use of the intended
recipient(s). If you are not the intended recipient(s) be advised
that any form of distribution, copying or use of this communication
or the information it contains is strictly prohibited and may be
unlawful. We apologise if you have received this communication in
error. Please return it to the sender immediately, delete this
communication from your computer and destroy any copies of it. Any
views/opinions expressed in this email are that of the author and may
not reflect the views of Salamis (M&I)Ltd.

[Pete Clarke]

Post by Mark McRitchie
Our blacklists dir totals to about 24MB - I'd suggest that squidGuard rather
than squid could be your problem.

I concur .. when I disable squidGuard everything flies...

Post by Mark McRitchie
Have the blacklists converted into dbm format?

They are, I believe, still in the plaintext format under
/var/lib/squidguard/db/*

Cheers,


Pete.

[Pete Clarke]

Hi there,

Well, I compiled the .db files using squidGuard -C all and everything runs
*much* quicker now - no slowdowns at all, and system load is negligable -
trouble is, nothing gets blocked!

Any further ideas?? possibly something I've missed?

Cheers,


Pete.

[Pete Clarke]

But your as well not to. SquidGuard doesn't look at them - we keep ours
around so we can verify blocked urls, rebuild the db files if necessary

etc.

etc.

:-) sorry - my reply should have gone to the list, not to you personally..

Thanks for the input - I will convert the files and try again.

Cheers,


Pete.

[Mark McRitchie]

Post by Pete Clarke
Well, I compiled the .db files using squidGuard -C all and
everything runs
*much* quicker now - no slowdowns at all, and system load is
negligable -

Excellent :-)

Post by Pete Clarke
trouble is, nothing gets blocked!
Any further ideas?? possibly something I've missed?

Hmm.. Ok... Are you sure your squidGuard ACLs are set correctly and that in
squid.conf squidGuard is using the correct config file?

From my squid.conf:
redirect_program /usr/bin/squidGuard -c
/etc/chastity/squidGuard-chastity.conf

Initially installed chastity as a starting point for our blocklists.

IIRC the default squidGuard conf might pass everything by default...
Heres a snippet from ours:
Acl {
default {
pass !adult !audio-video !forums !hacking !redirector !warez
!ad
s !aggressive !drugs !gambling !violence all
redirect
http://127.0.0.1/cgi-bin/squidGuard.cgi?clientaddr=%a&s
rcclass=%s&clientuser=%i&clientname=%n&clientgroup=%s&targetclass=%t&targetg
roup
=%t&url=%u

}
}

HTH!
Mark.


Salamis Group of Companies - WWW.SALAMISGROUP.COM

This communication contains information which is confidential and may
also be privileged. It is for the exclusive use of the intended
recipient(s). If you are not the intended recipient(s) be advised
that any form of distribution, copying or use of this communication
or the information it contains is strictly prohibited and may be
unlawful. We apologise if you have received this communication in
error. Please return it to the sender immediately, delete this
communication from your computer and destroy any copies of it. Any
views/opinions expressed in this email are that of the author and may
not reflect the views of Salamis (M&I)Ltd.

[Pete Clarke]

Post by Mark McRitchie
Hmm.. Ok... Are you sure your squidGuard ACLs are set correctly and that in
squid.conf squidGuard is using the correct config file?
redirect_program /usr/bin/squidGuard -c
/etc/chastity/squidGuard-chastity.conf

From mine :

redirect_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf

Post by Mark McRitchie
Initially installed chastity as a starting point for our blocklists.

I have modified the conf file to have acl's dependant on user.
There were some issue with it, but the log file reports errors until you fix
them :-)

Here is a snippit from my squidGuard.conf file...

#---------------------------------------------------------------------------
# access lists
#
acl {
grownups {
# allow everything except adverts...
pass !ads all
}

kids {
# block inappropriate sites
pass !porn !adult !drugs !gambling !violence !dialers all
}

default {
# block access to all unknown users
pass none
redirect XXX
}
}