The squidGuard FAQ squidGuard is an ultrafast and free filter, redirector and access controller for Squid By Pål Baltzersen and Lars Erik Håland Copyright © 1999-2000, ElTele Øst AS

This page was last modified 2000-03-17

FAQ - Frequently Asked/Answered Questions

Currently in semirandom order:

1. Is there a mailing list for squidGuard?

   Yes!.




2. I have db3.x.x installed and squidGuard won't compile?

   Only db2.x.x versions are supported. We are working on db3.x.x support, but the API has changed so it may take a while to fix.




3. squidGuard does not block?

   There my be at least 2 reasons for this:

   1. You didn't end your pass rules with "none". Pass rules ends with an implicit "all". It is good practice to allways en the pass rules with either "all" or "none" to make them clear. Ie. use:
      pass good none
      or
      pass good !bad all
   2. squidGuard goes into emergency mode. Reasons may be syntax errors in the config file, reference to non existing database files, filprotection problems or missing directories. Check the squidGuard log.
      Note:When run under Squid, squidGuard is run with the same user and group ID as Squid (cache_effective_user and cache_effective_group in squid.conf). The squidGuard configuration and database files must be readable for this user and/or group and the squidGuard log directory must be writable for this user and/or group. If not squidGuard will go into the "pass all for all" emergency mode.




4. How can I block audio and video?

   Use an expressionlist with something like this:
   \.(ra?m|mpe?g?|mov|movie|qt|avi|dif|dvd?|mpv2|mp3)($|\?)




5. Are there any blacklist exchange plans?

   Yes, we plan to add an interface to the new web site to allow proxyadministrators to indirectly add and remove URLs from the robot config. Though there are still some practical issues to solve.




6. How can I test timeconstraints

   You can set a simulated start time with the -t yyyy-mm-ddTHH:MM:SS option:

   squidGuard -c test.conf -t 1999-12-31T23:59:30 -d <test.in>test.out 2>test.log

   With the -t option squidGuard parses the given date&time and calculates an offset from the current time at startup and then adds this offset to all timevalues during runtime.




7. squidGuard compiles fine and the tests succeed, but it seems to pass all when run under Squid

   There may be at leaste two reasons for this:

   • Some versions of Squid (supposedly 2.2.*) silently ignores argumets to the right of redirect_program prefix/bin/squidGuard. Solutions are one of:
     • Set the actual config file location at compiletime with --with-sg-config
     • Use a shell wraper with redirect_program prefix/bin/squidGuard.sh and make prefix/bin/squidGuard.sh an executable shell like:

       #! /bin/sh -
       exec prefix/bin/squidGuard -c whatever/squidGuard.conf

   • When run under Squid, squidGuard is run with the same user and group ID as Squid (cache_effective_user and cache_effective_group in squid.conf). The squidGuard configuration and database files must be readable for this user and/or group and the squidGuard log directory must be writable for this user and/or group. If not squidGuard will go into the "pass all for all" emergency mode.




8. compilation of sg.l on fails with "sg.l:line ...: Error: Too many positions" with native lex

   Some native versions of lex have problems with sg.l. The solution is to use GNU flex wich is better anyway. Do "setenv LEX flex" if configure selects the native lex before flex. Flex should compile right out of the box similar to other GNU programs. (Thanks to laurent.foulonneau@mail.loyalty.nc).




9. Can I use proxy authenticated user the same way as RFC931/Ident user?

   If you patch Squid with this simple diff, kindly contributed by Antony T Curtis, the authenticated user will be passed from Squid to squidGuard and the answer will be yes, otherwise no:
   

   	A useful patch to Squid 2.2STABLE which fixes per-user redirection where
   	the user is authenticated using proxy-auth...
   
   	*** src/redirect.c.orig Tue Jun 22 14:04:43 1999
   	--- src/redirect.c      Tue Jun 22 15:46:41 1999
   	***************
   	*** 103,108 ****
   	--- 103,110 ----
   	      cbdataAdd(r, cbdataXfree, 0);
   	      r->orig_url = xstrdup(http->uri);
   	      r->client_addr = conn->log_addr;
   	+     if (http->request->user_ident[0])
   	+       r->client_ident = http->request->user_ident; else
   	      if (conn->ident == NULL || *conn->ident == '\0') {
   		r->client_ident = dash_str;
   	      } else {




10. Can I manipulate domains.db and urls.db from Perl?

    Yes, but you must bind custom comparefunctions. Also note the domains are stored with a leading ".":
    

            use DB_File;
    
    	sub mirror($) {
    	  scalar(reverse(shift));
    	}
    
    	sub domainmatch($$) {
    	  my $search = mirror(lc(shift));
    	  my $found = mirror(lc(shift));
    	  if ($search . "." eq $found) {
    	    return(0);
    	  } else {
    	    return(substr($search,0,length($found)) cmp $found);
    	  }
    	}
    
    	sub urlmatch($$) {
    	  my $search = lc(shift) . "/";
    	  my $found = lc(shift) . "/";
    	  if ($search eq $found) {
    	    return(0);
    	  } else {
    	    $search = substr($search,0,length($found));
    	    return($search cmp $found);
    	  }
    	}
    
    	my (%url,%domain);
    
    	$DB_BTREE->{compare} = \&urlmatch;
    	my $url_db = tie(%url, "DB_File", "urls.db", O_CREAT|O_RDWR, 0664, $DB_BTREE)
    	|| die("urls.db: $!\n");
    
    	$DB_BTREE->{compare} = \&domainmatch;
    	my $domain_db = tie(%domain, "DB_File", "domains.db", O_CREAT|O_RDWR, 0664, $DB_BTREE)
    	|| die("domains.db: $!\n");
    
    	# Now you can operate on %url and %domain just as normal perl hashes:)
    	$domain{".playboy.com"} = "" unless(exists($domain{"playboy.com"}));
    
    	$url_db->sync;
    	$domain_db->sync;

    See the perltie(1) and DB_File(3) man pages that comes with Perl for more info.




11. How can I list domains.db or urls.db from Perl?

    Use a script like this:
    

    	#!/local/bin/perl -w
    	use strict;
    	use DB_File;
    
    	foreach (@ARGV) {
    	  my (%db, $key, $val);
    	  die("$_: $!\n") unless(-f);
    	  tie(%db, "DB_File", $_, O_RDONLY, 0664, $DB_BTREE) || die("$_: $!\n");
    	  foreach $key (keys(%db)) {
    	    if($val = $db{$key}) {
    	      $val = "\"$val\"";
    	    } else {
    	      $val = "undef";
    	    }
    	    print "$key -> $val\n";
    	  }
    	  untie(%db);
    	}

    See the perltie(1) and DB_File(3) man pages that comes with Perl for more info.

If you have questions and/or answers that should be on the FAQ list please send them to squidguard@squidguard.org