Guys,
I'm having a bit of a 'mare with Dansguardian. I want to run dansguardian integrated with Squid, and as far as it goes, that works just great. If I browse to www.bbc.co.uk, I get the page I request, when I try to browse to www.playboy.com, I get an appropriate block message. However, when I try to make the integration between Dansguardian and ClamAV work, I get a problem.

If I try to go to the EICAR page and download a test virus, its clear that the virus is detected by ClamAV. Instead of getting the file downloaded, or the normal block page, it tries to go to http://yourserver.yourdomain/cgi-bin.../eicar.com.txt
which of course doesn't work because yoursever.yourdomain doesn't resolve to anything, so I get an error from Squid (Can't find the webpage, which is correct, as far as it goes).

OK, you may suggest I look in dansguardian.conf, and adjust the line where it says:
accessdeniedaddress ='http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl'
to indicate a proper address so I tried that, but it doesn't make any difference, I still get the same behaviour.

I found some hints....the file dansguardian.conf is looking for "YOURSERVER.YOURDOMAIN" (upper Case) before you change it to a proper name/address, but the browser output indicates "yourserver.yourdomain" (lower case), so the URL that Dansguardian is feeding to squid, (and squid is failing to find) is clearly not coming from the dansguardian.conf file.

I can replicate this on both the latest, fully patched Ubuntu or Debian.

If I could just find where in DansGuardian that the "yourserver.yourdomain" configuration is located, I may be able to make progress, but I can't find it despite significant time looking, and I've run Google thin looking!

any suggestions?

Cheers

I'm not sure if your logic is correct. If I browse to

http://ww1.SDJSD.com/

I'm told that

http://ww1.sdjsd.com/

doesn't exist, so perhaps firefox's fingers just don't reach the shift key.

I see your point, but when I change the "YOURSERVER.YOURDOMAIN" to "192.168.123.88" (the private network address of my server), the URL that DansGuardian is asking Squid to get when DansGuardian has detected a virus in the download is still "yourserver.yourdomain", thus proving that the field in dansguardian.conf is nor being applied (and yes, I did restart Dansguardian )

How about

(substitute correct path in place of /etc/dansguardian as necessary)

You suggested I try:

find /etc/dansguardian -type f | xargs grep yourserver

Sorry...I'm having a "blond" moment! Not sure what you're trying to achieve with this...can you spell it out, its been a long day!

Cheers
JB

search the dansguardian files for the text "yourserver" to see where it's configured. No idea what directory to start in though (ie, I doubt /etc/dansguardian is the right place)

The problem turned out to be my stupidity! I was building and testing this setup behind a bastion device also running Squid and DG. Do the thing on the inside of the firewall, but not behind Squid/DG...works fine! D'Oh!

Thanks for all suggestions