- 论坛徽章:
- 0
|
企业解决方案实践squid+squidGuard+sarg+clamav+mrtg
SquidGuard 1.2.0 compiling and installation procedure
Get the following file and save it to /usr/local/src
#wget http://ftp.teledanmark.no/pub/db/db-2.7.7.tar.gz
#wget http://ftp.teledanmark.no/pub/www/proxy/squidGuard/squidGuard-1.2.0.tar.gz
Build and install BerkeleyDB
#tar zxvf db-2.2.7.tar.gz
#cd db-2.2.7
#cd build_unix
#../dist/configure
#make
#make install
Build and Intall SquidGuard
#tar zxvf squidGuard-1.2.0.tar.gz
#cd squidGuard-1.2.0
# export LIBS="-lpthread"
#./configure --prefix=/usr/local/squidguard --datadir=/usr/share --sysconfdir=/etc/squid
--localstatedir=/var --infodir=/usr/share/info --mandir=/usr/share/man
--with-sg-config=/etc/squid/squidguard.conf --with-sg-logdir=/var/log/squidguard
--with-sg-dbhome=/usr/local/squidguard/db --with-db=/usr/local/BerkeleyDB
#make
#make install
Create the log directories and files
#mkdir /var/log/squidguard
#touch /var/log/squidguard/squidguard.log
#touch /var/log/squidguard/ads.log
#touch /var/log/squidguard/stopped.log
#chown –R squid.squid /var/log/squidguard
Set up the page to redirect users to when they're blocked:
Download a modified squidGuard.cgi file and save it to /var/www/html/cgi-bin/
#wget http://www.maynidea.com/squidguard/squidGuard.cgi
Download an “invisible” gif file and save it to /var/www/html/images/
#wget http://www.maynidea.com/squidguard/1x1.gif
Add the following lines in /etc/squid/squid.conf
redirect_program /usr/local/squid/bin/squidGuard -c /etc/squid/squidGuard.conf
redirect_children 5
Download the newest blacklists and save it to /usr/local/squidguard/db
#wget http://ftp.teledanmark.no/pub/www/proxy/squidguard/contrib/blacklists.tar.gz
#tar zxvf blacklists.tar.gz
#rm blacklists.tar.gz
Modify /etc/squid/squidGuard.conf file please refer to Appendix I;
Clam AntiVirus compiling and installation procedure
Download the following file and save it to /usr/local/src
#wget http://jaist.dl.sourceforge.net/sourceforge/clamav/clamav-0.80.tar.gz
#wget http://dazuko.org/files/dazuko-2.0.4.tar.gz
#tar xvzf clamav-0.80.tar.gz
#/usr/sbin/groupadd clamav
#/usr/sbin/useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav
#cd clamav-0.80
#./configure
#make && make install
Setting up auto-updating
#touch /var/log/clam-update.log
#chmod 600 /var/log/clam-update.log
#chown clamav /var/log/clam-update.log
Edit the configuration file in /usr/local/etc/freshclam.conf:
UpdateLogFile /var/log/clam-update.log
Add the closest mirrors database into /usr/local/etc/freshclam.conf server freshclam will attempt to download the newest virus database from.
DatabaseMirror clamav.ialfa.net
DatabaseMirror clamavdb.hostlink.com.hk
DatabaseMirror database.clamav.net
Enable On-access scanning
Copy kernel-source-2.4.20-8.i386.rpm from second disk to /usr/local/src
#rpm –ivh kernel-source-2.4.20-8.i386.rpm
#tar –xzvf dazuko-2.0.4.tar.gz
#./configure
#make
#/sbin/insmod dazuko.o
#mknod -m 600 /dev/dazuko c 254 0
#chown root:root /dev/dazuko
Protect a whole system, add the following lines to /usr/local/etc/clamd.conf
ClamukoScanOnAccess
ClamukoIncludePath /
ClamukoIncludePath /var
ClamukoIncludePath /cache1
ClamukoIncludePath /cache2
ClamukoExcludePath /proc
Add the following line to the crontab of the root users:
35 * * * * /usr/local/bin/freshclam --quiet
Squid Analysis Report Generator
Download the following file and save it to /usr/local/src
#wget http://jaist.dl.sourceforge.net/sourceforge/sarg/sarg-2.0.2.tar.gz
#tar –xzvf sarg-2.0.2.tar.gz
#cd sarg-2.0.2
#mkdir /var/www/html/sarg
#./configure --enable-sysconfdir=/etc/squid --enable-html=/var/www/html/sarg
#wget http://sarg.sourceforge.net/sarg-2.0.2-version.patch.gz
#make
#gzip -d sarg-2.0.2-version.patch.gz
#patch -p0<sarg-2.0.2-version.patch
#make install
#export LC_ALL=C
Create sarg.daily sard.weekly sarg.monthly in /usr/sbin, Please refer to Appendix II;
#chmod 755 /usr/sbin/sarg.*
Create password file for allow user authentication in User Reports using .htaccess
#/usr/bin/htpasswd -c /usr/local/sarg/passwd admin
#chmod 644 /usr/local/sarg/passwd
Install change passwd tools for User need to access User Reports
#http://jaist.dl.sourceforge.net/sourceforge/orsochpasswd/chpasswd-2.2.2.tar.gz
#tar zxvf chpasswd-2.2.2.tar.gz
#cd chpasswd-2.2.2
#./configure --enable-cgidir=/var/www/cgi-bin
#make && make install
#vi /usr/local/etc/chpasswd/chpasswd.conf
password_file /usr/local/sarg/passwd
header "Change Your Proxy Server User Access Reports Account Password"
minimum_length 7
enable_log /usr/local/etc/chpasswd/chpasswd.log
#chown apache.apache /usr/local/sarg/passwd
#touch /var/www/html/sarg/.htaccess
#vi /var/www/html/sarg/.htaccess
AuthUserFile /usr/local/sarg/passwd
AuthName "SARG, Restricted Access"
AuthType Basic
Require user admin
Create Script file to generate user reports
#mkdir /var/www/html/sarg/daily
#mkdir /var/www/html/sarg/weekly
#mkdir /var/www/html/sarg/monthly
Add the following line using crontab -e
05 0 * * * root /usr/sbin/sarg.daily
15 0 * * 1 root /usr/sbin/sarg.weekly
30 1 1 * * root /usr/sbin/sarg.monthly
Modify /etc/sarg/sarg.conf file please refer to Appendix III;
MRTG-2.10.15 compiling and installation procedure
SNMP configure
Insert the second disk and install net-snmp
#mount /dev/cdrom
#cd /mnt/cdrom/RedHat/RPMS/
#rpm –ivh net-snmp-*
#vi /etc/snmp/snmpd.conf
view mib2 included.iso.org.dod.internet.mgmt.mib-2 fc
change access notConfigGroup “” any noauth exact systemview none none
to access notConfigGroup “” any noauth exact mib2 none none
#ln –s /etc/rc.d/init.d/snmpd /etc/rc3.d/S88snmpd
Download the following file and save it to /usr/local/src
#wget http://people.ee.ethz.ch/~oetiker/webtools/mrtg/pub/mrtg-2.11.0.tar.gz
#tar xvzf mrtg-2.11.0.tar.gz
#mkdir /var/mrtg-2
# ./configure --prefix=/var/mrtg-2
--with-gd=/usr/include
--with-gd-lib=/usr/lib
--with-gd-inc=/usr/include
--with-png=/usr/include
--with-zlib=/usr/include
#make
#make install
#mkdir –p /var/www/html/mrtg/images
#cp images/*.* /var/www/html/mrtg/images/
#cd /usr/local/mrtg-2/bin
#/usr/local/mrtg-2/bin/cfgmaker --output=/usr/local/mrtg-2/bin/mrtg.cfg public@localhost
#vi /usr/local/mrtg-2/bin/mrtg.cfg
WorkDir: /var/www/html/mrtg
#/usr/local/mrtg-2/bin/indexmaker --output=/var/www/html/mrtg/index.html /usr/local/mrtg-2/bin/mrtg.cfg
Run the following command three times:
# env LANG=C /usr/local/mrtg-2/bin/mrtg /usr/local/mrtg-2/bin/mrtg.cfg
Add the following line using crontab –e:
*/5 * * * * env LANG=C /usr/local/mrtg-2/bin/mrtg /usr/local/mrtg-2/bin/mrtg.cfg
Appendix I:
/etc/squid/squidGuard.conf
dbhome /usr/local/squidguard/db/blacklists
logdir /var/log/squidguard
# DESTINATION CLASSES:
destination bl_ads {
domainlist ads/domains
urllist ads/urls
redirect http://10.160.1.114:8000/images/1x1.gif
log ads.log
}
destination bl_aggressive {
domainlist aggressive/domains
urllist aggressive/urls
redirect http://10.160.1.114:8000/cgi-bin/squidGuard.cgi?clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u
log stopped.log
}
destination bl_drugs {
domainlist drugs/domains
urllist drugs/urls
redirect http://10.160.1.114:8000/cgi-bin/squidGuard.cgi?clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u
log stopped.log
}
destination bl_gambling {
domainlist gambling/domains
urllist gambling/urls
redirect http://10.160.1.114:8000/cgi-bin/squidGuard.cgi?clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u
log stopped.log
}
destination bl_hacking {
domainlist hacking/domains
urllist hacking/urls
log stopped.log
redirect http://10.160.1.114:8000/cgi-bin/squidGuard.cgi?clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u
}
destination bl_porn {
domainlist porn/domains
urllist porn/urls
expressionlist porn/expressions
redirect http://10.160.1.114:8000/cgi-bin/squidGuard.cgi?clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u
log stopped.log
}
destination bl_violence {
domainlist violence/domains
urllist violence/urls
redirect http://10.160.1.114:8000/cgi-bin/squidGuard.cgi?clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u
log stopped.log
}
acl {
default {
pass !bl_ads !bl_aggressive !bl_drugs !bl_gambling !bl_hacking !bl_porn !bl_violence all
}
}
Appendix II:
/usr/sbin/sarg.daily
#!/bin/bash
#Get yesterday date
YESTERDAY=$(date --date "1 day ago" +%d/%m/%Y)
export LC_ALL=C
/usr/sbin/sarg -o /var/www/html/sarg/daily –f /usr/local/sarg/sarg.conf –l /var/log/squid/access.log -d $YESTERDAY >; /dev/null 2>;&1
exit 0
/usr/sbin/sarg.weekly
#!/bin/bash
#Generate Access.log for correct weekly reports
cat /var/log/squid/access.log.0 /var/log/squid/access.log >; /var/log/squid/access.log.week
#Get yesterday date
YESTERDAY=$(date --date "1 days ago" +%d/%m/%Y)
#Get one week ago date
WEEKAGO=$(date --date "7 days ago" +%d/%m/%Y)
export LC_ALL=C
/usr/sbin/sarg -l /var/log/squid/access.log.week -o /var/www/html/sarg/weekly –f /usr/local/sarg/sarg.conf -d $WEEKAGO-$YESTERDAY >; /dev/null 2>;&1
exit 0
/usr/sbin/sarg.monthly
#!/bin/bash
#Get yesterday date
YESTERDAY=$(date --date "1 day ago" +%d/%m/%Y)
#Get 1 month ago date
MONTHAGO=$(date --date "1 month ago" +%d/%m/%Y)
export LC_ALL=C
/usr/sbin/sarg –l /var/log/squid/access.log -o /var/www/html/sarg/monthly –f /usr/local/sarg/sarg.conf -d $MONTHAGO-$YESTERDAY >; /dev/null 2>;&1
/etc/rc.d/init.d/squid -k rotate
exit 0
Appendix III:
/usr/local/sarg/sarg.conf
title "Company Name. Proxy Server User Access Reports"
temporary_dir /tmp
records_without_userid ignore
use_comma yes
topsites_num 100
max_elapsed 28800000
report_type topsites users_sites date_time denied auth_failures site_user_time_date
topuser_num 0
displayed_values abbreviation
authfail_report_limit 50
denied_report_limit 50
#siteusers_report_limit 0
squidguard_report_limit 50
user_report_limit 50
download_suffix "zip,arj,iso,cab,com,mdb,exe,mp3,avi,mpg,mpeg,ZIP,RAR,EXE,ARJ,CAB,MDB,MP3,AVI,MPG,MPEG" |
|
免费注册
发表于 2005-01-18 17:56
ROXY 10.160.1.114:8080";
发表于 2005-01-23 18:26
