e2guardian 3.4.0.3 Fails To Build Completely On Raspbian Jessie Lite 2016-03-18

[William Rusch]

e2guardian 3.4.0.3 fails to build completely on Raspbian Jessie Lite 2016-03-18.

Extracted e2guardian_3.4.0.3_wheezy-jessie_amd64.deb file listing to learn what
files will be installed in respective locations with a correct build/installation.

Followed instructions given in the INSTALL file for Debian, since Raspbian Jessie is
based upon Debian 8.

Observed following files are not created during build:
/usr/lib/cgi-bin/e2guardian.pl
/usr/share/lintian/overrides/e2guardian
/etc/init.d/e2guardian
/etc/logrotate.d/e2guardian
/run/systemd/generator.late/e2guardian.service

I've attached config.log. Suspect I'm missing something that will be obvious to
others.

Appreciate any guidance.

Thanks - Bill

[FredB]

Did you follow this https://github.com/e2guardian/e2guardian/blob/master/INSTALL#L262 ?

[William Rusch]

Thanks for speedy reply. Yes, I confirmed that all the all the Build-Depends were in place along with Other packages related and Other packages suggests. Changes I made were installing gawk and bzip2 (to get libbz2). Squid, clamav and clamav-freshclam are already installed. Will check everything again before another build attempt. I copy and pasted the ./autogen.sh && ./configure line verbatim.

[William Rusch]

Compiled source on Debian Live 8.3 Standard installation. Seems to have compiled without major issues.

Compared installed package list between Debian Live 8.3 Standard with INSTALL file's
DEBIAN Build-Depends to Raspbian Jessie Lite 2016-03-18 with INSTALL file's DEBIAN Build-Depends.

Rapbian Jessie Lite needs following packages installed which are not mentioned in INSTALL file's
DEBIAN Build-Depends: bison, flex, help2man and linux-headers.

Both system's compiles complained about configure not supporting '--enable-locallists=yes'.

Raspbian's gcc 4.9.2 had errors for gcc/g++ unrecognized command line options:
'-V' '-qversion'

Also, there is an issue with confdefs.h - fatal errors about ac_nonexistent.h and vfork.h not being found.
The compile then terminates.

Attached is newer config.log.

Appreciate any hints or guidance as how this can be resolved would be welcomed.

Thanks - Bill

On Friday, April 1, 2016 at 9:10:30 AM UTC-5, William Rusch wrote:

[FredB]

Both system's compiles complained about configure not supporting '--enable-locallists=yes'.

Yes, mistake in documentation, fixed now

Raspbian's gcc 4.9.2 had errors for gcc/g++ unrecognized command line options:
'-V' '-qversion'

Observed following files are not created during build:
/usr/lib/cgi-bin/e2guardian.pl
/usr/share/lintian/overrides/e2guardian
/etc/init.d/e2guardian
/etc/logrotate.d/e2guardian
/run/systemd/generator.late/e2guardian.service

Created here (pi2/jessie) , maybe you mean installed with "make install" ?
Now I have a binary (no tested) and files

e2guardian -v
e2guardian 3.4.0.3

Built with:  '--prefix=/usr' '--enable-clamd=yes' '--with-proxyuser=e2guardian' '--with-proxygroup=e2guardian' '--sysconfdir=/etc' '--localstatedir=/var' '--enable-icap=yes' '--enable-commandline=yes' '--enable-email=yes' '--enable-ntlm=yes' '--enable-trickledm=yes' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' 'CXXFLAGS=-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security' 'LDFLAGS=-Wl,-z,relro' 'CPPFLAGS=-D_FORTIFY_SOURCE=2' 'CFLAGS=-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security' '--enable-pcre=yes' '--with-filedescriptors=8192' '--enable-sslmitm=yes'

I agree that we should take a look at "make install" it is old and I'm not sure it works with Debian Jessie ..

[FredB]

> I agree that we should take a look at "make install" it is old and I'm
> not sure it works with Debian Jessie ..

> --

But as far as I known e2guardian and Raspbian seem compatible without
problem although "make install" is broken, all the files are generated
but not installed (I guess that the problem is the same on Linux Debian
and maybe others ...)

[William Rusch]

Thanks again for quick response. Combing through the config.log, it appears that the fatal errors about vfork.h and ac_nonexistent.h may not really be fatal to the build. I may actually have a viable build. Had to recompile with '--with-filedescriptors=8192' changed to '--with-filedescriptors=1024' as Raspbian doesn't support anything larger than that. Then ran e2guardian again, it failed to start with complaints about user and group e2guardian not being found. Have fixed that and will do further testing in next day or so. Will update post with I learn.

[William Rusch]

Resolved /var/log/e2guardian ownership issue. e2guardian now starts with no errors and stays up running. When using Firefox and setting browser to proxy server's ip address using port 8080 I get this message "The proxy server is refusing connections". Any guidance on deeper debugging would be appreciated. Logs created in /var/log/e2guardian are access.log (which has file size of 0) and dstats.log which doesn't seem to be very verbose. Thanks

[FredB]

A proxy, like squid, is needed and it must allow local requests from E2guardian.
Do you have some messages from your proxy logs ? Perhaps 407 code ?

Sent from my ASUS

-------- Message d'origine --------
De :William Rusch
Envoyé :Sat, 09 Apr 2016 04:00:10 +0200
À :e2guardian
Sujet :Re: e2guardian 3.4.0.3 Fails To Build Completely On Raspbian Jessie Lite 2016-03-18

--
You received this message because you are subscribed to the Google Groups "e2guardian" group.
To unsubscribe from this group and stop receiving emails from it, send an email to e2guardian+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[William Rusch]

Sorry for delay in responding, busy weekend. Yes, squid is installed and running. But checking my notes, I caught minor configuration changes missed for shorewall and squid. Those issues are now resolved giving me squid running transparently. Will update again when I attempt e2guardian.

[William Rusch]

Confirmed that squid logs (access.log and cache.log) located in /var/log/squid3 are actively being written to and I can surf web without issue. Start e2guardian without issues and shows multiple processes running. As before when I point client Firefox browser to proxy server's ip address at port 8080 I still get earlier message "The proxy server is refusing connections". The e2guardian config file /etc/e2guardian/e2guardian.conf is left at proxyport = 3128. Will pick up later as I'm currently running out of ideas.

[FredB]

I guess you have a 407 code in squid logs
Allow e2guardian (127.0.0.1 perhaps ? or the local address) is needed in squid.conf

# Local network allowed
Local network -> Squid (Listen IP)

# Local network allowed but not E2 > 407 code
Local network -> E2guardian (listen IP) -> Squid (Listen IP)

[William Rusch]

Double checked the squid logs via grep command. No matches on 407 code, but the cache.log has many lines that repeat as follows: "2016/04/12 21:51:59 kid1| ERROR: No forward-proxy ports configured". Maybe this is the issue or possibly more configuration is needed on shorewall. Will research and try more changes tomorrow. Enabling acl localhost src 127.0.0.1 in squid.conf with squid restart had no effect on resolving issue.

[FredB]

Le 13/04/2016 04:56, William Rusch a écrit :
> Double checked the squid logs via grep command. No matches on 407
> code, but the cache.log has many lines that repeat as follows:
> "2016/04/12 21:51:59 kid1| ERROR: No forward-proxy ports configured".
> Maybe this is the issue or

Ho, you are using transparent proxy ? no 407 but there is something in
access.log for each request ?
http://wiki.squid-cache.org/KnowledgeBase/NoForwardProxyPorts

> possibly more configuration is needed on shorewall. Will research and
> try more changes tomorrow. Enabling acl localhost src 127.0.0.1 in
> squid.conf with squid restart had no effect on resolving issue.
>

Right, I guess there is something wrong, a trace with tcpudmp is needed

FYI e2guardian can make SSLMITM in transparent mode
Are you testing HTTP or HTTPS ?

[FredB]

FYI e2guardian can't make SSLMITM in transparent mode

[William Rusch]

Learned that for Squid 3 that intercepting should be used instead of transparent (Squid 2).
Made that change - situation didn't improve.

I have only tested http sites only.

When I get "The proxy server is refusing connections" on test computer
configured for e2guardian (IP: 192.168.2.254 Port:8080) squid's access log
stops recording any entries for that computer. But other computers on the
network which are not configured for e2guardian (IP: 192.168.2.254 Port:8080)
still are able to surf the web without issues just squid in intercepting (transparent)
mode. Note: It makes no difference for the above message, if the browser is
firefox or chrome.

I will look at doing a trace and/or tcpdump this weekend, if I can fit it in.

[William Rusch]

Attached are the uncommented lines from squid.conf and e2guardian.conf. Maybe this will be of value.

[FredB]

I saw nothing strange here, can you just make a test with proxyip =
192.168.2.254 and perhaps also make a try with this new package
https://github.com/e2guardian/e2guardian/releases/download/v3.4.0.3/e2guardian_3.4.0.3_wheezy-jessie_armhf.deb

[William Rusch]

Thanks for confirming that the files look normal. Also, appreciate you creating a package for me to test with. Made change to /etc/e2guardian/e2guardian.conf file, same error. Then manually removed all traces of the locally compiled e2guardian. Rebooted system. Installed your package. Here is sequence of events.

- Installing package:

root@brandmauer:/home/pi# dpkg --install e2guardian_3.4.0.3_wheezy-jessie_armhf.deb
Selecting previously unselected package e2guardian.
(Reading database ... 46688 files and directories currently installed.)
Preparing to unpack e2guardian_3.4.0.3_wheezy-jessie_armhf.deb ...
Unpacking e2guardian (3.4.0.3) ...
Setting up e2guardian (3.4.0.3) ...
Adding system user `e2guardian' (UID 111) ...
Adding new group `e2guardian' (GID 116) ...
Adding new user `e2guardian' (UID 111) with group `e2guardian' ...
Creating home directory `/var/log/e2guardian' ...

Job for e2guardian.service failed. See 'systemctl status e2guardian.service' and 'journalctl -xn' for details.
invoke-rc.d: initscript e2guardian, action "start" failed.
WARNING: Starting e2guardian failed. Please check your configuration.
Synchronizing state for e2guardian.service with sysvinit using update-rc.d...
Executing /usr/sbin/update-rc.d e2guardian defaults
Executing /usr/sbin/update-rc.d e2guardian enable
Processing triggers for systemd (215-17+deb8u4) ...
root@brandmauer:/home/pi#

- Checking systemctl status:

root@brandmauer:/home/pi# systemctl -l status e2guardian.service
● e2guardian.service - E2guardian Web filtering
   Loaded: loaded (/etc/systemd/system/e2guardian.service; enabled)
   Active: failed (Result: exit-code) since Sun 2016-04-17 08:20:48 CDT; 2min 47s ago
 Main PID: 6451 (code=exited, status=0/SUCCESS)

Apr 17 08:20:48 brandmauer e2guardian[11863]: Error binding ipc server file (try using the SysV to stop e2guardian then try starting it again or doing an 'rm /tmp/.e2guardianipc').
Apr 17 08:20:48 brandmauer e2guardian[11863]: Error binding ipc server file (try using the SysV to stop e2guardian then try starting it again or doing an 'rm /tmp/.e2guardianipc').
Apr 17 08:20:48 brandmauer e2guardian[11863]: Exiting with error
Apr 17 08:20:48 brandmauer e2guardian[11863]: Exiting with error
Apr 17 08:20:48 brandmauer systemd[1]: e2guardian.service: control process exited, code=exited status=1
Apr 17 08:20:48 brandmauer systemd[1]: Failed to start E2guardian Web filtering.
Apr 17 08:20:48 brandmauer systemd[1]: Unit e2guardian.service entered failed state.

- Corrective action:

root@brandmauer:~# rm /tmp/.e2guardianipc

- Second start attempt:

root@brandmauer:~# e2guardian
Error binding urllistsock server file (try using the SysV to stop e2guardian then try starting it again or doing an 'rm /tmp/.e2guardianurlipc').
Exiting with error

Note-> I made no changes to e2guardian configuration files in your package. Let know, if you still wish me to do tcpdump.

[FredB]

- Corrective action:

root@brandmauer:~# rm /tmp/.e2guardianipc

- Second start attempt:

root@brandmauer:~# e2guardian
Error binding urllistsock server file (try using the SysV to stop e2guardian then try starting it again or doing an 'rm /tmp/.e2guardianurlipc').
Exiting with error

rm /tmp/.e2guardianurlipc

Please remove all files, like this rm /tmp/.e2guardia*

And try:

service e2guardian restart
Or
/etc/init.d/e2guardian restart

[William Rusch]

Thanks much. I was able to get e2guardian to start up without issues. But still getting "The proxy server is refusing connections" message.  Maybe the issue is shorewall, I've searched their mailing list archive. All hints their mailing list gives on getting shorewall to work with dansguardian fail with the current version of shorewall. I assume your configuration and testing is done with iptable configuration?

[FredB]

Yes, I guess there is a problem with shorewall

My advice
Make a try without shorewall\iptable with a browser proxy manually configured

You can also try something like this

Connect to your rasp

export http_proxy=http://127.0.0.1:8080 (8080 = e2 port)
wget http://e2guardian.org

[William Rusch]

Disabling Shorewall and changing /etc/e2guardian/e2guardian.conf
as follows:
filterip = 127.0.0.1
proxyport = 8080
proxyip = 127.0.0.1
proxyport = 8080

export http_proxy=http://127.0.0.1:8080
wget http://e2guardian.org

Gives me:

--2016-04-20 21:29:40--  http://e2guardian.org/
Connecting to 127.0.0.1:8080... connected.
Proxy request sent, awaiting response... No data received.
Retrying.

That repeats after timeout.

Manually configured browser with above settings gives

"The proxy server is refusing connections" message.

Searched the Shorewall archives and found a posting from
Chuck Kollars (2008/01/04) giving working configuration
settings for Shorewall/Squid/Dansguardian. Tried those
settings and get same result with message as above. I will
post to Shorwall list.

[cool...@gmail.com]

Hi,

I also run Squid3 + e2Guardian on a Raspberry Pi 2.
I'm not using Raspbian Jessie but a stock version of Debian Jessie (bootstrapped with the kernel from Raspbian)

Here's my Squid3 config:
visible_hostname host.domain.com # need modification!
access_log stdio:/var/log/squid3/access.log
cache_log /var/log/squid3/cache.log
coredump_dir /var/cache/squid
acl localnet src 10.0.0.0/8 # Allow all local networks addresses...
acl localnet src 172.16.0.0/12 # Just pickup one or use them all!
acl localnet src 192.168.0.0/16 #
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
cache_dir ufs /var/spool/squid3 500 16 256
cache_mem 256 MB
dns_nameservers 127.0.0.1 # need modification!
shutdown_lifetime 3 seconds

For e2Guardian, you can download the package that I've made which is available here: https://github.com/e2guardian/e2guardian/releases/download/v3.4.0.3/e2guardian_3.4.0.3_wheezy-jessie_armhf.deb
It should be compatible with Raspbian.

[William Rusch]

Hi:

Discovered the solution after picking up research on this again via various mailing lists. Never was able to get Shorewall's author to respond on their mailing list.

Here's how to configure Shorewall /etc/shorewall/rules file to work with Squid and E2Guardian defaults. Append the last five lines shown.

#
#ACTION        SOURCE        DEST        PROTO        DEST PORT(S)     SOURCE     ORIGINAL
#   

#
#       Redirect browser traffic to E2Guardian content filtering.
#
ACCEPT        $FW              net             tcp               www
REDIRECT     loc                 8080          tcp               www 


With this configuration there is no need to set client browsers to a proxy port number.

Thanks to everyone who took time to reply.