From 85e8988f685fa12327d6970cba2c1a5b7acf6a5d Mon Sep 17 00:00:00 2001 From: Marcello Coutinho Date: Thu, 15 Mar 2012 18:46:09 -0300 Subject: dansguardian - version 0.1.5 with fixes and ldap group based authentication --- config/dansguardian/dansguardian.conf.template | 2 +- config/dansguardian/dansguardian.inc | 63 ++++++-- config/dansguardian/dansguardian.xml | 14 ++ config/dansguardian/dansguardian_about.php | 1 + config/dansguardian/dansguardian_blacklist.xml | 4 + config/dansguardian/dansguardian_config.xml | 8 +- config/dansguardian/dansguardian_groups.xml | 31 +++- config/dansguardian/dansguardian_ips_header.xml | 4 + config/dansguardian/dansguardian_ldap.php | 148 +++++++++++++++++++ config/dansguardian/dansguardian_ldap.xml | 171 ++++++++++++++++++++++ config/dansguardian/dansguardian_limits.xml | 4 + config/dansguardian/dansguardian_log.xml | 4 + config/dansguardian/dansguardian_sync.xml | 4 + config/dansguardian/dansguardian_users_header.xml | 4 + config/dansguardian/dansguardianfx.conf.template | 2 +- 15 files changed, 444 insertions(+), 20 deletions(-) create mode 100644 config/dansguardian/dansguardian_ldap.php create mode 100755 config/dansguardian/dansguardian_ldap.xml (limited to 'config/dansguardian') diff --git a/config/dansguardian/dansguardian.conf.template b/config/dansguardian/dansguardian.conf.template index 5bee053e..27099332 100755 --- a/config/dansguardian/dansguardian.conf.template +++ b/config/dansguardian/dansguardian.conf.template @@ -680,7 +680,7 @@ softrestart = {$softrestart} #SSL certificate checking path #Path to CA certificates used to validate the certificates of https sites. -sslcertificatepath = '/etc/ssl/certs/' +sslcertificatepath = '/usr/local/share/certs/' #SSL man in the middle #CA certificate path diff --git a/config/dansguardian/dansguardian.inc b/config/dansguardian/dansguardian.inc index 6c6d6e93..a568b69e 100755 --- a/config/dansguardian/dansguardian.inc +++ b/config/dansguardian/dansguardian.inc @@ -215,27 +215,30 @@ function sync_package_dansguardian() { $load_samples=0; #ssl men-in-the-middle feature - $dirs=array($dansguardian_dir."/ssl",$dansguardian_dir."/ssl/generatedcerts",$dansguardian_dir."/ssl/generatedlinks"); + $dirs=array("/var/log/dansguardian/stats","/etc/ssl/demoCA","/etc/ssl/demoCA/private","/etc/ssl/demoCA/crl","/etc/ssl/demoCA/certs",$dansguardian_dir."/ssl/generatedcerts",$dansguardian_dir."/ssl/generatedlinks"); foreach ($dirs as $dir) if (!is_dir($dir)) - mkdir ($dir,0700,true); - $ca_cert = lookup_ca($dansguardian_config["ca"][0]); + mkdir ($dir,0755,true); + $ca_cert = lookup_ca($dansguardian_config["dca"]); if ($ca_cert != false) { if(base64_decode($ca_cert['prv'])) { - file_put_contents($dansguardian_dir. "/ssl/ssl_ca_key.pem",base64_decode($ca_cert['prv'])); - $ca_pk = "caprivatekeypath = ".$dansguardian_dir . "/ssl/ssl_ca_key.pem"; + file_put_contents("/etc/ssl/demoCA/private/cakey.pem",base64_decode($ca_cert['prv'])); + $ca_pk = "caprivatekeypath = '/etc/ssl/demoCA/private/cakey.pem'"; } if(base64_decode($ca_cert['crt'])) { - file_put_contents($dansguardian_dir . "/ssl/ssl_ca_cert.pem",base64_decode($ca_cert['crt'])); - $ca_pem = "cacertificatepath = ".$dansguardian_dir . "/ssl/ssl_ca_cert.pem"; - $generatedcertpath= "generatedcertpath = ".$dansguardian_dir . "/ssl/generatedcerts"; - $generatedlinkpath= "generatedlinkpath = ".$dansguardian_dir . "/ssl/generatedlinks"; + file_put_contents("/etc/ssl/demoCA/cacert.pem",base64_decode($ca_cert['crt'])); + exec("/usr/bin/openssl x509 -hash -noout -in /etc/ssl/demoCA/cacert.pem",$cert_hash); + file_put_contents("/usr/local/share/certs/".$cert_hash[0].".0",base64_decode($ca_cert['crt'])); + $ca_pem = "cacertificatepath = '/etc/ssl/demoCA/cacert.pem'"; + $generatedcertpath= "generatedcertpath = '/etc/ssl/demoCA/certs/'"; + #generatedcertpath = ".$dansguardian_dir . "/ssl/generatedcerts"; + $generatedlinkpath= "generatedlinkpath = '".$dansguardian_dir . "/ssl/generatedlinks'"; } - $svr_cert = lookup_cert($dansguardian_config["cert"][0]); + $svr_cert = lookup_cert($dansguardian_config["dcert"]); if ($svr_cert != false) { if(base64_decode($svr_cert['prv'])) { - file_put_contents($dansguardian_dir . "/ssl/ssl_server_key.pem",base64_decode($svr_cert['prv'])."\n".base64_decode($svr_cert['crt'])); - $cert_key = "certprivatekeypath = ".$dansguardian_dir . '/ssl/ssl_server_key.pem'; + file_put_contents("/etc/ssl/demoCA/private/serverkey.pem",base64_decode($svr_cert['prv'])); + $cert_key = "certprivatekeypath = '/etc/ssl/demoCA/private/serverkey.pem' "; } } } @@ -796,7 +799,7 @@ EOF; $cron_found=0; if (is_array($config['cron']['item'])) foreach($config['cron']['item'] as $cron) - if (!preg_match("/usr.local.(bin.freshclam|www.dansguardian.php)/",$cron["command"])){ + if (!preg_match("/usr.local.(bin.freshclam|www.dansguardian)/",$cron["command"])){ $cron_found++; $new_cron['item'][]=$cron; } @@ -875,7 +878,32 @@ EOF; break; } - + $cron_cmd="/usr/local/bin/php /usr/local/www/dansguardian_ldap.php"; + if (is_array($config['installedpackages']['dansguardiangroups']['config'])) + foreach ($config['installedpackages']['dansguardiangroups']['config'] as $dansguardian_groups){ + if(preg_match('/(\d+)m/',$dansguardian_groups['freq'],$matches)){ + $new_cron['item'][]=array( "minute" => "*/".$matches[1], + "hour" => "*", + "mday" => "*", + "month" => "*", + "wday" => "*", + "who" => "root", + "command"=> $cron_cmd." ".$dansguardian_groups['name']); + $config['cron']=$new_cron; + $cron_found++; + } + if(preg_match('/(\d+)h/',$dansguardian_groups['freq'],$matches)){ + $new_cron['item'][]=array( "minute" => "0", + "hour" => "*/".$matches[1], + "mday" => "*", + "month" => "*", + "wday" => "*", + "who" => "root", + "command"=> $cron_cmd." ".$dansguardian_groups['name']); + $config['cron']=$new_cron; + $cron_found++; + } + } #write files conf_mount_rw(); @@ -997,7 +1025,10 @@ function dansguardian_validate_input($post, &$input_errors) { $input_errors[] = "{$value} cannot be used as name."; else if ($key == "name" && preg_match("/\W/",$value)) $input_errors[] = "{$value} cannot be used as name. Use only a-z 0-9 characters"; - + else if (empty($value)) + continue; + else if($key == "freq" && (!preg_match("/^\d+(h|m|d)$/",$value) || $value == 0)) + $input_errors[] = "A valid number with a time reference is required for the field 'Update Frequency'"; } } @@ -1045,6 +1076,8 @@ function dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type) { $xml['dansguardian'] = $config['installedpackages']['dansguardian']; $xml['dansguardianantivirusacl'] = $config['installedpackages']['dansguardianantivirusacl']; $xml['dansguardianconfig'] = $config['installedpackages']['dansguardianconfig']; + $xml['dansguardianblacklist'] = $config['installedpackages']['dansguardianblacklist']; + $xml['dansguardianldap'] = $config['installedpackages']['dansguardianldap']; $xml['dansguardiancontentacl'] = $config['installedpackages']['dansguardiancontentacl']; $xml['dansguardianfileacl'] = $config['installedpackages']['dansguardianfileacl']; $xml['dansguardiangroups'] = $config['installedpackages']['dansguardiangroups']; diff --git a/config/dansguardian/dansguardian.xml b/config/dansguardian/dansguardian.xml index 41f2a447..1188796c 100644 --- a/config/dansguardian/dansguardian.xml +++ b/config/dansguardian/dansguardian.xml @@ -68,6 +68,16 @@ /usr/local/www/ 0755 + + http://www.pfsense.org/packages/config/dansguardian/dansguardian_ldap.php + /usr/local/www/ + 0755 + + + http://www.pfsense.org/packages/config/dansguardian/dansguardian_ldap.xml + /usr/local/pkg/ + 0755 + http://www.pfsense.org/packages/config/dansguardian/dansguardian_limits.xml /usr/local/pkg/ @@ -200,6 +210,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml diff --git a/config/dansguardian/dansguardian_about.php b/config/dansguardian/dansguardian_about.php index f9c9e260..49359472 100755 --- a/config/dansguardian/dansguardian_about.php +++ b/config/dansguardian/dansguardian_about.php @@ -57,6 +57,7 @@ include("head.inc"); $tab_array[] = array(gettext("Limits"), false, "/pkg_edit.php?xml=dansguardian_limits.xml&id=0"); $tab_array[] = array(gettext("Blacklist"), false, "/pkg_edit.php?xml=dansguardian_blacklist.xml&id=0"); $tab_array[] = array(gettext("Access Lists"), false, "/pkg_edit.php?xml=dansguardian_antivirus.xml&id=0"); + $tab_array[] = array(gettext("LDAP"), false, "/pkg.php?xml=dansguardian_ldap.xml&id=0"); $tab_array[] = array(gettext("Groups"), false, "/pkg.php?xml=dansguardian_groups.xml&id=0"); $tab_array[] = array(gettext("Users"), false, "/pkg.php?xml=dansguardian_users.xml&id=0"); $tab_array[] = array(gettext("IPs"), false, "/pkg.php?xml=dansguardian_ips.xml&id=0"); diff --git a/config/dansguardian/dansguardian_blacklist.xml b/config/dansguardian/dansguardian_blacklist.xml index a8895342..d95558e6 100644 --- a/config/dansguardian/dansguardian_blacklist.xml +++ b/config/dansguardian/dansguardian_blacklist.xml @@ -68,6 +68,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml diff --git a/config/dansguardian/dansguardian_config.xml b/config/dansguardian/dansguardian_config.xml index 11a34434..6016d80f 100644 --- a/config/dansguardian/dansguardian_config.xml +++ b/config/dansguardian/dansguardian_config.xml @@ -68,6 +68,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml @@ -198,7 +202,7 @@ CA - ca + dca To create a CA on pfsense, go to system -> Cert Manager]]> select_source @@ -208,7 +212,7 @@ Cert - cert + dcert To create a Certificate on pfsense, go to system -> Cert Manager]]> select_source diff --git a/config/dansguardian/dansguardian_groups.xml b/config/dansguardian/dansguardian_groups.xml index 4849126d..baa9b44a 100755 --- a/config/dansguardian/dansguardian_groups.xml +++ b/config/dansguardian/dansguardian_groups.xml @@ -66,6 +66,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml @@ -148,7 +152,6 @@ 10 - Pics picsacl @@ -328,6 +331,32 @@ input 10 + + LDAP + listtopic + + + LDAP + ldap + + The group must has the same name in dansguardian and on active directory
+ This is not aplicable for default group]]> + select_source + 05 + + + dc + dc + + + Update frequency + freq + + Valid options are minutes(m), hours(h)
+ Sample: To update every two minute, use 2m]]> + input + 05 + dansguardian_php_install_command(); diff --git a/config/dansguardian/dansguardian_ips_header.xml b/config/dansguardian/dansguardian_ips_header.xml index 2029fabf..33e50332 100644 --- a/config/dansguardian/dansguardian_ips_header.xml +++ b/config/dansguardian/dansguardian_ips_header.xml @@ -66,6 +66,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml diff --git a/config/dansguardian/dansguardian_ldap.php b/config/dansguardian/dansguardian_ldap.php new file mode 100644 index 00000000..79a6b21a --- /dev/null +++ b/config/dansguardian/dansguardian_ldap.php @@ -0,0 +1,148 @@ +#!/usr/local/bin/php -f + $value) { + $result[$key] = $value; + } + return $result; +} + +function get_ldap_members($group,$user,$password) { + global $ldap_host; + global $ldap_dn; + $LDAPFieldsToFind = array("member"); + $ldap = ldap_connect($ldap_host) or die("Could not connect to LDAP"); + + // OPTIONS TO AD + ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION,3); + ldap_set_option($ldap, LDAP_OPT_REFERRALS,0); + + ldap_bind($ldap, $user, $password) or die("Could not bind to LDAP"); + + $results = ldap_search($ldap,$ldap_dn,"cn=" . $group,$LDAPFieldsToFind); + + $member_list = ldap_get_entries($ldap, $results); + $group_member_details = array(); + if (is_array($member_list[0])) + foreach($member_list[0] as $list) + if (is_array($list)) + foreach($list as $member) { + $member_dn = explode_dn($member); + $member_cn = str_replace("CN=","",$member_dn[0]); + $member_search = ldap_search($ldap, $ldap_dn, "(CN=" . $member_cn . ")"); + $member_details = ldap_get_entries($ldap, $member_search); + $group_member_details[] = array($member_details[0]['samaccountname'][0], + $member_details[0]['displayname'][0]); + } + ldap_close($ldap); + array_shift($group_member_details); + return $group_member_details; + ldap_unbind($ldap); +} + +// Read Pfsense config +global $config,$g; + +#mount filesystem writable +conf_mount_rw(); + +$id=0; +$apply_config=0; +if (is_array($config['installedpackages']['dansguardiangroups']['config'])) + foreach($config['installedpackages']['dansguardiangroups']['config'] as $group) { + #ignore default group + if ($id > 1) + if ($argv[1] == "" || $argv[1] == $group['name']){ + $members=""; + $ldap_servers= explode (',',$group['ldap']); + echo "Group : " . $group['name']."\n"; + if (is_array($config['installedpackages']['dansguardianldap']['config'])) + foreach ($config['installedpackages']['dansguardianldap']['config'] as $server){ + if (in_array($server['dc'],$ldap_servers)){ + $ldap_dn = $server['dn']; + $ldap_host=$server['dc']; + $result = get_ldap_members($group['name'],$server['username'].','.$server['dn'],$server['password']); + foreach($result as $key => $value) { + if (preg_match ("/\w+/",$value[0])){ + #var_dump($value); + $name= preg_replace('/[^(\x20-\x7F)]*/','', $value[1]); + $pattern[0]="/USER/"; + $pattern[1]="/,/"; + $pattern[2]="/NAME/"; + $replace[0]=$value[0]; + $replace[1]="\n"; + $replace[2]="$name"; + $members .= preg_replace($pattern,$replace,$server['mask'])."\n"; + } + } + } + } + if (!empty($members)){ + $import_users = explode("\n", $members); + asort($import_users); + $members=base64_encode(implode("\n", $import_users)); + if($config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] != $members){ + $config['installedpackages']['dansguardianusers']['config'][0][strtolower($group['name'])] = $members; + $apply_config++; + } + } + } + $id++; + } +if ($apply_config > 0){ + print "user list from LDAP is different from current group, applying new configuration..."; + write_config(); + include("/usr/local/pkg/dansguardian.inc"); + sync_package_dansguardian(); + print "done\n"; +} + +#mount filesystem read-only +conf_mount_ro(); + +?> \ No newline at end of file diff --git a/config/dansguardian/dansguardian_ldap.xml b/config/dansguardian/dansguardian_ldap.xml new file mode 100755 index 00000000..3411f483 --- /dev/null +++ b/config/dansguardian/dansguardian_ldap.xml @@ -0,0 +1,171 @@ + + + + + + + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + dansguardianldap + 1.0 + Services: Dansguardian + /usr/local/pkg/dansguardian.inc + + + Daemon + /pkg_edit.php?xml=dansguardian.xml&id=0 + + + General + /pkg_edit.php?xml=dansguardian_config.xml&id=0 + + + Limits + /pkg_edit.php?xml=dansguardian_limits.xml&id=0 + + + Blacklist + /pkg_edit.php?xml=dansguardian_blacklist.xml&id=0 + + + Access Lists + /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + + + + Groups + /pkg.php?xml=dansguardian_groups.xml + + + Users + /pkg_edit.php?xml=dansguardian_users.xml + + + IPs + /pkg_edit.php?xml=dansguardian_ips.xml + + + Report and log + /pkg_edit.php?xml=dansguardian_log.xml&id=0 + + + XMLRPC Sync + /pkg_edit.php?xml=dansguardian_sync.xml&id=0 + + + Help + /dansguardian_about.php + + + + + hostname + dc + + + domain + dn + + + + username + username + + + + + Ldap configuration + listtopic + + + Hostname + dc1.mysite.com]]> + dc + input + 25 + + + Domain + dc=mysite,dc=com]]> + dn + input + 25 + + + Username + cn=antispam,cn=Users]]> + username + input + 25 + + + Password + + password + password + 10 + + + mask + Apply prefix or sufix any info to username extracted.
+ use "," if you need more than one mask for each user
+ domain\USER #NAME,USER@MYDOMAIN.COM
+ NAME shows user name
+ USER shows user login
]]> + mask + input + 50 + + + + dansguardian_php_install_command(); + + + dansguardian_php_deinstall_command(); + + + dansguardian_validate_input($_POST, &$input_errors); + + + sync_package_dansguardian(); + + \ No newline at end of file diff --git a/config/dansguardian/dansguardian_limits.xml b/config/dansguardian/dansguardian_limits.xml index eef24d52..4974bc7d 100644 --- a/config/dansguardian/dansguardian_limits.xml +++ b/config/dansguardian/dansguardian_limits.xml @@ -68,6 +68,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml diff --git a/config/dansguardian/dansguardian_log.xml b/config/dansguardian/dansguardian_log.xml index 3a0f241e..a3448d44 100644 --- a/config/dansguardian/dansguardian_log.xml +++ b/config/dansguardian/dansguardian_log.xml @@ -67,6 +67,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml diff --git a/config/dansguardian/dansguardian_sync.xml b/config/dansguardian/dansguardian_sync.xml index c041f398..f91eae6a 100755 --- a/config/dansguardian/dansguardian_sync.xml +++ b/config/dansguardian/dansguardian_sync.xml @@ -66,6 +66,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml diff --git a/config/dansguardian/dansguardian_users_header.xml b/config/dansguardian/dansguardian_users_header.xml index 70edb5fe..1f15a610 100644 --- a/config/dansguardian/dansguardian_users_header.xml +++ b/config/dansguardian/dansguardian_users_header.xml @@ -66,6 +66,10 @@ Access Lists /pkg_edit.php?xml=dansguardian_antivirus_acl.xml&id=0 + + LDAP + /pkg.php?xml=dansguardian_ldap.xml + Groups /pkg.php?xml=dansguardian_groups.xml diff --git a/config/dansguardian/dansguardianfx.conf.template b/config/dansguardian/dansguardianfx.conf.template index d420871f..ccc24f19 100644 --- a/config/dansguardian/dansguardianfx.conf.template +++ b/config/dansguardian/dansguardianfx.conf.template @@ -376,7 +376,7 @@ sslcertcheck = {$dansguardian_groups['sslcertcheck']} # Forge ssl certificates for all sites, decrypt the data then re encrypt it # using a different private key. Used to filter ssl sites sslmitm = {$dansguardian_groups['sslmitm']} -mitmkey = '{$dansguardian_groups['mitmkey']}' +#mitmkey = '{$dansguardian_groups['mitmkey']}' EOF; -- cgit v1.2.3