originalip option in dansguardian

I upgraded my firewall on Mandriva 2009.1 to 2010 and got into problem with dansguardian. Client computers got DansGuardian 400 - Bad Request , url is malformed for certain sites such as google and facebook. I suspected it must be related to new option introduced by newly installed dansguardian (2.10.1.1). In changelog, I got this:


Jan 21 17:18:39 firewall6 dansguardian[1090]: Destination host of dnl-15.geo.kaspersky.com did not match the original destination IP of 95.211.85.42
Jan 21 17:18:40 firewall6 dansguardian[1111]: Destination host of www.google-analytics.com did not match the original destination IP of 72.14.213.113
Jan 21 17:18:40 firewall6 dansguardian[1074]: Destination host of us.bc.yahoo.com did not match the original destination IP of 216.252.124.30
Jan 21 17:18:40 firewall6 dansguardian[1072]: Destination host of dnl-11.geo.kaspersky.com did not match the original destination IP of 38.117.98.202
Jan 21 17:18:41 firewall6 dansguardian[1091]: Destination host of dnl-04.geo.kaspersky.com did not match the original destination IP of 38.117.98.199
Jan 21 17:18:42 firewall6 dansguardian[1083]: Destination host of dnl-07.geo.kaspersky.com did not match the original destination IP of 38.117.98.199
Jan 21 17:18:42 firewall6 dansguardian[1116]: Destination host of newsrss.bbc.co.uk did not match the original destination IP of 212.58.226.73
Jan 21 17:18:43 firewall6 dansguardian[1076]: Destination host of dnl-11.geo.kaspersky.com did not match the original destination IP of 38.117.98.202
Jan 21 17:18:43 firewall6 dansguardian[1086]: Destination host of dnl-02.geo.kaspersky.com did not match the original destination IP of 38.117.98.196
Jan 21 17:18:49 firewall6 dansguardian[1270]: Started sucessfully.


After diff'ing between previous dansguardian.conf (currently in use) and the current version of the file (not in use). It turned out that originalip option was the culprit. It was on by default if it wasn't in there. To turn it off, I must tell it off as below:

# Network Settings
#
# the IP that DansGuardian listens on. If left blank DansGuardian will
# listen on all IPs. That would include all NICs, loopback, modem, etc.
# Normally you would have your firewall protecting this, but if you want
# you can limit it to a certain IP. To bind to multiple interfaces,
# specify each IP on an individual filterip line.
filterip = 192.168.6.6

# the port that DansGuardian listens to.
filterport = 8080

# the ip of the proxy (default is the loopback - i.e. this server)
proxyip = 127.0.0.1

# the port DansGuardian connects to proxy on
proxyport = 3128

originalip = off

This is what changelog says about originalip option:

Fri 5th June 2009 - DansGuardian 2.10.1.1 - stable

Add "originalip" option to dansguardian.conf, for determining the original destination IP in transparent proxy set-ups, and ensuring that the destination domain of the request resolves to that IP. This can help to address a particular transparent proxy security vulnerability (US-CERT VU#435052), but because of certain limitations - only implemented on Linux/Netfilter; potential breakage of websites using round-robin DNS - the code is not enabled by default. Enable by passing "--enable-orig-ip" to the configure script. Fix a crash which could occur when dealing with simultaneous incoming connections in configurations using more than one listening socket. Fix a crash when checking time limits on item lists. Fix potential usage of uninitialised memory during phrase filtering.

Luckily, Mandriva package was built with --enable-orig-ip enabled.

Cheers.

Stripping comments from a file

You can run this command to strip comments (line starting with a #) and empty lines from a file in Linux:

cat /etc/squid/squid.conf | grep -v ^# | grep -v ^$

I usually run this command on squid.conf, a file heavily commented.

To save the lines to file squiD.conf, you can run:

cat /etc/squid/squid.conf | grep -v ^# | grep -v ^$ > squiD.conf

Have fun!...

Nat Friedman leaves Novell

Nat Friedman and Miguel de Icaza were the founders of Ximian project. They both were known for their famous GNOME project where Ximian bornt. You can read what Nat will do next in his blog.

We are using MySQL, help save it

As Oracle are progressing to acquire Sun, the future of MySQL is at stake. Read Monty's article about this at http://monty-says.blogspot.com/2009/12/help-saving-mysql.html to understand this issue better.

How to change KDE 4 startup sound

It may not obvious for beginner. These are the steps on how to change startup sound in KDE 4.

1. Open KDE System Setting


2. Double click on the notifications to open it.


3. For Event source, select KDE System Notifications as below.


4. From the list, select Login and click browse button to change the sound file.


From here, there are lots of options for you to try. Have fun!

Google Chrome 64-bit for Linux

After searching for hours for Google Chrome 64-bit for Mandriva 2010, I found this one works great. Please expect some bugs. At least flash plugin works with the help of Mozilla's. This package may work for other distro too. You have to try it yourself.

Mandriva Linux 2010 released

Announced on Nov 4th 2009, the release of Mandriva 2010. It is available in three editions : One, Powerpack and Free, for architectures i586 and x86-64. One and Free can be downloaded for free from official Mandriva mirrors and via BitTorrent.

To know what this edition has to offer, read here.

What really attracts me is this:

Mandriva Linux 2010 includes Go-OO branch of the popular OpenOffice.org. That means more features, like SVG support, 3D transitions, VBA support, KDE 4 integration and Includes useful extensions.

So for those who *really* need these features of Go-OO, should consider use this edition of Mandriva Linux.

Have fun!