debian SquidGuardでブロックログを出力

■Lenny、Squeezeで確認
　「squidGuard.conf」へのacl作成スクリプトを修正

# sudo -u proxy mkdir /var/log/squid/block
# cd /var/lib/squidguard/db
# echo * | for DIR in `xargs`;do \
    echo -e "dest ${DIR} {\n\tdomainlist\t${DIR}/domains\n\turllist\t\t${DIR}/urls"
    echo -e "\tlogfile /var/log/squid/block/${DIR}.log\n\tredirect http://www.labunix.net/block.html\n}\n"; \
   done
# vim /etc/squid/squidGuard.conf
# chown proxy:proxy /etc/squid/squidGuard.conf
# chown -R proxy:proxy /var/log/squid/

■「squid.conf」の事前チェック、squidGuardのDB作成
　squid設定の再読み込み、再チェック

# sudo -u proxy /usr/sbin/squid -k check
# sudo -u proxy /usr/bin/squidGuard -d -C all 2>&1 | tail -4
# sudo -u proxy /usr/sbin/squid -k reconfigure
# sudo -u proxy /usr/sbin/squid -k check

■テスト

# cat /var/lib/squidguard/db/personal/urls
b.st-hatena.com/js/bookmark_button.js

# cat /var/lib/squidguard/db/personal/urls | w3m -dump http://`xargs`
Black

■サイズが「0」のブロックログ

# find /var/log/squid/block/ -size 0 -print | xargs ls -l
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:57 /var/log/squid/block/ads.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:57 /var/log/squid/block/aggressive.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:57 /var/log/squid/block/audio-video.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:57 /var/log/squid/block/drugs.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:57 /var/log/squid/block/gambling.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:57 /var/log/squid/block/hacking.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:57 /var/log/squid/block/mail.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:58 /var/log/squid/block/porn.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:58 /var/log/squid/block/proxy.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:58 /var/log/squid/block/redirector.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:58 /var/log/squid/block/spyware.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:58 /var/log/squid/block/suspect.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:58 /var/log/squid/block/violence.log
-rw-r--r-- 1 proxy proxy 0 2012-03-15 19:58 /var/log/squid/block/warez.log

■サイズが「1」以上のブロックログ

# find /var/log/squid/block/ -size 1 -print | xargs ls -l
-rw-r--r-- 1 proxy proxy 145 2012-03-15 19:59 /var/log/squid/block/personal.log

■1時間以内に変更のあったログ

# echo 1 | awk '{print $1/24}'
0.0416667

# find /var/log/squid/block/ -mtime -0.0416667
/var/log/squid/block/
/var/log/squid/block/suspect.log
/var/log/squid/block/mail.log
/var/log/squid/block/ads.log
/var/log/squid/block/warez.log
/var/log/squid/block/spyware.log
/var/log/squid/block/drugs.log
/var/log/squid/block/proxy.log
/var/log/squid/block/redirector.log
/var/log/squid/block/audio-video.log
/var/log/squid/block/personal.log
/var/log/squid/block/gambling.log
/var/log/squid/block/aggressive.log
/var/log/squid/block/hacking.log
/var/log/squid/block/violence.log
/var/log/squid/block/porn.log

■上記の1/4、つまり15分以内に更新のあったログ

# find /var/log/squid/block/ -mtime -0.01
/var/log/squid/block/personal.log

■ログのチェック

# tail -f /var/log/squid/block/personal.log | sed s/"192.*net"/"[host_info]"/g
2012-03-15 19:59:14 [5538] Request(default/personal/-) http://b.st-hatena.com/js/bookmark_button.js [host_info] - GET

■過去一日の間に更新があったブロックリストをシステムメール送信

# vim squidGuard_report.sh
#!/bin/bash
set -e

if [ `id -u` -ne "0" ];then
  echo "Sorry,Not Permit User!"
  exit 2
fi

TEMP="/var/log/squid/squidGuard_block_report.log"

sudo -u proxy echo -e "`LANG=C date`\n# SquidGuard block Report" > ${TEMP}
for bar in `seq 1 80`;do echo "#";done | xargs echo -n | \
  sudo -u proxy sed s/" "//g >> ${TEMP}
echo "" >> ${TEMP}
sudo -u proxy find /var/log/squid/block -mtime -1 -print | \
  grep -v "block\$" | \
  for list in `xargs`;do
    TITLE=`echo "$list" | sed s%"/var/log/squid/block/"%%g | sed s/"\.log"//g`
    echo "[ ${TITLE} ]"
    test -f "$list" && sudo -u proxy cat "${list}"
  done >> ${TEMP}
cat ${TEMP} | mail -s "squidGuard Block Report" root
unset TEMP bar TITLE list
exit 0


■実行すると、以下のようなメールが届く
　※2日目以降は変更のファイルのみ

# chmod +x *report.sh
# ./1st_squidGuard_report.sh
# ./squidGuard_daily_report.sh

Subject: squidGuard Block Report

Thu Mar 15 21:49:50 JST 2012
# SquidGuard block Report
################################################################################

[ warez ]
[ suspect ]
[ spyware ]
[ hacking ]
[ mail ]
[ redirector ]
[ ads ]
[ violence ]
[ proxy ]
[ gambling ]
[ drugs ]
[ porn ]
[ personal ]
2012-03-15 20:49:41 [2200] Request(default/personal/-) http://b.st-hatena.com/js
/bookmark_button.js 192.168.188.188/debian-squeeze - GET REDIRECT
[ audio-video ]
[ aggressive ]

■2日目以降からは以下のようになるはず。

# ./squidGuard_daily_report.sh

Subject: squidGuard Block Report

Thu Mar 15 21:49:50 JST 2012
# SquidGuard block Report
################################################################################

[ personal ]
2012-03-15 20:49:41 [2200] Request(default/personal/-) http://b.st-hatena.com/js
/bookmark_button.js 192.168.188.188/debian-squeeze - GET REDIRECT

■更新が無かった場合

Subject: squidGuard Block Report


Thu Mar 15 21:52:09 JST 2012
# SquidGuard block Report
################################################################################

■cronで自動化

$ sudo cp squidGuard_report.sh /etc/cron.daily/