Proxy

[Geoff]

I just run my proxy on port 8080 and set the proxy settings for clients in the GPOs. Additionally firefox needs a pref tweak to make it do NTLM but that's not really a problem.

Ident would be the easiest solution if you wanted to use transparent proxying and authentication. But to my mind it's a non-issue. It's easier to set the clients up with a proxy than it is to deploy Ident servers to all your client machines.

[webman]

Tom: What I'm asking though, is the only difference that "Transparent on GREEN" tickbox makes is the proxy service running on port 80 instead of 8080 for example?

[Geoff]

yes. that's it exactly.

[tom_newton]

Transparent on green actually leaves the proxy on port 800 or 8080 or wherever is the default (SmoothWall is 800). It then uses firewalling rules to "loop back" the traffic from port 80 into the proxy.

[webman]

I thought it did something like that. So how does this affect the Dansguardian content filtering and the transparent authentication as mentioned by Norphy?

[Geoff]

if you put the proxy on port 80 it can't do NTLM authentication like Norphy wants. It doesn't affect the content filtering though.

[tom_newton]

I thought it did something like that. So how does this affect the Dansguardian content filtering and the transparent authentication as mentioned by Norphy?

OK, ignore the proxy end of the bargain completely - assume by some form of black magic, all our connections are going through a proxy.

In order for a browser (eg. IE) to know it has to authenticate against a proxy it has to know where that proxy is so it can talk to it. Unless you have set up a proxy in the internet settings, IE doesn't know about the proxy, so can't authenticate. If you *have* it does know about the proxy, and hence it snot a transparent proxy.

If "proxyish things" (like being asked for proxy credentials) started happening to IE when it didn't think it was going via a proxy, it'd get confused. Effectively, it would appear as if the origin site (eg. google) were asking for the authentication, and then whjen you moved sites, the next site would ask for auth, too. In this case, the browser would falsely send your username and password to the origin site.

[webman]

Thanks Tom, I understand what you mean.