School Guardian 2008 and ntlm

DMcCoy · 24-07-2008, 07:33 PM

I've spent the last couple of days trying to get School Guardian 2008 installed and configured. I've found lots of nice things in it!

However I have hit a rather nasty problem. I can't get ntlm authentication/identification to work correctly.

Does anyone else use this combination successfully?

As it stands this is whats happening

User authenticates. Page is requested. Some of the page comes back. I've been talking to support who have helped a bit with the issue (turning on persistant connections seems to help quite a bit) but I've not been able to eliminate it. The content is not currently being filtered.

I've been working on it tonight as I'm really pushed for time. One interesting thing I did note is that some items appear in the filter request log *exactly* 2 minutes after the original requests. This doesn't seem to happen with no auth, ssl auth or any of the others I would assume.

Using safari seems to exacerbate the issue, often losing the page style sheets.

edsa · 24-07-2008, 09:31 PM

Quote:

Originally Posted by DMcCoy

I've spent the last couple of days trying to get School Guardian 2008 installed and configured. I've found lots of nice things in it!

However I have hit a rather nasty problem. I can't get ntlm authentication/identification to work correctly.

Does anyone else use this combination successfully?

As it stands this is whats happening

User authenticates. Page is requested. Some of the page comes back. I've been talking to support who have helped a bit with the issue (turning on persistant connections seems to help quite a bit) but I've not been able to eliminate it. The content is not currently being filtered.

I've been working on it tonight as I'm really pushed for time. One interesting thing I did note is that some items appear in the filter request log *exactly* 2 minutes after the original requests. This doesn't seem to happen with no auth, ssl auth or any of the others I would assume.

Using safari seems to exacerbate the issue, often losing the page style sheets.

We had a similar problem when we first installed School Guardian. A workround was to enable ntlm identification (terminal services compat mode) This seemed to do the trick until Smoothwall released an upgrade to fix the problem. We now use ntlm ident with no problems

Make sure that filtering is applied to the user groups that you wish to filter.

Have you tried a save and restart with cleared cache?

GrumbleDook · 24-07-2008, 09:46 PM

We are using Network Guardian and have also been on the phone tonight with Nick about a similar issue.

The above fix also worked for us.

DMcCoy · 25-07-2008, 12:17 AM

Hmm, seems to be something a bit like this

'[squid-users] Squid sends TCP_DENIED/407 even on already authenticated users' - MARC

In fact on the wikipedia front page I had no formating, and there was a 407 for the main.css file amongst lots of 200s.

DMcCoy · 25-07-2008, 12:37 AM

The 407 itself is ok, it seems that while IE mostly retries and is successful, Safari often doesn't retry or fails.

I would blame OS X and ntlm but I've not been able to replicate the issue using ntlm to an ISA proxy. I'll have a go with 10.4 tomorrow anyway.

ahuxham · 25-07-2008, 10:21 AM

Sorry to de-rail, but isn't NTLM just dandy?

DMcCoy · 25-07-2008, 10:59 AM

Quote:

Originally Posted by ahuxham

Sorry to de-rail, but isn't NTLM just dandy?

No

See attached

DMcCoy · 25-07-2008, 11:14 AM

Going to try ident servers on the windows and macs later instead. That should work

plexer · 25-07-2008, 11:21 AM

I had several issues with NLTM some users would get asked for a username/password combo via a popup box even though it's not supposed to do this.

I tried various things as suggested by tech support and I'll be looking into this again when I'm in over the hols.

Ben

ChrisH · 25-07-2008, 11:55 AM

Quote:

Originally Posted by plexer

I had several issues with NLTM some users would get asked for a username/password combo via a popup box even though it's not supposed to do this.

I tried various things as suggested by tech support and I'll be looking into this again when I'm in over the hols.

Ben

You usually only get that when they are trying to access from more than one machine or they have swopped machines and it hasnt timed out for the old machine yet.

OverWorked · 25-07-2008, 11:59 AM

I had a bit of trouble getting it going, but it's worked flawlessly since.

First of all, I second what Edsa said. Here's a few ideas:-

services » authentication » control - do you get all green lights?

services » authentication » settings - is it all filled in correctly? If you're using AD, I could PM you a screen shot of mine.

services » authentication » user activity - are users being listed?

system » preferences » time - is the clock correct? Timezone should be Europe/London. I just manually set my clock - I couldn't get NTP to work. The RTC in the BIOS should be set to GMT (not BST).

plexer · 25-07-2008, 11:59 AM

Nope definitely not that.

Ben

DMcCoy · 25-07-2008, 01:09 PM

With the persistant connections and a rebuild the 407s (without browser retries) have reduced to an acceptable level, at least with low volume testing. Just had one image not show up so far on apples home page (which was quite problematic).

Hopefully that it will work well enough to keep with ntlm, although I'll be adding ident servers to machine when I reimage

tom_newton · 25-07-2008, 02:07 PM

I would vaguely wonder about auth timeouts... but then i'd just be tinkering to "see if it does anything"

Also - if you enable/disable transparent filtering it changes the way NTLM does things (IIRC!).

We are looking at SPNEGO and all things "post" NTLM, but there aren't really many good, widely used standards for this sort of thang.

Welcome, Register for free! or Login below:
User Name		Remember Me?
Password

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Forensic Software or School Guardian which one	Grommit	Network and Classroom Management	19	24-07-2008 12:55 PM
School Guardian	tldees	Networks	3	12-06-2008 05:08 PM
Network Guardian 2008 is nice.	plexer	How do you do....it?	0	23-04-2008 03:29 PM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

		EduGeek.net Forums > Technical > *nix
School Guardian 2008 and ntlm

24-07-2008, 09:46 PM	#3 (permalink)
GrumbleDook Join Date: Jul 2005 Location: Kettering, Northants Posts: 4,688 Thanks: 44 Thanked 118 Times in 82 Posts Blog Entries: 1 Rep Power: 37	We are using Network Guardian and have also been on the phone tonight with Nick about a similar issue. The above fix also worked for us.

25-07-2008, 12:17 AM	#4 (permalink)
DMcCoy Join Date: Oct 2005 Location: Isle of Wight Posts: 1,670 Thanks: 1 Thanked 64 Times in 59 Posts Rep Power: 21	Hmm, seems to be something a bit like this '[squid-users] Squid sends TCP_DENIED/407 even on already authenticated users' - MARC In fact on the wikipedia front page I had no formating, and there was a 407 for the main.css file amongst lots of 200s.

25-07-2008, 12:37 AM	#5 (permalink)
DMcCoy Join Date: Oct 2005 Location: Isle of Wight Posts: 1,670 Thanks: 1 Thanked 64 Times in 59 Posts Rep Power: 21	The 407 itself is ok, it seems that while IE mostly retries and is successful, Safari often doesn't retry or fails. I would blame OS X and ntlm but I've not been able to replicate the issue using ntlm to an ISA proxy. I'll have a go with 10.4 tomorrow anyway.

25-07-2008, 10:21 AM	#6 (permalink)
ahuxham Join Date: Apr 2008 Location: Somerset Posts: 235 Thanks: 11 Thanked 12 Times in 12 Posts Rep Power: 3	Sorry to de-rail, but isn't NTLM just dandy?

25-07-2008, 11:14 AM	#8 (permalink)
DMcCoy Join Date: Oct 2005 Location: Isle of Wight Posts: 1,670 Thanks: 1 Thanked 64 Times in 59 Posts Rep Power: 21	Going to try ident servers on the windows and macs later instead. That should work

25-07-2008, 11:21 AM	#9 (permalink)
plexer Join Date: Dec 2005 Location: Norfolk Posts: 3,577 Thanks: 12 Thanked 50 Times in 50 Posts Rep Power: 21	I had several issues with NLTM some users would get asked for a username/password combo via a popup box even though it's not supposed to do this. I tried various things as suggested by tech support and I'll be looking into this again when I'm in over the hols. Ben

25-07-2008, 11:59 AM	#11 (permalink)
OverWorked Join Date: Jul 2005 Location: N. Yorks Posts: 535 Thanks: 32 Thanked 9 Times in 8 Posts Rep Power: 10	I had a bit of trouble getting it going, but it's worked flawlessly since. First of all, I second what Edsa said. Here's a few ideas:- services » authentication » control - do you get all green lights? services » authentication » settings - is it all filled in correctly? If you're using AD, I could PM you a screen shot of mine. services » authentication » user activity - are users being listed? system » preferences » time - is the clock correct? Timezone should be Europe/London. I just manually set my clock - I couldn't get NTP to work. The RTC in the BIOS should be set to GMT (not BST).

25-07-2008, 11:59 AM	#12 (permalink)
plexer Join Date: Dec 2005 Location: Norfolk Posts: 3,577 Thanks: 12 Thanked 50 Times in 50 Posts Rep Power: 21	Nope definitely not that. Ben

25-07-2008, 01:09 PM	#13 (permalink)
DMcCoy Join Date: Oct 2005 Location: Isle of Wight Posts: 1,670 Thanks: 1 Thanked 64 Times in 59 Posts Rep Power: 21	With the persistant connections and a rebuild the 407s (without browser retries) have reduced to an acceptable level, at least with low volume testing. Just had one image not show up so far on apples home page (which was quite problematic). Hopefully that it will work well enough to keep with ntlm, although I'll be adding ident servers to machine when I reimage

Register now for FREE and post messages!
Username: Password: Confirm Password: E-Mail: Confirm E-Mail: Birthday: Image Verification I agree to forum rules

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

25-07-2008, 02:07 PM	#14 (permalink)
tom_newton Join Date: Sep 2006 Location: Leeds Posts: 761 Thanks: 5 Thanked 21 Times in 19 Posts Rep Power: 8	I would vaguely wonder about auth timeouts... but then i'd just be tinkering to "see if it does anything" Also - if you enable/disable transparent filtering it changes the way NTLM does things (IIRC!). We are looking at SPNEGO and all things "post" NTLM, but there aren't really many good, widely used standards for this sort of thang.