Google Chrome Updater vs Proxy

[Rammie]

I know I've seen an answer to this somewhere, but I can't find it now that I need it, so... When we installed Chrome, we targetted Updater at our LEA's ISA server (which is/was an unauthenticated proxy). Setting up the proxy was fiddly (in the GP bolt-on), but we got the hang of it after a while and it worked a treat.

 

Now, we've changed ISPs to Virgin and we no longer have a top-level proxy, only our internal proxies which need authentication to traverse. We've changed the proxy address in GP, but, problem, there is nowhere to put a username/password to authenticate the updater traffic. So how do you trick Updater to store an authentication pair, to traverse the proxy - deployable solution preferred, obviously? Alternatively, how do you find out which hosts Updater needs to update, so I can put them in Squid's whitelist?

[Duke5A]

We use Chrome in our district and I just disabled the auto-update and updates are pushed via Group Policy. To get the update servers addresses you'll probably have to turn off authentication on your proxy and watch the logs as you force the update. I didn't see anything pertaining to Google Update server addresses in a quick search.

[ADMaster]

Same here, disable updates and push chrome with gpo.

[Rammie]

Thanks Duke5A, ADMaster! I had considered GP push and that is the way we deploy the base install. However, I'm not fond of tinkering with GP any more than strictly necessary. In any case, GoogleUpdater works very neatly given the tools to work with; it's just a shame that Google didn't provide neater solutions for Enterprise users.

 

Good news is that I located the "official" update host list buried in Google's documentation somewhere or other. It looks like this:

 

http://cache.pack.google.com/edgedl/chrome/win/

http://www.google.com/dl/chrome/win/

https://dl.google.com/chrome/win/

http://dl.google.com/chrome/win/

http://dl.google.com/chromeos/

http://google.com/dl/chrome/win/

 

I could have whitelisted these, but better news is that one of my technicians dusted off his SQUID acl knowledge and worked out how to identify browser + Google Update traffic, so that our proxy now has this on bypass. Apparently he's done this before with BOINC traffic, although I didn't realize it. Chrome now updates fine at any time of day and the students don't even notice. By the way, GoogleUpdate.adm is essential to set the proxy URL in GP and there is no other obvious way of doing it. Reading the web indicates that loads of people assume that the Updater uses the same settings page as Chrome (well, you would, wouldn't you?), whereas in fact, the settings are quite separate. When you begin to appreciate that GoogleUpdater performs for a whole suite of apps, not just Chrome, you start to realize why.

Edited July 2, 2013 by Rammie