Pros and cons of filtering systems

[Opendium_Steve]

We get a lot of really good feedback on our filtering products from our customers, but I'm curious about folks using other systems - what do you guys really like about the filtering systems you're using, what do you hate, how could they be improved?

 

(Sorry if anyone feels this thread is inappropriate - I've been lurking on the forum for a while and decided there was no better way to get opinions than to just ask.)

[dhicks]

what do you guys really like about the filtering systems you're using, what do you hate, how could they be improved?

 

We use Lightspeed, which generally works well. It's annoying to have to distribute its client agent to all workstations for it to pick up which user is logged in to which machine, and it's starting to strike me as a bit pricy for what it offers. We currently have an on-site Lightspeed device sat in our server cupboard, I would like to get rid of that device and move to s virtual server provided along with the Internet connection. Schools Broadband offer Internet-connection-with-Lightspeed filtering, does anyone offer Internet-connection-with-Opendium filtering?

[Opendium_Steve]

I've PM'd you a more complete answer because I don't want this to appear to be an advert (which wasn't the intention), but briefly:

 

We use Lightspeed, which generally works well. It's annoying to have to distribute its client agent to all workstations for it to pick up which user is logged in to which machine

 

It's unfortunate, but there isn't a perfect solution for authenticating users - standard basic proxy authentication used to be pretty reliable, but it seems that increasingly lax software development has left a lot of new software with either broken or nonexistent support (I'm looking at you Apple/Google! ). We mostly use Kerberos authentication for Windows machines that are on the Windows domain, and this is pretty good and doesn't involve installing a client (you do need to enable proxy support on the workstations, but that can be done very easily through active directory). Workstations that are off the domain and non-Windows workstations end up using a combination of basic proxy authentication, WISPr and a captive portal - mostly this works ok, but there are occasional down sides.

Edited February 13, 2015 by Opendium_Steve

[exa_markd]

It surprises me that an agent is needed on the workstation David, I have come across some UTM's that monitor the event log activity of the Domain controllers to track logins. This activity is then passed onto the UTM so that when web requests are made the appropriate filtering can be applied. This also achieves SSO with a captive portal for non windows hosts.

[Davit2005]

Sophos, no client needed. Windows authenticates automatically, if authentication fails then falls back to Captive Portal. Non college devices get Captive Portal.

[dhicks]

It surprises me that an agent is needed on the workstation David, I have come across some UTM's that monitor the event log activity of the Domain controllers to track logins. This activity is then passed onto the UTM so that when web requests are made the appropriate filtering can be applied. This also achieves SSO with a captive portal for non windows hosts.

 

That's a good point - whenever I'd imagined how a web filter might identify who was on a workstation I'd always thought of it going directly to the workstation itself to ask who was logged on but, of course, you're right, it could ask the domain controller instead. Can you get an accurate idea of who is logged on if someone switches users on a workstation rather than logs off?

 

How does the captive portal method of authentication tell when someone is logged off?

[Opendium_Steve]

How does the captive portal method of authentication tell when someone is logged off?

 

The quick answer is: it doesn't

 

Using captive portal or WISPr authentication on their own is only really suitable for single-user devices (e.g. phones, tablets, etc), where the device appears on an IP address and you know that every web request from that IP for a significant period of time (say an hour or so) is going to be from the same user.

 

Kerberos, NTLM and HTTP Basic authentication all authenticate every connection to the proxy server individually, so they are more suitable for multi-user devices. All the major desktop web browsers support one or more of these methods, although support from non-browser software is a bit hit and miss.

 

The solution we settled on a few years back is to use a hybrid of these mechanisms, authenticating every connection where possible, but falling back to cached credentials when dealing with software that doesn't support this. Its proven pretty reliable in most situations, although one place the hybrid system doesn't work well is a remote desktop situation (multiple users using the same device at exactly the same time) - the only way to handle that is to either authenticate every connection individually, or to forget about tracking individual users on that device and just set some fixed filtering that applies to all its traffic.

[exa_markd]

I cannot remember what the SSO agent does for switching users - I guess as long as it generates logout events there firewall will get to know. The Captive portal can be made to generally expire a login after a period of configurable time or the user can logout of the captive portal to free up that machine ip. Captive portal is good sometimes to temporarily 'elevate' permissions from default - say student to staff permissions for web. Based on what I have seen of various UTM suppliers.