Sheridan Posted October 16, 2015 Posted October 16, 2015 Does anyone know what URLs a chromebook tries to connect to on initial startup? Got one on trial here, joined to the wifi, connected to the proxy but will not go past the stupid dinosaur 'Network not available' message. When I check the logs for the (non authenticated) proxy it shows a raft of: http://www.gstatic.com/generate_204 connections but nothing else? Its connected ok, has an IP address and has the proxy set. But thats as far as it gets - I'm wondering if its typically trying to bypass the proxy for something.
aleach2 Posted October 16, 2015 Posted October 16, 2015 Hi, Yes we had the same issue with our smoothwall. It need to have un-authenticated access to the net to load the login page and to authenticate users against Google apps. Here is a list of we had to allow: gstatic.com tools.google.com clients3.google.com pki.google.com apis.google.com safebrowsing.google.com clients4.google.com googleusercontent.com play.google.com clients5.google.com ajax.googleapis.com accounts.google.com client-channel.google.com ssl.gstatic.com googleapis.com pack.google.com dl-ssl.google.com storage.googleapis.com dl.google.com accounts.youtube.com commondatastorage.googleapis.com omahaproxy.appspot.com clients6.google.com ytimg.com accounts.google.co.uk clients2.google.com clients1.google.com m.google.com cros-omahaproxy.appspot.com apps-apis.google.com oauth.googleusercontent.com verisign.net Its a lot. Adam. 1
Sheridan Posted October 16, 2015 Author Posted October 16, 2015 Wow, unauthenticated access to the whole of google basically! Not very good for a school environment then!
sammy42 Posted October 16, 2015 Posted October 16, 2015 Google exceptions .txt Hi Sheridan Here is what we have set up on our UTM. hope this helps. We found that if its a new chrome book straight from the suppliers once you get it connected on to the internet you will need to update it to the latest version. As it may have been produced up to a year before it was sold so will need up dating before it works correctly hope that makes sense. You can do this by login on as a guest and them updating 1
Sheridan Posted October 16, 2015 Author Posted October 16, 2015 So effectively the Proxy setting is completely ignored? Where have I seen that before then! How do you find these exceptions fit in with https inspection of your GAFE accounts traffic then? Allowing exceptions for the likes of accounts.google.com which is part of the inspection policy seems to be at odds with each other.
CyberNerd Posted October 16, 2015 Posted October 16, 2015 We still inspect Google et al. (smoothwall) Our "do not HTTPS inspect" list is: gstatic.com lh1.googleusercontent.com lh2.googleusercontent.com clients3.google.com lh4.googleusercontent.com clients4.google.com accounts.youtube.com talk.google.com accounts.google.co.uk clients2.google.com lh3.googleusercontent.com clients1.google.com mtalk.google.com google-analytics.com r17---sn-aigllnll.c.pack.google.com m.google.com accounts.google.com cache.pack.google.com ssl.gstatic.com googleapis.com 'safe-search' is still applied. 1
Sheridan Posted October 16, 2015 Author Posted October 16, 2015 Ah right - so if I'm getting this right, those of you have got this working have got a list of the google sites as authentication exceptions, but https inspection enabled for GAFE, but with the https inspection enabled for unauthenticated users?
CyberNerd Posted October 16, 2015 Posted October 16, 2015 Just HTTPS inspection *disabled* (IE DO NOT INSPECT) for the sites I posted above. ie we create a "chromebook login" group and choose not to intercept the https for those sites. Which makes sense from a load point of view too, I don't want to load my proxies with random login info.
Sheridan Posted October 16, 2015 Author Posted October 16, 2015 I think we've gone down a slightly different route (which was helped by Smoothwall during the setup) as we use the option to only allow logins to our Google domain. That means we have https inspection ON for the small list of google sites (and web searches etc) but OFF for other sites that don't require it. I think I've also discovered a major flaw with the chromebook idea for us - as we use a third party VLE (that uses GAFE) it means signing in to the chromebook doesn't work, as they need to SSO through the vle.
Bev Posted October 16, 2015 Posted October 16, 2015 (edited) I took mine home, set them all up and then brought them back into school and they all work fine on the proxy once they had been initially setup. I think I've also discovered a major flaw with the chromebook idea for us - as we use a third party VLE (that uses GAFE) it means signing in to the chromebook doesn't work, as they need to SSO through the vle. We do this, but they have to sign in using their google apps email address but their VLE password. They can then directly access their google docs/email without reclogging in, but I've realised that the kids automatically go to the Portal (vle) website and login again as this is the procedure they are familiar with. Consequently, I think we'd be as well using the Chromebooks in Guest Mode (but we have problems with the proxy doing that), or setting up some generic Chromebook login accounts, as I don't think we are getting any benefit of them logging into their own account and logging in seems to take a long time out of each lesson. Edited October 16, 2015 by Bev 1
Sheridan Posted October 16, 2015 Author Posted October 16, 2015 I'll give a few student accounts a try and see how it works out. These aren't going to be quite as simple to deploy as I first thought! I notice when I put the list of exceptions in our smoothwall a few google sites went rather odd (missing css, pages not rendered etc) so I've had to take that out for the moment.
CyberNerd Posted October 16, 2015 Posted October 16, 2015 I think I've also discovered a major flaw with the chromebook idea for us - as we use a third party VLE (that uses GAFE) it means signing in to the chromebook doesn't work, as they need to SSO through the vle. We had the same issue. We used to SSO to GAFE via the VLE but when we tested the chromebooks we found this wasn't workable. We removed the SSO for the VLE and auth directly to Google. If the VLE provider could allow auth via google your SSO will work. Doing this also fixed a bunch of problems with drive on ipads as a side note.
Sheridan Posted October 16, 2015 Author Posted October 16, 2015 We had the same issue. We used to SSO to GAFE via the VLE but when we tested the chromebooks we found this wasn't workable. We removed the SSO for the VLE and auth directly to Google. If the VLE provider could allow auth via google your SSO will work. Doing this also fixed a bunch of problems with drive on ipads as a side note. Yeah its going to be down to preference. Do they want to login to the VLE seperately, or use the GAFE account with SSO. I think if we switched off SSO from the VLE to GAFE and allowed direct login to GAFE the VLE would be used a lot less!
CyberNerd Posted October 16, 2015 Posted October 16, 2015 Yeah its going to be down to preference. Do they want to login to the VLE seperately, or use the GAFE account with SSO. I think if we switched off SSO from the VLE to GAFE and allowed direct login to GAFE the VLE would be used a lot less! We found that on Chrome/Chromebooks it will sync the username/password for the VLE on login, so on a large scale chrome rollout it makes little difference.
Bev Posted October 16, 2015 Posted October 16, 2015 The only issue I have is that if the password needs reseting it takes about an hour before it syncs back to the Chromebook. I don't know if this is unique to our VLE or typical of GAFE but if the child turns up with a Chromebook needing their password resetting I have to log them on as Guest as I can't reset their password during that lesson.
CyberNerd Posted October 16, 2015 Posted October 16, 2015 The only issue I have is that if the password needs reseting it takes about an hour before it syncs back to the Chromebook. I don't know if this is unique to our VLE or typical of GAFE but if the child turns up with a Chromebook needing their password resetting I have to log them on as Guest as I can't reset their password during that lesson. When we reset passwords through active directory the sync is instant, so I would guess it is to do with the VLE, a token or similar.
Sheridan Posted October 16, 2015 Author Posted October 16, 2015 Thanks for all the input on this, I'm going to get a management license and do some testing again once its an enrolled device.
gshaw Posted October 16, 2015 Posted October 16, 2015 (edited) Funny enough I've just come on Edugeek to have a look if anyone else had weird proxy behaviour on their Chromebooks The first run I connected them to our internal SSID (no proxy, direct connection to web) and all was wonderful. Putting them onto the internal proxied network turned the experience into a very ropey one with random sign-in errors and DHCP connection errors. All the more reason I want to dump the whole proxy thing and go bridged mode. Noticed the same as others mentioned with the software versions - out the box had a few on v44, some on 41 and others on 40. The subtly different login screens are the only real giveaway. Btw remember when enrolling to do the CTRL+ALT+E straight away when the login screen appears else you'll have to wipe the device via Developer mode (found that one out after using a generic Google account for a quick demo last week) And don't get me started on that lizard on the Chromebook 11's - brilliant devices apart from whatever numpty made the logon wallpaper non-customisable Edit: I've changed the proxy settings on the managed network from Auto Configuration to Manual and the sign in screen is appearing now. Seems like another application that doesn't play nicely with WPAD files... Edited October 16, 2015 by gshaw
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now