Embc user level filtering

[SpuffMonkey]

Is anyone else's internet completely down? Ours went off late on Thursday night and still isn't back - which is irritating as I was supposed to be doing some remote work...

[GrumbleDook]

See my above post.

[apinnard]

Fine by me. I couldn't be arsed to remote work this weekend anyway. Too many chocolate eggs to wade through.

[karend]

All seems to be ok apart from a nating issue in Derbyshire which is being investigated and does not affect other LA's.

PCF issues have been resloved and will undergo further testing today as will the whole of the embc estate to ensure all is ready for tomorrow 7am

Un-migrated websites and 3rd party hosted services are the only exception to the tues 07.00 deadline.

School websites - currently still have a target of wed morning to re-enable legacy webservers.

If any other information arrives during the day I will post asap.

[Edu-IT]

Should everything be accessible again now then?

[GrumbleDook]

From what I can gather the sections are coming online as validation is being completed. One of use will put an update on around 8pm, unless more information is available sooner.

 

If you have a specific query please feel free to PM me.

[PRicho]

Strange, i can VPN into our site via our external IP of our ISA, yet it seems port 80 isnt open on the same IP as non of our websites work.

 

guess i should wait it out :-)

[kmount]

Check your public IPs as we're seeing different results based on the IP.

 

IE, 83.X is fine, but 213.X is dead.

[GrumbleDook]

I have issues with NAT on both ranges, but some of that may still be a hangover from Network Solutions cocking up my DNS.

 

Ok ... so I use a .com and it couldn't be transfered with the rest of the .uk domains that have DNS hosted with EMBC ... but that isn't a problem. I just got to eh control panel on our account at Network Solutions and tell them to use the new name servers.

 

5 bloody days of trying and it being reset to the old FJS name servers ... and no repsonse from Network Solutions via email. Finally I ring up and have find out what the issue is. The drone on the phone talks me through what I should be doing and wants me to try and then ring back ... I get *him* to try it whilst I am on the phone.

 

"Sorry sir, this doesn't appear to be working"

 

Really? What a surprise!

 

"I am not sure why this is a problem. Please hold whilst I consult with a colleague."

 

He goes to find the person with the duty brain cell.

 

"Thank you for waiting sir. I have checked with both a colleague and a senior colleague and I will have to escalate this to 2nd line."

 

Do you have an idea why it isn't working, I asked?

 

"It may be that there is an issue with the domain. Are you sure it is a valid domain? There are some strange ones out there in use by 4th tier ISPs."

 

Now, no matter what people may moan about with RBCs, NEN and JANET ... I would not call them or any company with a contract for them a 4th tier ISP. I express this opinion.

 

"Janet? I'm sorry sir, I am not sure that i know her?"

 

I explain about a rather hefty backbone for the UK academic setup, the links with centres of research, connecting into a government structured network ... I them ask him to cast his mind back to a similar setup in the US based around academic institutes.

 

"I'm sorry sir, I am not sure what you are referring to."

 

ARPAnet?

 

"I think you must be mistaken sir, that was all military."

 

I sigh ... I accept that this is a drone and that the best thing I can do is just get some definite answers on action that will be taken rather than explaining the history of how the internet was designed, built and is still maintained to this day.

 

I ask what the process is for this escalation.

 

"First we have to check if is a valid domain."

 

Can you not do this now?

 

"Ok sir, but it will only be checked again by second line... ah ... I think I see what the problem is. It may be that the domain is thought to be a subdomain."

 

A subdomain? Of what?

 

"Why, of uk.com sir?"

 

Is uk.com not a valid cTLD?

 

"You may be right sir, but our system appears to be confused about it. It would take one of the 2nd line guys to deal with this anyway. I have your contact details as "

 

Can you also email an additional address as we will not have access to emails on the domain due to network switchover this weekend.

 

"Oh, don't worry sir, it will take up to 3 working days to deal with anyway, so your email should be back on by then."

 

I mentally count days from Thursday until Tuesday and try to work out how many of those are working days.

 

"That means it will updated on Monday at the latest sir."

 

I thank him, as he has been very polite, and worry that I will have to chase this on Monday. I get back from a weekend in London to find that this is still not fixed, the name servers are not registered correctly and so I have another go at doing it .. and it works. 2 hours later and everything seems fine. In fact ... I check the EMF delivery logs and from Friday most traffic has been going there anyway. Oh well ... something has worked somewhere.

[kmount]

Heh, sounds like HP first line support

[GrumbleDook]

Ok, a quick update for EMBC users.

 

The work is ongoing and will be completed by 7am tomorrow as planned.

 

The Proxy has been migrated so those using proxy.embc.uk.com will now have the correct service. Those schools that have not changed their proxy settings yet, do not worry ... DNS spoofing with the EMBC means that proxy.embc.org.uk points to the same proxy. You do not need to do any more at this time.

 

Those with local control of filtering can administer their school's access by using the http://webfiltering.embc.uk.com and the username / password previously used to administer NetSweeper under Fujitsu.

 

NAT / firewall rules - It would be an idea for schools to partner up with another school for testing. If you are using the proxy for all traffic (including to other embc schools) then you can test whether the firewall rules are working properly by accessing the website of another school. eg, I can test stuff for kmount and he can test for me. If you are still unsure whether it is working you need to log a call with the helpdesk, but it may help to have the original external IP request to hand to aid with this. I may also be able to provide some assistance for testing from an outside source to but PM me separately about that please.

 

The EMBC hosted web servers should be back up on Wednesday morning. That have had a lift and shift to the new location to help with this. If you have a query about your EMBC hosted website please wait until Wednesday before making a call should there still be an issue.

 

Please make sure that you check your LA portal on EMBC or the top level portal for any updated documentation. This includes administrative guides for NetSweeper, EMF and so on.

 

We will shortly be uploading flash videos on how to change proxy settings etc, which we would appreciate you sharing with your feeder primaries.

 

Thanks for your patience over the weekend.

[kmount]

So much for this 2 weeks holiday then! (Mutters)

[john]

Least they are keeping you informed unlike a northern LEA who have only since Sept really started keeping us informed montly of the joys of the ISP and email systems, which are again not working, but I believe there considering looking into Exchange and Dominio which is a much better idea IMHO.

[apinnard]

A couple of things I have noticed this morning:

 

1) When a user goes to a "blocked" page (i.e: Bebo.com) instead of the NetSweeper warning, they get the EMBC login page. We don't have users login here so I am not sure why this is appearing!

 

2) Our website (http://www.latimer.org.uk) and mail server are still unavailable externally. This is actually hosted internally by us but the domain is done by EMBC.

 

3) We send email from our own exchange box mail.latimer.org.uk with the email addresses [email protected] but whenever we send external emails this morning it bounces back saying "You do not have permission to send to this recipient. For assistance, contact your system administrator."

 

Apart from that, not bad for first thing in the morning!

Edited March 25, 2008 by apinnard

[kmount]

Big smiles Alex!

 

1) I would imagine that as a default if a user isn't logged in and try and request a page which could feasibly require escalated privileges, it offers them the opportunity whereas if they were logged in and tried the page it would just refuse.

 

2) I note both your www and mail are two different IP's. - Having checked a few bits externally, I conclude that accessing your mail.* box is OK (OWA/RDP comes up), but nothing on http://www.* responds.

 

3) With the above in mind, I think you need to look at your exchange relay configuration as to why it won't allow you to relay upstream. (Do you have the techy guide on the migration?)

 

HTH.

[monty]

I've got some problems with email this morning too. Can't send any email, they get returned saying client not authorised if I use the old SMTP relay host, and if I use the new one I get Relaying not permitted.

Also we collect our school email from a pop box (legacy thing but it works fine normally), however our email server cannot now pick up form the pop box we just get a connection timeout.

Oh yea and loads of complaints that staff couldn't access the servers over the weekend.

Any one got an idea on the email bit though?

[kmount]

Hi Monty,

 

The servers over the weekend job was the migration which heads@ should have been aware of and had your staff logged into the platform they'd have seen it. (Not that they'd do that ... eh;))

 

As for the connection timeout, this is worrying but could possibly be because the email server doesn't have POP3S enabled for the account. (IE, its running secure pop over port 995).

 

Relaying not permitted suggests that the outbound mail account details don't have "use authentication" with the 'EMBC Username' as the username, IE, in my case kimm7.

 

Just to confirm, your internal server grabs ALL of the mail for the school and then you have accounts internally configured on this mail server which is where your users get their mail? - If so, it suggests the above paragraph could be true.

 

Nobody should be using mp.embc.org.uk anymore as there's no guarantee it'll work and to be honest, it will only compound your headaches.

 

Might be worth giving Synetrix a ring...

[monty]

I've not had a problem with the pop collector before, I use EFS to collect then pass onto the exchange server. I can only assume it has something to do with the change, but I have no idea what I can do to check this. I can locate the pop server through dns, just get the timeout when trying to pick up the pop box.

The relaying thing probably is the username as we have never used one so it's not on the exchange server, I don't even remember seeing anything that said I had to put in a username and I've no idea what it could be.

I've placed a call with synetrix and asked for password details for the portal, because I can't get on to see the documents without logging into the portal (webview was a saved password and I lost the written one in the move), according to synetrix I don't have a password and have never had one and they will try and call me back later.

[apinnard]

Big smiles Alex!

 

1) I would imagine that as a default if a user isn't logged in and try and request a page which could feasibly require escalated privileges, it offers them the opportunity whereas if they were logged in and tried the page it would just refuse.

 

2) I note both your www and mail are two different IP's. - Having checked a few bits externally, I conclude that accessing your mail.* box is OK (OWA/RDP comes up), but nothing on http://www.* responds.

 

3) With the above in mind, I think you need to look at your exchange relay configuration as to why it won't allow you to relay upstream. (Do you have the techy guide on the migration?)

 

HTH.

 

I have changed the deny page to the system default and now this is working fine.

 

Points 2 and 3 are still valid though!

[kmount]

What port are you trying to talk to the POP3 on? (Even if with telnet, it should connect to 995 but not do much more useful). - I'm wondering if you've got an internal firewall or something which is blocking the connection as even from the outside (where i am now) I can see the mail server on mail.embc.uk.com port 995.

 

Previously (prior to mirapoint), it was possible to relay without needing a username which is possibly how you've done it thus far with no problem.

 

Don't use webview, its due to disappear, persevere with Synetrix and you'll get your details from them.

[kmount]

Aye, point 2 (sub mail) is fine IMO but the www is broken for sure.

 

As for point 3, what are you relaying/smarthosting to and do you have credentials in there? ie, pop your own embc details in there for apinnard and see if that fixes it. (Not a great fix, as it should be generic).

[apinnard]

Hi Kim

 

Yes, https://mail.latimer.org.uk (OWA) is now working fine. http://www.latimer.org.uk however is not.

 

I am smart hosting to smtp.embc.uk.com and there are no credentials in there. We don't use the EMBC mail here at all, it's all [email protected]. Nobody (except the head/senco/bursar) has EMBC email accounts

[SpuffMonkey]

our Citrix portal and logmein connections are both broken since Thursday - any ideas anyone?

[vikpaw]

Those with local control of filtering can administer their school's access by using the http://webfiltering.embc.uk.com and the username / password previously used to administer NetSweeper under Fujitsu.

 

Well i'm glad i thought to check here for an update as ringing the Synetrix helpdesk an hour ago i was told that "i haven't had a chance to catch up with all the changes at the weekend". Blimey, nor have we!

 

He also wasn't even aware of the new website for filtering which you'd think would have been published somewhere else more prominent and perhaps added to a quick fix sheet given to all helpdesk staff.

 

Still, if a change really is as good as a rest, we should all be mightly relaxed by now...

[monty]

What port are you trying to talk to the POP3 on? (Even if with telnet, it should connect to 995 but not do much more useful). - I'm wondering if you've got an internal firewall or something which is blocking the connection as even from the outside (where i am now) I can see the mail server on mail.embc.uk.com port 995.

 

Previously (prior to mirapoint), it was possible to relay without needing a username which is possibly how you've done it thus far with no problem.

 

Don't use webview, its due to disappear, persevere with Synetrix and you'll get your details from them.

 

Plain old port 110 for gathering the POP account, no internal firewall blocking that either.

Should they be able to give me the email username over the phone? The woman I spoke to this morning didn't seem to have a clue and would only pass my information on.