Smoothwall Filtering/Authentication

[lmrogers]

Good Morning,

 

Hopefully a quick one that someone will just know. Our cashless catering server (canteen PC) runs the SquidSync application to sync payments up and down students Squid accounts. This week however it is throwing an error 407 proxy auth required.

 

I have added the machine's IP (set static) into the Smoothwall exceptions (Guardian - Web Filter - Exceptions) so that it should have unfiltered Internet access, but it is still prompting the 407 proxy auth required error.

 

I have also allowed the domain that it is trying to connect to in the filter.

 

Am I missing something or doing something wrong?

 

Cheers

[TechMonkey]

I think if they are in the Exceptions list you should use port 801. The alternative is to add the destination into the Bypass Authentication content list (maybe called something else).

[lmrogers]

So I have added the destination URL into the Bypass Authentication now and still getting the same error. I can browse the internet on that computer quite happily with no prompts but if I go to like the Network Settings page in Windows I then get a Smoothwall authentication prompt. Enter a login details in there and it doesnt accept and keeps asking. I thought adding the machine IP into the exceptions would not require the computer to try and authenticate?

[TechMonkey]

Did you change the proxy port?

[Jcx500]

Have you added the proxy to NETSH?

[ibpalle]

Good Morning,

 

Hopefully a quick one that someone will just know. Our cashless catering server (canteen PC) runs the SquidSync application to sync payments up and down students Squid accounts. This week however it is throwing an error 407 proxy auth required.

 

I have added the machine's IP (set static) into the Smoothwall exceptions (Guardian - Web Filter - Exceptions) so that it should have unfiltered Internet access, but it is still prompting the 407 proxy auth required error.

 

I have also allowed the domain that it is trying to connect to in the filter.

 

Am I missing something or doing something wrong?

 

Cheers

 

You have done something wrong You have added the source IP to exclusions but are still using proxy settings. Here are a couple of solutions:

 

1: Find the domain the SquidSync application connects to and add that to an authentication exception in web proxy - authentication - exceptions.

2: Create a location in guardian - policy objects - locations with the source IP and add an auth policy in web proxy - authentication - manage policies for that location to not require authentication and treat unauthenticated requests with the appropriate group membership for the access from that system.

[lmrogers]

You have done something wrong You have added the source IP to exclusions but are still using proxy settings. Here are a couple of solutions:

 

1: Find the domain the SquidSync application connects to and add that to an authentication exception in web proxy - authentication - exceptions.

2: Create a location in guardian - policy objects - locations with the source IP and add an auth policy in web proxy - authentication - manage policies for that location to not require authentication and treat unauthenticated requests with the appropriate group membership for the access from that system.

 

I have tried both those suggestions and could not get either to work.

[ibpalle]

Ok, any new symptoms from the system that I can use to help you further and are there any log entries you can see in the reports - realtime - web filter once you filter for the source IP? Also, could you show me the auth policy you added for the location - just want to check that the sequencing is correct as that policy obviously needs to be in place before the generic ntlm auth policy. Edited March 10, 2021 by ibpalle

[DGardiner]

If you have added it to the guardian source exceptions you may need to add a firewall rule to allow traffic from that ip outbound as the transparent proxy wont pick up the connection.(depending on firewall config)

 

Though if youve added it to exeptions and its still getting a 407 that would suggest the device has a explicit proxy set?

[lmrogers]

So the computer has no proxy set, just ticked to Automatically detect/configure like most by default. @ibpalle I will send you a PM with screenshots of the policies.

 

Error is still the same in SquidSync, cannot get the smoothwall prompt now to ask for credentials and have confirmed the unfiltered access appears to be fully unfiltered.

[ibpalle]

Is the error from SquidSync the same as before? If so, are there proxy settings in the SquidSync application and if there are, can you remove them?

[DGardiner]

So the computer has no proxy set, just ticked to Automatically detect/configure like most by default. @ibpalle I will send you a PM with screenshots of the policies.

 

Error is still the same in SquidSync, cannot get the smoothwall prompt now to ask for credentials and have confirmed the unfiltered access appears to be fully unfiltered.

 

a longshot, but would it not be possible to use ident by location? and add a location that contains that fixed ip? Not played with it so not sure if it overides the proxy auth config but just thinking out loud!

[ibpalle]

Absolutely possible but not needed - I think we should troubleshoot why any of the 4 options given so far does not seem to be working first. Are there proxy settings on the SquidSync application?

[lmrogers]

Just got to wait for our Squid support to get back to me. I don't have any passwords to get into the config of the Squid app.

[ibpalle]

One thing to try while you wait is to go to the reports - realtime - web filter and add the systems IP address to the filtering field. Then fire up the SquidSync app and see if there are any entries in the web filter logs. If there is to much chatter traffic, close other apps running on that system and also try adding the word 'denied' to the category field as that will show only blocked requests. You should be able to see where the app is going if it's still using the proxy.

 

If there is nothing, go to the firewall section in the realtime area and add the system IP address as a filter and try to refresh/open the app again. This should show you if any firewall rules are blocking the traffic.

 

Additionally, a lost of ports and protocols used by the app as well as where it's trying to go, would be a good list to get from the provider.

[lmrogers]

Just had a remote session with the Squid support team and we have some more information. There is no proxy settings within the SquidSync app. No proxy settings on the local machine. Fully unfiltered access and no authentication, however when you try and use IE 11 then Smoothwall is prompting for authentication and no matter what credentials I use it just refuses and keeps asking for credentials.

[ibpalle]

Then obviously none of the suggestions I made earlier has been implemented correctly.

 

What is the IP of the system and can it be set to be static?

Where is the app going - what domains is it accessing?

Did you add a no authentication policy for a location including the IP of the system - if so, send me a pm with a screen of the location and the auth policy you added.

Did you add the system IP to exclusion in Guardian - web filter - exclusions?

[lmrogers]

Then obviously none of the suggestions I made earlier has been implemented correctly.

 

What is the IP of the system and can it be set to be static?

Where is the app going - what domains is it accessing?

Did you add a no authentication policy for a location including the IP of the system - if so, send me a pm with a screen of the location and the auth policy you added.

Did you add the system IP to exclusion in Guardian - web filter - exclusions?

IP of the machine is static.

App is going to https://secure.squidcard.com which I have also allowed in the web filter as well as added to an authentication whitelist.

I have tried to send you a PM with a screenshot of the polices created but EduGeek says it contains too many characters for some reason.

The static IP has been added as an exclusion in there.

 

I have managed to get IE to authenticate with my credentials, this then allow IE web access but the sync app still errors with 407 Proxy Auth Required.

[ibpalle]

So obviously the auth exception for the domain or the auth proxy exception policy for the systems static IP has not been implemented yet. Go to web proxy - authentication - exceptions and check what categories have been added to the exceptions field. Add the domain 'squidcard.com' to any of those categories and wait for 15s - then try again.

 

If you would like to exclude the entire system from requiring authentication, then make sure that there is a no authentication policy for the proxy, using a location with the systems static IP in the where field and make sure it is listed before the authentication policy asking for NTLM or Kerberos.

Edited March 11, 2021 by ibpalle