Smoothwall iDex and OSX 10.15 and above

[Mrpower]

I have been working on recording our internet activity on our smoothwall. I set up iDex on some Macs running 10.13. Yes I know, old , security, etc.. and they login fine.I could see the user and their internet activity. I installed the software on some newer Mac's running 10.15 and the smoothwall logs an initial login then it logs them out or they are logged out and never back in; even though they are still login on the Mac.

I have no AD; so it's just the Mac client and the smoothwall talking to each other. The setup seem to work happily on 10.13 but not on 10.15. Maybe its new privacy setting on the Macs? Anyone have any ideas?

[ibpalle]

It sounds like you maybe forgot to set the proxy to localhost:8080 after installing the software (iDex client) on the 10.15 devices?

[Mrpower]

It sounds like you maybe forgot to set the proxy to localhost:8080 after installing the software (iDex client) on the 10.15 devices?

 

Nope, I didn't forget. I was stumped by that at first, but I added the proxy setting while I was testing on 10.13 and all work fine, as mentioned above.

Update: After a test this morning, I noticed after about ten minutes the user according to user activity on the smoothwall, appear to be displayed as logged out. My test was on a Mac running 10.13 and 10.15, so both are doing the same thing.

Is there a log I can look at that might give me an idea of what's happening?

Edited November 18, 2022 by Mrpower

[ibpalle]

The reports - realtime - system and select authentication from the section drop down list. You can see the static logs in the logs menu as well.

 

It sounds like the login follows the timeout of 10m - is that the value set in the services - authentication - settings for the global timeout?

 

The login is done when the iDex client interface gets traffic. Could it be that the device is not actually sending traffic via the proxy settings and thus the login times out? If you browse after a logout, does a new login appear?

[Mrpower]

Yes the time out was set for 10 minutes I have set it for about 7 hours about 420 minutes.

"If you browse after a logout, does a new login appear?" This would suggest the I can use idex to authorise a login through the proxy on the firewall. I tried directing the devices to the proxy on the smoothwall but it would not authorise the login, with the method of Core authentication (according to your help documents).

Basically I was unable to get any proxy authorisation to automatically recognise the user without a pop up login window after initial login. For example: you open a browser like chrome a pop up appeared with login. This also broke my mdm management as the server and client could not talk to each other without a login.

I did make a support ticket with smoothwall, but I haven't heard anything back for a week now.

[ibpalle]

The iDex client has built-in identification and attaches user/group info to all requests going to the Smoothwall. They should show as 'iDex client' logins in the method column in the services - authentication - user activity list. If you redirect the system to a normal proxy, not the iDex client, there will be no logins from the iDex client.

 

When you see the clients logged in to the Smoothwall, in the user activity list mentioned above, what is the method for the login?

[Mrpower]

The Current login method uses a OpenDirectory / LDAP. I have added the OpenDirectory / LDAP in Authorisation / directories. As staff are using VPN and they are Authenticating off the OpenDirectory / LDAP.

 

Even without a proxy setting added, the active web filter report dose not seem to record all activity. for example, my daily report, has the IP address not the username when I tested accessing a restricted webpage.

[ibpalle]

Your directory is irrelevant in a sense - at least for the iDex client. It takes the username of the logged in user, if it can find it and use that. With iDex clients browsing, do you see any iDex client logins in the services - authentication - user activity?

[Mrpower]

Yes, users appear in "logins in the services - authentication - user activity", as mentioned before, but now with the idle time increased, they are login for longer. Yesterday I was doing some testing with an old iPad to try to work out a method that works well for iPads. I had accessed a restricted website and the realtime report acknowledge the blocked site, but did not report the access in my alert. can I update the alerts to cover this?

[ibpalle]

And was the method iDex client for the logins you saw? The reason I keep asking this is that I would not expect iDex client logins to follow the timeout value but it's been a while since I have used it so I could be wrong.

 

As for alerts - what alerts are you talking about - I am assuming safeguarding notifications? Those notifications are based on the safeguarding rulesets in our blocklist. If you have a site that you would consider to be Porn for example but Smoothwall does not categorise it as such, add it to the Porn category so it can be included in the Adult category alerts in notification for example.

 

You can add content to the standard categories in the guardian - policy objects - categories.

[Mrpower]

Thanks for your help. I discovered that our anti-virus software seemed to be coursing 50% of the issues with iDex. Regards Alerts and safeguarding. I have spoken with other people at Smoothwall about setting up cloud filter and cloud monitor. The wheels are in motion for Cloud filter and I need to talk to the safeguarding officer about the Monitor.