Proxy PAC

[itgeek]

Hi, I am looking for a way to deploy proxy.pac file so staff can use the laptops at home.

 

What is the best way to deploy the proxy.pac file to users, as I don't have the option for the Internet Explorer Maintenance/Connection/Automatic Browser Configuration?

 

Thanks

[LeMarchand]

When we used a proxy.pac the laptops defaulted to "direct" if they were unable to connect to it. As a consequence we never did anything "special" to allow staff to connect at home. You could test by hotspotting one to your phone.

[chaplic]

You cannot host a pac file via a file:// URL any more which is annoying.

 

It's a helluva bodge, but back in the day I ended up writing something that setup IIS on the PC, popped a proxy.pac in the wwwroot directory and configured it up, the last proxy returned was DIRECT which meant when it couldn't find the proxy it routed out direct, which worked at home. Not sure I'd reccommend it, but it worked.

 

Today, Intune can configure a per-WiFi proxy setting so that's what I use and presumably it's doable by the config tooling of your choice.

[mavhc]

Use wpad, if computer finds wpad computer, it uses the pac file, if it doesn't, it connects directly

[LeMarchand]

I thought wpad was/was being deprecated due to security concerns?

[tom_newton]

I would avoid doing this if I could - but if you have to, push the pac file via AD, and (it's a while since I have done this) as long as the pac file is unavailable, the browser will go direct.

Your other option is to produce a PAC that recognises your network by IP range.

 

WPAD is definitely something that's going away for security reasons.

 

Ideally, you'd put a filter client on staff laptops, so they could be filtered wherever. If you are a Smoothwall user, I can help you get started with that. If not, we could probably work something out for your staff.

[mavhc]

I thought wpad was/was being deprecated due to security concerns?

 

You can do the same with just specifying a pac file in autoconfig, and when it's not available it'll default to direct access

 

If you don't trust your LAN that's one problem, but as everything is https, that's probably fine.

[Andycat]

 

Ideally, you'd put a filter client on staff laptops, so they could be filtered wherever. If you are a Smoothwall user, I can help you get started with that.

 

Is this an extra cost on top of Smoothwall?

[dmj]

For WPAD to be a risk, the attacker would have to setup a fast DHCP/DNS server to redirect to an incorrect pac file, then setup a proxy to sniff for passwords. I would say that if you already have 802.1x on the network then WPAD would be fine for most applications. Its really convenient for devices without any MDM and dead easy to configure.

[tom_newton]

Is this an extra cost on top of Smoothwall?

 

No, you should already have the licence

[Andycat]

No, you should already have the licence

 

Ah we definitely need to explore this then!

[tom_newton]

For WPAD to be a risk, the attacker would have to setup a fast DHCP/DNS server to redirect to an incorrect pac file, then setup a proxy to sniff for passwords. I would say that if you already have 802.1x on the network then WPAD would be fine for most applications. Its really convenient for devices without any MDM and dead easy to configure.

 

Agree that WPAD isnt a risk on a trusted LAN, but the thinking goes that WPAD is a risk if your device sniffs for wpads on untrusted LANs - that's why in general browser folks are stopping support. It is the sort of thing I wouldnt rely on hanging around, working reliably or getting bugfixed is all.

[mavhc]

Which browsers/OSes are dropping support for WPAD?

[tom_newton]

Which browsers/OSes are dropping support for WPAD?

 

I dont know any definites, but I have heard rumours

[mavhc]

Any major change to functionality would be preceded by deprecation warnings for many months if not years

[chazzy2501]

I actually use the wpad / DHCP method, the DNS method conflicted with Direct Access. it has been solid for years. (windows only)