Android 13 or 14 / Smoothwall / www.google.com

[timbo343]

I've posted part of this post on another thread - here is part of the issue:

 

On Android 13 (and possibly 14) there is no way to get the devices to use the MitM certificate and for the device to present to the user as being "online". The only way i can get this to work is if i Do Not Inspect Google as this is where the device is communicating to. If I unblock Google then the Google searches at Google are not filtered.

 

I've tried to not filter or decrypt the following:

 

- clients3.google.com

- connectivitycheck.android.com

- connectivitycheck.gstatic.com

 

However it does seem to be Google which is where the phones are looking to for internet connectivity.

 

To go on from this, i've now been told that Android 13 / 14 phones will not connect to gmail.com services using the Gmail app whilst we are inspecting traffic at Google.

 

The only way round this is to allow Google however doing so breaks inspected searches when searching at google.com which all android phones default to.

 

@tom_newton or any other Smoothwall employee on here, is there a way to sort this? More than happy to spend some time troubleshooting this issue with you as this needs to work. The only other option is to not inspect google.com searches on android devices.

[synaesthesia]

With ever increasing resistance against MITM systems from just about all the major players, it appears one of the only really likely ways forward are managed browsers rather than MITM filtering - a case of you can't have your cake and eat it for privacy & security as well as safeguarding. It's certainly getting more and more difficult for companies like Smoothwall to offer protection otherwise, so interested what the general consensus is here.

[TechMonkey]

With ever increasing resistance against MITM systems from just about all the major players, it appears one of the only really likely ways forward are managed browsers rather than MITM filtering - a case of you can't have your cake and eat it for privacy & security as well as safeguarding. It's certainly getting more and more difficult for companies like Smoothwall to offer protection otherwise, so interested what the general consensus is here.

 

Which is interesting as the DfE is getting more and more hardline on filtering. More schools moved away from hardware to DNS filters or URL only filters, and then DfE announce schools should be content filtering. I don't know the answer really and you may be right, secured browsers that are allowed out, and other browsers blocked.

[tom_newton]

Are these BYO google devices or school owned?

[timbo343]

Are these BYO google devices or school owned?

 

They fall into both categories.

[tom_newton]

Android agent will be the answer for school owned. You want a beta next week-ish?

 

Tom

[TechMonkey]

Are these BYO google devices or school owned?

 

For me it is BYOD, which I know is a rod for our own backs!

[timbo343]

Android agent will be the answer for school owned. You want a beta next week-ish?

 

Tom

 

@tom_newton - yes please!

[Jonathaniel]

We're also seeing this issue with BYOD Android and ChromeOS devices - is there any way to get around this whilst complying with KCSIE's requirement to capture search terms?

[DrCheese]

Android agent will be the answer for school owned. You want a beta next week-ish?

 

Tom

 

Hi @tom_newton - When you say Android agent, do you mean a version of smoothwall browser similar to the iOS agent? If so... Would love a copy of the beta as trialing some Android school owned devices

[timbo343]

I've been working with the Smoothwall Developers and the app is slowly coming together, still a bit of work to do but Smoothwall have made a lot of progress in the last couple of weeks.

 

- - - Updated - - -

 

Hi @tom_newton - When you say Android agent, do you mean a version of smoothwall browser similar to the iOS agent? If so... Would love a copy of the beta as trialing some Android school owned devices

 

It doesn't quite work like that, it's essentially a VPN app.

[tom_newton]

Hi @tom_newton - When you say Android agent, do you mean a version of smoothwall browser similar to the iOS agent? If so... Would love a copy of the beta as trialing some Android school owned devices

 

Fling me an email you'll get set up. As our first Beta tester (Tim) says - this time we havent gone down the custom browser route (yet - I suspect there will be one at some point, or an extension if chrome supports)

[timbo343]

Would like to give further updates to this if you don't mind @tom_newton

 

On Android14 we have it working via Google Workspace however the prereq is that you need to assign your users Google Education Plus licenses to allow the Smoothwall Filter App to install the VPN settings.

 

You will need the quoria certificate from Smoothwall to be pushed to the devices.

 

The user is identified via a variable which is linked to the "work account" on the device.

 

Looking into issues on Android12 / Android13

[tom_newton]

Tim - you are welcome to update on this, glad you are making progress

[ibpalle]

The 'Capture Portal' category may need HTTPS exclusion on-prem to allow for urls like connectivitycheck.gstatic.com to be processed without interference.

[TechMonkey]

The 'Capture Portal' category may need HTTPS exclusion on-prem to allow for urls like connectivitycheck.gstatic.com to be processed without interference.

 

I seem to have an "Android Connectivity Checks" category set like this. Doesn't seem to be a custom category so could this be a legacy category?

 

I'll add the Capture Portal to that rule as well as it seems like a good idea.

 

EDIT: for future adventurers, it may be named "Captive Portal"

Edited April 19, 2024 by TechMonkey

[timbo343]

Would like to give further updates to this if you don't mind @tom_newton

 

On Android14 we have it working via Google Workspace however the prereq is that you need to assign your users Google Education Plus licenses to allow the Smoothwall Filter App to install the VPN settings.

 

You will need the quoria certificate from Smoothwall to be pushed to the devices.

 

The user is identified via a variable which is linked to the "work account" on the device.

 

Looking into issues on Android12 / Android13

Update on Android 12/13.

 

I have been testing on my own personal phone with a Google Workspace profile. This means there is a personal profile and a work profile on the phone.

 

The personal profile is linked to my own @gmail.com account and the work profile is linked to a test school account in Google Workspace.

 

The smoothwall filter will only filter chrome browsing activity when signed in with the test school account used on the personal profile. It will not filter personal accounts @gmail) or non-signed in chrome browsers.

 

If you use the chrome browser on the work profile the smoothall app will filter the browser.

[ITGuyNW]

2 year old thread revival

 

I am testing BYOD and no matter what I do, gmail app will not sync when we use any Wi-Fi point through Smoothwall. Gmail website works fine, also the other items such as drive sync fine.

 

I have tested this on Android 14 and 16.

 

I have tried HTTPS inspection/Do not inspect/ validate certificate with no difference in result.

 

Anyone come across this?