Smoothwall: Filtering For Pupils At Home

[dhicks]

Hello All,

 

We have the Smoothwall Cloud Filter (v3.2.3) browser extension force-installed accross our Google Workspace (ChromeOS) devices and Windows Chrome browsers. When a pupil logs in to Chrome browser at home with their school Google and turns on sync, the extension gets installed in the browser, but doesn't seem to be able to filter anything.

 

I'm guessing this is the same / similar problem we've been having with using GCPW / pGina on our in-school devices - if we install the Windows Smoothwall client it sees the logged-in account as a "local" account, it doesn't report the full [email protected] account to the browser.

 

Is this something that is fixable / being worked on? Is there an option for home users (parents) to be able to use the school's filtering for their child at home?

 

Note: filtering on ChromeOS devices, school-managed ones or otherwise, seems to be working fine (as long as a pupil is logged in with their school account their school setting apply), this is a specific Windows (and, I guess, MacOS) issue.

[Joeloman]

The Smoothwall Cloud Filter is not intended to work on private devices.
It is extremely easy to bypass the filter when the devices are not managed.

 

Check with your Smoothwall contact if there is Qustodio's Schools Offer.
Since Qustodio, which is part of the same group as Smoothwall, is made for private devices and parents.

[synaesthesia]

Indeed as above - filtering on own devices should surely be a no-no regardless of the account being used. If it's the school device then it's a different ball game.

GCPW removes the windows side of things (the main reason I can't entertain it as an option) so filtering is browser based only. Too risky IMO.

 

[dhicks]

51 minutes ago, Joeloman said:

Since Qustodio, which is part of the same group as Smoothwall, is made for private devices and parents.

 

Ah, that makes sense - we can, hopefully, point the parents that way.

[tom_newton]

You can definitely point parents that way yes - talk to your CSM, they can probably arrange a talk for parents to introduce them to it.

 

It's kinda possible to make the extension believe it's on chromeOS all the time (in which case it looks to the browser for login - what you are seeing is extendion installed, but no username, so it wont start) but I think you might cause more problems than you solve.

 

Tom

[dhicks]

19 hours ago, tom_newton said:

It's kinda possible to make the extension believe it's on chromeOS all the time (in which case it looks to the browser for login - what you are seeing is extendion installed, but no username, so it wont start) but I think you might cause more problems than you solve.

 

Okay, so we have two separate problems:

- What do we recommend our parents do by way of filtering at home: looks like the answer is either "make sure your child is logged in to a Chromebook with their school account" (which needs supervision from the parent, but should be do-able for younger children) or "Use Qustodio", which is designed (and, hopefully, has suitable support) for home users.

 

- We have (Windows and MacOS) school-managed devices where the Smoothwall browser extension is not working properly because the Smoothwall client-side application isn't reporting the correct username to the Smoothwall browser extension. We are currently instead using our own client-side utility that reports the correct username to the on-site Smoothwall gateway server via iDex (would have been RADIUS but that seems to not work properly either), with filtering then done by the gateway.

 

However, now you seem to be saying there might be some way of forcing the Smoothwall browser extension to pick up the username from the browser. Can you explain this in more detail, please?

 

Has anyone at Smoothwall managed to get around to having a look at getting the Smoothwall Windows client to be able to report the username correctly if using a local / GCPW / pGina account (and ideally for MacOS, although I do appreciate that's a whole different architecture and set of problems to solve)? I don't know how your software is developed, but it would seem to be a relatively minor fix (just add an append-this-domain-name setting to the client, probably just a value picked up from the Windows registry).

[tom_newton]

Yes, Qustodio is fully supported and designed for home devices.

 

I would probably hang fire and wait until the GCPW support is sorted - I know there's a job there for it, I keep chasing.

[KDW1987]

I have been using the palo alto's new prisma browser solution now for a year and it would fix this issue . 

 

You have to get the kids to install a third party browser on their personal device. But once they have the browser installed and have logged in once, it cashes the user details when a user first logs in against that local user account and after a reboot it will sso them back into that account, making the whole user experience simple.  It works on both byod and managed devices, but the parent has to install that browser on the kids profile and remove all other browsers and admin rights to stop them installing exe.'s / other browsers etc.

 

The Prisma browser also has all the dlp, casb and data controls and  AI filtering capabilities to meet the DFEs new AI standards for kcsie and is cloud based SASE solution meaning it applies anytime, anywhere.

Edited March 6 by KDW1987