Smoothwall SG in non transparent mode not authenticating users

[ssiruuk2]

I had a bit of a nightmare yesterday with our terminal server farm, for some unknown reason as of yet they stopped applying their proxy settings within IE as configured in the GPO locking down the os..

 

Anyhow, I battled and battled with this and got nowhere. Ended up setting up a second School Guardian server for these TS servers to run through but in non-transparent mode to get me out of a hole.

 

Its working fine apart from I cannot authenticate any users, in the realtime web logs you just see the ip of the TS that each user is on. All the LDAP settings are fine, all green lights under diagnostics in the smoothwall ui and I can browse groups via AD in the web console etc.. set the authentication type to "proxy", "proxy terminal services compatibilty or redirect to SSL login and the students can go on the internet without any pop up asking for credentials..

 

Any ideas as I'm stumped now!

 

Thanks

[andyrite]

Have you got a computer account in AD for the smoothwall box?

Are the dns entries correct? Needs both the forward and reserve lookup zones to be correct.

[tom_newton]

If you aren't seeing usernames, it's definitely guardian, rather than the auth component.

 

Suggest "NTLM authentication (TS Mode)" in guardian/auth/settings

[ssiruuk2]

 

Shows how tired I was this morning.. I meant this new box is in transparent mode not non transparent.. duh - sorry! So can't choose NTLM auth Could someone please change the title?

 

I have set the default gateway of the TS servers to go through this new smoothie as I can't force the proxy settings at the moment in the browser through GPO.

 

DNS seems to be setup fine - This smoothwall has an A record and PTR record in the reverse lookup zone. Theres no computer account in AD for the smoothwall though, I didn't think it could join the domain like that??

[tom_newton]

You *should* be able to do NTLM in transparent. It works slightly differently but the end result is the same. Wether you can still do TS mode I am not convinced, but modern TS installs (where each client has its own IP) dont seem to need this.

[ssiruuk2]

Hi Tom

 

You cant choose NTLM ident or auth if your in transparent mode. The Smoothwall throws up and error at the top of the page and says its not available in that mode.

[tom_newton]

Hm. What version of guardian is it? I distinctly remember helping to design the hack that allows such abhorrent tomfoolery

[ssiruuk2]

Hm. What version of guardian is it? I distinctly remember helping to design the hack that allows such abhorrent tomfoolery

 

We are using School Guardian 2008 - with all the latest updates applied

[tom_newton]

I've just done it on '08 here :-/

(Well, NTLM ident, coz i don't have my test box attached to AD)

 

Try the lads in support - they may be able to help you out.