Smoothwall Authentication Woes

[Gatt]

Ok not yet sure how or why it happened as we are still investigating but...

 

We have just had a spate of users being able to get un-filtered access to the Internet through Smoothie

 

I ran a check on our Authentication Service and noticed that the "Authentication service LDAP server connection" was "CLOSED"

Rebooted smoothwall and its now re-opened

 

However - Pupils have been on all sorts of websites all morning (Facebook, Youtube, etc)

 

We can still see their Names/IP's in the web filter logs as normal so we know who was accessing the sites and when, etc

 

The reboot appears to have re-enabled the filtering again - thankfully!!

 

So a couple of things I need to find out

 

1) What happened? Authentication Problems?

2) How do i stop it happening - can smoothie be set to block all by default (ie all un-authenticated users, no connection to AD, etc)

[ssiruuk2]

You can set "un-authenticated ips" to filtered, unfiltered or no access through the proxy. Maybe yours is set to unfiltered?

 

Have a look under Guardian > Authentication > Settings.

 

edit:just realised you said you can still see their usernames in the logs so they won't be classed as "unathenticated ip".

[Gatt]

The Un-Authenticated IP's wasz the first thing I thought of too, but yeah the fact that I get their usernames threw me as that would indicate authenticated IP's

 

[tom_newton]

Check your policy for "default users" as well - that's someone who's name we know but who we don't have a group set up for.

 

Odd AD closing issues sound like something to look into though - owt in t' logs?