Transparent NTLM authentication - Advice

[pooley]

Our LA has just changed from using ISA 2000 to ISA 2006 to supply our Websence filtered Internet.

 

I (and many other schools in our LA) have been using Python and NTLMaps (setup locally) so he children?staff do not have to enter a username and passsword to get onto the web.

 

Problem is that ISA 06 and Ntlmaps do not want to play ball, have tried various versions of Python and Ntlmaps, played with the settings etc but it just wint work correctly. I.e. it will allow you to get to bbc.co.uk but click on a link and it just stalls. (logs give 407 errors)

 

Anyways i'm looking for a proxy authentication replacement, I know I can attempt to install and configue ubuntu and squid, but is there anything else I could be using, I dont need the web filtering/cachine abilities of squid/dansguardian I just want an easy life and not to try to confuse staff with yet another Username and password to remember.

 

Any idea's?

 

Si

[psybernoid]

Hi Si,

I'm currently trialing both Squid & Tinyproxy in OVPS - as oddly enough, I'm hit with the same issue as you

 

Currently have Squid running ok, just https requests are proving problematic.

Working on getting squid up & running as a priority (along with the caching) on both windows & linux platforms.

Tinyproxy however, requires as postix platform, so not putting as much effort into that due to most sites not having the capability to run it.

 

As soon as I have a soloution, I'll let you know. Conversely, if you come up with anything....

[tom_newton]

NTLM-v1 vs NTLM-v2 problem, perhaps? Looks like APS does not support NTLM v2. Squid may be able to upstream-auth as NTLM v2. I'll ask a squid expert.

 

Edit: or, if your LEA are kind, they may be able to make the websence box use v1. Think it is a registry fudge, but I am wandering out of kansas here, as far as my knowledge of websense/ISA goes