Recommendations for DIY based Proxy Solution

[Davit2005]

We have quite a small network max 200 workstations and our OLD Proxy box is in pensionable status.

 

Has anyone gone down this DIY route and what combination did they use. I could go down the MS route (i.e. Microsoft ISA Server with some sort of proxy/filter plugin). Hardware Costs, Renewal Costs and Support costs are the biggest limiting factor while trying to achieve a reliable and easy to administer solution.

 

I thinking of setting up a DIY Linux based Proxy solution as only the most simple proxy filtering is required. Have had experience of setting up/administering BLOXX and Sophos filter boxes in previous employments.

 

The Requirements are:

Basic Content filtering (i.e. DansGuardian)

Simple to use/setup/administer/backup/GUI interface

Authenticates to Active Directory - for security group based filtering

Blacklists, Whitelists, banned words

 

I've spent a few days playing with Ubuntu/Squid/DansGuardian on a Virtual Server and managed to get a working system at home (thanks to YouTube) without the AD authentication and will be testing the solution massively before implementation and run the two systems side by side till happy, and take a deep breath before full deployment :-?

 

I am more than happy to research and read books if pointed in the right direction, my linux skills are rather limited at the moment but more than happy to learn, am picking a few commands up at the moment :-).

 

Big Thanks in anticipation of any reply.

[glennda]

I use squid/dansguardian here and never have problems with it. I've never made filtering VIA ad group work but it is possible from what I have read.

 

You can use webmin modules for a front end GUI ( in a web browser).

 

You can also download blacklists from the net.

[CyberNerd]

sounds like your on the right lines. Here's a howto to get Squid working with Samba for basic AD authentication

ConfigExamples/Authenticate/Ntlm - Squid Web Proxy Wiki

[CyberNerd]

this method should also work Configure squid for LDAP authentication using squid_ldap_auth helper

and this ConfigExamples/Authenticate/Kerberos - Squid Web Proxy Wiki

I'm not sure whether ldap,kerberos or winbind is hte best method?

[Arthur]

SmoothWall Express + add-on's (Advanced Proxy / URL Filter / Calamaris)?

 

Advanced Proxy includes Active Directory support.

[bossman]

@Davit2005:

 

If you have a spare computer with 2 nics and 2Gb ram then this could be another solution:

 

IPCop - Home

 

We used this for many years using transparent authentication and has many good features, reason we changed was our budget allowed us to purchase smoothwall.

 

Hope you get sorted

[Davit2005]

We should have a spare server coming up soon which we should be able to setup. It's not 64bit so can't really use esxi 4 but suppose could setup using 32bit windows 2003/2008 in a raid 1 with either virtual server or virtual box I suppose.

 

The only thing that worries me with transparent proxies is everything has to go thru it including servers etc. Can be a pain for windows update,activations and software that uses it's own download manager (Adobe etc.)

[CyberNerd]

We should have a spare server coming up soon which we should be able to setup. It's not 64bit so can't really use esxi 4 but suppose could setup using 32bit windows 2003/2008 in a raid 1 with either virtual server or virtual box I suppose.

 

Take a look at KVM - it's part of the linux kernel and can do useful things like live migrations/high availability that you won't get with virtualbox. THeres lots of management tools as well

Management Tools - KVM

 

The only thing that worries me with transparent proxies is everything has to go thru it including servers etc. Can be a pain for windows update,activations and software that uses it's own download manager (Adobe etc.)

 

I would have thought that transparent proxying solves some of these issues, compared to authenticating proxies. You can always leave the squid port open (to specific ip addressess) and use that as an unfiltered proxy and the dansguardian port as the filter.

[glennda]

Take a look at KVM - it's part of the linux kernel and can do useful things like live migrations/high availability that you won't get with virtualbox. THeres lots of management tools as well

Management Tools - KVM

 

 

 

I would have thought that transparent proxying solves some of these issues, compared to authenticating proxies. You can always leave the squid port open (to specific ip addressess) and use that as an unfiltered proxy and the dansguardian port as the filter.

 

pretty sure you need virtulisation support in the cpu/bios to run KVM (I use it to host all my vms)

[CyberNerd]

pretty sure you need virtulisation support in the cpu/bios to run KVM (I use it to host all my vms)

 

yes - your quite correct and it probably won't be supported on an older 32bit processor.

 

@glennda which management tools are you using, I was thinking about using kvm for desktop virtualisation - just some research at the moment but I'm liking the look of this: Spice - Home page

[glennda]

yes - your quite correct and it probably won't be supported on an older 32bit processor.

 

@glennda which management tools are you using, I was thinking about using kvm for desktop virtualisation - just some research at the moment but I'm liking the look of this: Spice - Home page

 

I use Virsh (command line) and Virt-manager on the machines to configure/manage machines.

 

I run it on 3 dl380 g5's and 2 Dl360 G7's using a OCSF2 Cluster meaning all the luns on the SAN can be attached to each host.

 

I then use Xming and Xll forwarding through putty if i need to use Virt-manager on a windows box.

[Davit2005]

pretty sure you need virtulisation support in the cpu/bios to run KVM (I use it to host all my vms)

 

Will look into KVM for sure, not one I've heard of. I've had to enable VM support in a few recent dell servers R410/R510 for 64bit support.

 

Our current proxy allows for certain pass thrus from designated source IP's, and also allows full access to designated destination IP's. The main issue is the AD authentication to 2008 R2. Being able to get the proxy to filter on AD security groups (i.e. Students, Staff, limited internet access etc.) would be a distinct advantage.

[glennda]

Will look into KVM for sure, not one I've heard of. I've had to enable VM support in a few recent dell servers R410/R510 for 64bit support.

 

Our current proxy allows for certain pass thrus from designated source IP's, and also allows full access to designated destination IP's. The main issue is the AD authentication to 2008 R2. Being able to get the proxy to filter on AD security groups (i.e. Students, Staff, limited internet access etc.) would be a distinct advantage.

 

In the end i setup 2 machines (identical config files copied from each other) one which does staff one does students with different block lists.

[Davit2005]

In the end i setup 2 machines (identical config files copied from each other) one which does staff one does students with different block lists.

 

I was thinking along these lines if can't get AD authentication to work. Easy to work as staff in different OU to Students and can very easily set up policy to point different OU's to different proxies.

 

Maybe advantageous to have a dual solutions and staff will just have to put up with limited access if their proxy fails and students can either be monitored carefully on staff policy or Internet disabled altogether if theirs fail. Better than no one on Internet at all. Specially when you have to support the system in house.

[glennda]

yup especially as it is just a case of adding the ip to the other machine and then setting the config to accept data on that IP saves the need redo gpo's and get staff to logout/login again.

 

I use Samba to do the auth and squid passes onto samba