SchoolGuardian + WSUS

[dave.81]

Didn't know right section for this but as SC is based on Linux why not here i thought lol...

 

Right we have just moved over the this system but i'm having great problems getting WSUS3 to update. The server it is running from has open access to the net without a username but when i try to synchronize or download the updates i get told that

 

9:39:37 192.168.100.1 - http://download.windowsupdate.com/v7/wsus/redir/wsus... 0 403

*DENIED* Your username is not allowed to web browse: -

Banned User

 

Now i've allowed the IP access and told it not to auth against windowsupdate.com but still nothing. Anyone else having problems. The funny thing is if i turn off the auth completely it works but no students can access the net....

 

Help

[plexer]

One way around it would be to set up NT Lanman Proxy, NTLM on your workstation and point your wsus box through that.

 

That way it will be browsing using an authorised username.

 

Otherwise using the bypass options should work.

 

Ben

[Guest Guest]

Cant you just run SW in parrelell to your network? Allowing your servers direct access.

Or is SW your firewall?

[tom_newton]

dave: the trick is to put the wsus update sites in the "sites that don't need authentication" list on the guardian/authentication page. I'd also add them to "always allow" in "default users".

 

There are a couple of wrangles involving windows update depending on exactly how folk have it set up. WU often gets its proxy settings from a different source from IE, for example.

 

It seems that you have the WSUS server going through the proxy, which, in and of itself is not an issue but it may mean you have to add a few explicit allows.

 

We've just been fiddling with our knowledge base on the web, but this URL should get you the right article:

https://support.smoothwall.net/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=211&nav=0,4

 

HTH,

 

Tom

[dave.81]

Have it all fixed now, added the server to the allow list and also the auth exceptions. Still wasn't working so i gave but..... installed an email update and rebooted it started working...

 

Wonderful now every pc in the college needs updates...

 

Thanks for the advice guys

[tom_newton]

Heh - methinks one of your changes required a guardian restart. Regrettably, the "windows solution" of "reboot it, see if it works" occasionaly seems to fix things too

[Geoff]

There are a couple of wrangles involving windows update depending on exactly how folk have it set up. WU often gets its proxy settings from a different source from IE, for example.

 

WU uses WinHTTP. You can control WinHTTP's proxy setting with the 'proxycfg' tool (present in XP SP1 and above and Win2k3). Here's what I use (as a machine startup script.

 

proxycfg -p proxy.carrhill.lancs.sch.uk:8080 erra.carrhill.lancs.sch.uk

[tom_newton]

@Geoff - I use WPAD. WinHTTP will actually pick up on DHCP option 252. This can be done with SchoolGuardian, and IE's "Automatic detection" then works as well. Trouble is, there's a minor, minor hackage required to SG's DHCP server (needs to be made authoritative). Can happily use Win2003's DHCP too.

[Geoff]

I dislike the security implications of using option 252 in DHCP.

[tom_newton]

Any in particular? Or just the possibility of a rogue DHCP server?

[Geoff]

Here you go:

 

http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol#Security