tom_newton

Point out "what if 2 kids have the same name" problem. Resort to usernames. Inform staff that if they don't like using usernames (which are the only thing you can guarantee uniqueness on) they can foxtrot oscar.

SG should allow you to pick certain ranges to go via a secondary connection. You may need advanced firewall to do VLANs - but just ask your account manager to swap it for you.

Afraid not, no (Well, depends what you mean by "cheap", we aren't w***ense, but we aren't £50)

Yes - this is what we've been doing for a long time

If it ties with sugar, then PHP? Our licencing system here is pure perl, and it does work, though we find irritating crossovers between it and other systems. If you want to give me a call, i'd be happy to share my experiences of such systems (I wrote a good bit of our current licencing system, and many of its flaws can be directly attributed to my naivety at the time)

Sounds like a CRM system. Writing your own might not be a great idea - probably best stick to your business, and get a CRM from somewhere else? sugarcrm is ok, and they have a free version.

I always like hard disks as a scapegoat :-/ Trafficlogger is a bit heavy, so that's normal. Is squid running OK?

For SmoothWall customers, I believe you can obtain GFI (nee Sunbelt) VIPRE at a very keen cost if you call your account manager. The ease of use of the admin console is my favourite bit of VIPRE tbh. It's not perfect, but its the nicest AV I have used so far.

Run "top" - is anything eating all your CPU time? Sounds like it could be a hardware issue though.

Hack some perl. Or sometimes i'll go through any requests for licencing tweaks on our database and fix those.

I can get Jason to put it back like that if that's helpful? We'll run this past a few proxy experts at some point soon and see if they can shed any light.

Would it be possible to let the smoothie pass straight through? I've had a look round to see if I could find any info on "error 13" - it *could* be related to compression, but we don't turn that on...

Aha! That's the root of your problem. When you put a site in do-not-auth-for, it doesn't get authenticated, so for that single request, you don't have a username - and for that single request, your group becomes "Unauthenticated IPs" - because most of our auth methods are stateless, and rely on re-assessing authentication details on every transaction. More secure, but quite intensive - and prone to fail for bad software. Anyway. Because you have "unauthenticated IPs" as "no browsing" (see guardian/auth/settings) you will get blocked when you don't authenticate. To fix this, you will need to: 1. allow unauth' IPs to browse 2. Create a rule: Unauthenticated IPS, Everything, All the time, Block (this re-instates the "no browsing" rule in an overridable way) 3. Create a rule "Unauthenticated IPs, Custom Allowed Content, All the time, Allow" Assuming dropbox is in CAC, you'll be golden. HTH, Tom

So you are using ISA as an upstream proxy? First, one suggestion would be to not do that, and allow the smoothie direct network access through ISA's NAT. Second - it would seem that you *might* have ISA set up incorrectly - have you tried HTTPS proxy directly through ISA?

Ladies, Gentlemen and other, We have (yet another) support role opening up in our southampton office. This is due to our continued rapid growth, and a desire to keep customer support at a very high level. Some details here: SmoothWall | News » Company As you might notice, we also provide informal support through edugeek - which we are finding works pretty well. As such, being a current eg poster confers a slight advantage It's a great role, one in which the possibilities for learning new skills are broad. There are also opportunities to progress into on-site engineer roles for those that would like that sort of thing. There is weekend work involved (though I think since the job ad went up it has changed) - usually one whole weekend in every 4, though as we add to our numbers this is expected to change, which you then get back in the form of two weekdays. I mention this because it does put some people off - and it is best to be "up front". Any questions by email, PM or in thread. Cheers, Tom

On a more diagnostic note... I presume the smoothie is set up as a regular proxy? What's the failure mode for HTTPS? Is ISA an upstream proxy of the smoothwall? What's in the logs, both smoothie (info/logs/web filter) and ISA access logs?

Support agents are in - there should be someone on the end of a phone now

Anything in the logs?

tom@flying-squirrel:~$ ~/guardiantest.pl http://proxy1.tplack.com/ Blocked http:// proxy1.tplack.com Proxies This is where I need me "feet up" emoticon.

How about appending the data URL-encoded to the PHP script? That may be the only way.

I presume you mean strreturned? As that's a variable containing the string I presume eworkGetField returns. Try: var strreturned = eworkGetField("clpApprovedData"); strreturned = strreturned.substring(0, strreturned.lastIndexOf('~')); if(strorginal.toUpperCase()!= strreturned.toUpperCase()) Which is what webman suggested, inserted into your code.

In what way does it fail?

Pete, I believe they will let you encrypt the list - but as you say, you then have to decrypt it in RAM to match. We normalise the URLs in the list (via some automatic process) then store a hash. We then normalise the requested URL, and do a hash comparison. As such, no-one can reverse-engineer the IWF lists out of Guardian. This is also why you will see "iwfhelper" as a process on your guardian box. Though the reason they aren't ever used by open-source/very cheap filters is that IWF membership is costly (it costs us per user).

Becta may be on its way out, but I *suspect* that the accreditation will remain. We'll see. John's not too far off the mark - it is a sensible CYA manoeuvre, plus it gives you an idea that the filtering is at least OK on BECTA categories (though they don't cover proxies, be sure to test that yourself).