Number6

I had to reformat my HD and I'm currently reinstalling stuff. Just downloaded Tweedeck (v34.1) and fired it up. It immediately launches into the "you need to set up an account" dialogue screen which then asks the usual Twitter credentials questions. The problem is that it won't connect because [presumably] I need to enter to proxy settings. BUT, the settings buttons are greyed out, they can't be accessed until I set up a Twitter account. But I can't set up a Twitter acount until I enter the proxy settings so that Tweetdeck can connect in the first place There's no way to bypass this - no close button or anything on the acount setup dialogue :mad: Anyone got a workaround for this?

Email is one of my major concerns. We're heavily dependent on Exchange at the moment so how does ebox handle mail and what clients does it like?

I think it's Google Toolbar causing the problem.

Curiouser.... If I disable pop up blocker on a local machine.... pop-ups are still blocked..... even though IE says the blocker is off. :confused:

Hi. This should probably be in the server section but I guess more people will see it here. I'm trying to disable pop-up blocking, or at least manage which site's pop-ups are allowed, via GP on SBS2003. Clients are Win7 using IE8 I cannot get the blocker to turn off. Neither can I get any sites allowed to launch pop ups. I hve hunted down every reference I can find to this in the GPs and set it appropriately but the blocker still blocks. I've entered a specific domain in the allow pop-ups GP section but it's still blocked. Am I missing something?

UPDATE - But of course I just remembered that SBS doesn't support child domains

Thanks for that alonebfg. I'm thinking of installing an ebox box as a new DC within the existing forest at a primary school that I look after. The site runs SBS2003 and we're running out of available uersers so my thinking is to set up ebox as DC for the pupil logons. I have an old Dell server that I can use and if I can make it run, and talk to the other Windows server infrastructure then I've saved the cost of upgrading to a new 2008 / Exchange 2010 combo. Is there a users limit at all?

I'm just wondering if it actually works? :-)

Doesn't have to be that way. Different services can be split across different boxes that run specific implementations of ebox. You can have a separate firewall, print server, file server, mail server, DC, etc. No different in concept to having different boxes each running Win Server 2008 but doing different tasks.

Is anyone here actually using ebox in anger? I've spent much of the afternoon reading all the documentation on ebox that I can find and it seems a pretty nifty system. But is it too good to be true? What are your experiences of actually using it?

I was thinking of installing Frox to handle ftp calls. It's a weird one with IE. All other browsers seem to pop the credentials dialogue but not IE. We only have to one user who insists on using IE to ftp into a onelan box to manage our digital signage. I've installed filezilla for him but he still defaults to IE. Hey-ho!

Update: Using Firefox pops up the username and password entry dialogue. Using IE does not and gives the error.

We have had a Dansguardian / Squid proxy box running for a couple of weeks now and all was well. DG is using the NTLM Auth protocol which transparently authenticates all user requests via the user's network credentials. It's all running silky smooth, or was.... FTP requests via a browser seem to be a problem. I may be wrong but Squid appears to treat all FTP requests as requiring anonymous login and does not give the user the option of entering credentials. I've had a look at squid.conf and can't see any option to prevent squid from doing this. There is an option to modify the "email address" that squid transmits as part of the anonymous login procedure but nothing that tells squid to fetch an FTP site using normal [username / password] login. Entering ftp://[username: password]@{ftp site address} into the browser address bar makes no difference, the returned error message makes it clear that squid is still insisting on applying anonymous login. The ftp site can be accessed OK via Filezilla, it's just browser requests that are the problem. Has anyone else dealt with this issue? If so how?

Will I? Are you sure? If a user on our network opens up a browser and requests a web page this would normally go out on port 80 or 443 through the firewall, if the firewall silently redirects port 80 / 443 traffic to port 8080 instead then the browser will still think it's talking to the web site but is passing it's header info to port 8080 instead? Wouldn't it? In which case wouldn't the authenticators in the header still be passed to DG?

I hate the rules settings with a passion on this Sonicwall box, nothing seems to be logical. Anyway... I want to trap all internal web traffic on port 80 and transparently forward it to port 8080. My reasoning is to give our network transparent web filtering and proxying via the Dansguardian / squid box. I know that I can set proxy settings via GP, and I have done so, but this doesn't stop users manually modifying the proxy settings, nor installing browsers that won't pick up on the GP setting. We also have roaming users who are not AD users but who use internet access via our network. I'd also like to trap things like iPhone browsing. I want to send all web traffic to the proxy. Sooo.... can anyone who actually understands SonicWall's forwarding rules tell me if this is feasible and if so how I'd do it? Many thanks.

Well, I'm happy to report that it's now all good There were a couple of minor settings in squid.conf that were wrong. All usernames are now being logged correctly and browsing is being authenticated. Filter groups are also working, so I just need to modify the group settings now before I roll out a production copy. Thanks for all the help, and to one person in particular from here who has spent several hours with me via online chat and who provided invaluable help - you know who you are and thanks very much!

Here are my squid and DG config files. I've deleted all commented out lines. If you are able to and have the time could you have a look and see if there's anything obviously wrong or missing please? Thanks squid.conf.txt dansguardian.conf.txt

Yes it is there.

Had enough for now. Look again next week. DG conf file is set to listen on 8080 and the proxy port is set to 3128. Squid.conf is set to use nltm_auth. All wbinfo checks and kinit respond OK. If the browser is pointed at 3128 then authentication is requested but if pointed at 8080 then it appears not to be and filtering for all users takes place as per group 1, neither are usernames logged in either the squid or DG access logs.

If I point the browser at the squid port then the request is authenticated. If I point it at the DG port it isn't authenticated?

This is odd now. Everything appears OK according to all the guides I've read, all wbinfo, kinit, etc commands give the right responses but no usernames are being logged. Also I've just tried browsing from a non-domain pc and it hasn't asked for authentication.

Should the originator's username be logged in the DG access log?

I did all that but DG seems to be ignoring it. Everyone is defaulting to group 1

Right I'm moving along slowly. Squid and DG are working using ntlm_auth against AD users and this is all fine. I have two problems to resolve though: 1) When I reboot the server clients won't authenticate. I have to stop squid, run winbind-ch.sh and then restart squid, it then works fine until the next reboot when I have to rerun the preceding. Winbind-ch.sh is in rc2.d and I've tried playing with the run times to no avail. Any ideas? 2) How do I get DG to recognise filtergroups? I've set up two groups, one filtered and one not and I put my AD username in the filtergroups list but clients won't read it. Is there anything else I need to do to make groups work?

Right I'm moving along slowly. Squid and DG are working using ntlm_auth against AD users and this is all fine. I have two problems to resolve though: 1) When I reboot the server clients won't authenticate. I have to stop squid, run winbind-ch.sh and then restart squid, it then works fine until the next reboot when I have to rerun the preceding. Winbind-ch.sh is in rc2.d and I've tried playing with the run times to no avail. Any ideas? 2) How do I get DG to recognise filtergroups? I've set up two groups, one filtered and one not and I put my AD username in the filtergroups list but clients won't read it. Is there anything else I need to do to make groups work?