Duke5A

For anyone running Squid: Squid Proxy and Youtube for Schools - Blogs - EduGeek.net

Now your just showing off. 81.55 Mbps / 51.43 Mbps

Getting Youtube for Schools to work is something that is either easy, or an extreme PITA; which is entirely dependent upon what you use for a proxy. If you're reading this, then you know Squid falls in the ladder of those two scenarios. There are two ways to go about doing it: adding a custom HTTP header, or rewriting the URL on the fly. The cleanest way is using the custom HTTP header, but as of Squid 3.1 it doesn't natively support adding custom headers. You can only change existing ones. To do this you need to setup an ICAP server and it seemed a bit overkill for this simple task, so I elected to go for the URL rewriting. The basic gist of this is that your school's filter ID needs to be appended onto the end of every URL. This is accomplished by means of either a perl or PHP script that Squid calls out to do the rewrite. Seeing as how I'm a VB monkey and couldn't wrap my head around Perl in the time allotted for this task so I cheated. Following Youtube's guidelines I wrote the script in VB to give me the desired output and used a converter to go to Perl. It needed some tweaks, but it seems to work. Just replace the filter ID with your own in the script and you should be set. #!/usr/bin/perl $|=1; $strSchoolID = 'edufilter=xxxxxxxxxxxxxxxxxx'; while (<>) { @X = split; $strURL = $X[0]; if ((index($strURL, 'youtube.com') + 1)) { if ((index($strURL, 'edufilter') + 1)) { print $strURL, "\n"; } elsif ((index($strURL, '.css') + 1)) { print $strURL, "\n"; } elsif ((index($strURL, '.gif') + 1)) { print $strURL, "\n"; } elsif ((index($strURL, '.png') + 1)) { print $strURL, "\n"; } elsif ((index($strURL, 'gif') + 1)) { print $strURL, "\n"; } elsif ((index($strURL, '.js') + 1)) { print $strURL, "\n"; } elsif ((index($strURL, '.xml') + 1)) { print $strURL, "\n"; } elsif ((index($strURL, '?') + 1)) { $strURL = $strURL . '&' . $strSchoolID; print "$strURL\n"; } else { $strURL = $strURL . '?' . $strSchoolID; print "$strURL\n"; } } else { print "$strURL\n"; } } The Squid configuration should look something like this: url_rewrite_program /etc/squid3/helper/urlrewrite3.pl redirect_rewrites_host_header on redirect_children 30 acl RedirectYoutube dstdomain .youtube.com redirector_access allow RedirectYoutube redirector_access deny all By default Squid will pass every outgoing connection through the script, so I set an ACL to only pass connections going to Youtube. And don't forget to set execute permission on the script file. I haven't pushed this out to an entire building yet, but it works with my test group so far. If you find any bugs with this drop me a line. I hope this helps!

That's new to me! MS does have a utility for diagnosing WMI errors though: Download The WMI Diagnosis Utility from Official Microsoft Download Center

Found it... I had left the -D option flipped on the squid_kerb_auth helper in the config.

I recently setup a Debian 6.0.6 box with Squid 3.1 installed from the repository. I'm moving my proxies over to Kerberos before I raise AD from 2003 to 2008. I've gotten everything working correctly, but I keep getting an odd entry in the cache log. 2012/12/06 10:17:40| squid_kerb_auth: DEBUG: AF [i]long randmon string of text[/i]== [email protected] This pops up quite frequently. The thing is the proxy is working just as it should. All the traffic is being logged according to username in the access log and my staff can get to everywhere they're trying to go. Kerberos is the only configured authentication method in the Squid config file. In my Google travels I read some references to clients attempting to send NTLM back Squid first, but this was usually accompanied by this in the cache log; which isn't present in mine. WARNING: received type 1 NTLM token Is this even indicative of an error, or do I simply need to turn down a debug level or something? Thanks!

It depends on the version of Squid he is running. For 3.1 and above this holds true, but for 3.0 and below not defining the disk cache will create it in it's default location. I'm guessing you have Squid running on port 3128 and DG on 8080? What happens if point a client directly to Squid on 3128? Are you getting list updates for DG?

Check the cache log first for errors. If you're out of space it'll tell you. Default location is: /var/log/squid3/cache.log

Export the image and import it again under a different name, but keep it in the same install group. Then under its properties select a different XML for the unattended file. Result will be an additional image in the list of available ones to choose from, only this one will be using a different answer file. Since WDS uses deduplication to store the images in an install group it won't take up any additional space either.

I wound up writing my own launcher for TightVNC in VB .Net 2010. We're not in a position where we have to ask permission to take over a machine and this setup even works when the machine isn't logged in.

We run a managed Cisco setup here. VLANs are actually tunneled to the access points by the controller. You set the location group the AP is in on the management console then it knows what VLAN to dish out. I've seen it where the AP will lose its config and it won't know what location it's in. I know these are two different setups, but it might be something to look at. It might explain why it'll associate, but doesn't go anywhere.

Note to self, do not upgrade BE.

We haven't moved to Office 2013 yet, but I've already started to see issues like this. Out of the blue Outlook 2010 seemingly at random starts asking for user credentials. Same symptoms as you described: asking for credentials, no matter what you give it it fails, and clicking cancel makes it work. I didn't think that it might be trying to make a web connection. I guess I'll be moving my Squid boxes over to Kerberos next week.

Sounds like you are in the same boat I was in. There is a couple of other threads on this board regarding this exact issue. Give this one a read: http://www.edugeek.net/forums/windows-server-2008-r2/101412-gpo-not-working-ie9-proxy-settings.html#post872011

Here is the auto config script if anyone is interested. It's a tweaked example I think I got from FN-GM. function FindProxyForURL(url, host) { //Declare proxy strings as variables var staffproxy = "PROXY yourproxyhere:3128"; // IP not to use proxy if (shExpMatch(url, "http://10.*")) { return "DIRECT"; } if (isPlainHostName(host)) { return "DIRECT"; } // URLS not to use proxy server if (shExpMatch(url, "*blah.somesite.net*")) { return "DIRECT"; } if (shExpMatch(url, "*whocka.whocka.net*")) { return "DIRECT"; } if (shExpMatch(url, "*asdf.com*")) { return "DIRECT"; } // Apply proxy if machine is on internal network if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0")) { return staffproxy; } if (isInNet(myIpAddress(), "10.0.0.0", "/8")) { return staffproxy; } else return "DIRECT"; } If Internet Explorer can connect to the host and download the script it'll use it, but if it can't it'll go out direct. So with it hosted internally when a user take their machine home proxy settings won't be used. The script is already set to not apply proxy settings to connections on a 10.0.0.0/8 network. The only goofy thing I had to do is with lines 18 and 19, where the proxy is applied. The myIpAddress function returns different strings depending on what browser it is called from. Line 18 will apply the proxy in IE, and 19 is for Firefox.

Sure do. It's running on an ESXi 4.1 host and is assigned 2 vCPUs, 1GB RAM, 30GB of disk, and one NIC. Since it's not acting as a transparent proxy only the single NIC was needed (no routing necessary). It handles traffic in a 4,000 student district with relative ease. Squid is setup for NTLM to check usernames against Active Directory and logs traffic under the account name. SARG runs via Cron Job at 12:00 every night and parses the logs into a website that hosted off of the same proxy VM via Apache. We have filtering provided by our ISD externally so I setup their proxy as a cache peer in Squid. Once Squid is finished with it it'll pass of requests to the ISD proxy. You could do filtering internally if you had to though using Dan's Guardian.

We use a Squid 3.0 proxy for student traffic monitoring and blocking with SARG to create the access reports all running on an Ubuntu 11.04 VM. The reports are parsed every night and dumped to a webpage hosted on the proxy. Teachers and staff have the address to view reports by AD username. For blocking I setup Squid to look up membership of an AD group and if the user is a member it restricts their access to only a couple sites used for online learning. Teachers can edit the group via an app I made in VB .Net 2010 that is hosted on a district shared drive. Content filtering is handled by the ISD (our version of an LEA). You could use Dan's Guardian though if you didn't have anything else. The entire setup took works well, but it did take a week or so to iron the bugs out.

We had issues with proxy settings and teachers taking their laptops home too. I eventually settled for using an auto configuration script in IE so they wouldn't have to mess around with it anymore. It has worked pretty good so far.

I guess I can't blame that one on auto-correct, can I? lol...

I'm running a couple Squid proxies and had similar issues with certificate revocation on a number of different sites and services. With certificate revocation on a connection is attempted to reach the CA to check the status of the certificate. While checking the Squid access log I noticed that credentials weren't being passed to Squid for those connections going out to the CA (we use NTLM authentication for our proxies). As a result, Squid wasn't forwarding that connection and the revocation check was failing. To get around it I added the CA domain to an ACL that is allowed to bypass proxy authentication. Adobe uses Verisign for this particular certificate as my proxy shows a connection to ocsp.verisign.com in the middle of all the connections to my.adobeconnect.com. Allowing unobstructed access to Verisign's TLD and sub domains should fix the issue. I hope this helps.

Flash is already built-in to Chrome, so I guess it kind of makes sense to go that route with IE10. If they could pull Java under the same setup we would probably see a dramatic decrease in maleware infections.

I have/had a very similar problem with netbooks not pulling proxy settings. What was really odd was it was seemingly random; it would only affect two or three systems at a time in an entire cart of thirty and never the same ones. For troubleshooting I eased the restrictions on our student accounts and tried these steps: Check proxy settings in IE - the checkbox was not ticked Forcing a policy refresh at the command line using gpupdate /force - No Change Verifying that proxy settings were indeed in the policy the machine was getting using RSOP - it was Used RSOP to check for group policy related errors - No Errors By hand verified the policy was replicated properly between my domain controllers - No Difference Finally I tried flipping this policy option on: Due to the randomness of the issue I could never really verify that this fixed, but at least I haven't heard any grumbling since then.

@robjcrowston What's the purpose of having the proxy? The forwarding rule that dhicks listed will work, but will forward all HTTPS traffic, thus negating any content filtering you may have setup.

It looks like the script is complaining that the user object doesn't exist. I use VB for this stuff and you have to create the user before you can set the password or it'll give the exact same error. Try setting the password on a separate line after the user object has been created.

Then if all you're looking to do is make this exception for OWA then it needs to be done with iptables. What you need to do is create a rule that routes all traffic destined to the OWA server directly to it and place it higher in the list than your port 80 redirect. I can't tell you how to do this off the top of my head though; it's time to practice some Googel-Fu.