Blue Coat OPT-1000-2499-3YR User Manual download pdf (Page 54)

5.4.1.4. Squid NCSA

Select the Squid NCSA option if OPTENET server has been installed in a UNIX

environment (Solaris, Aix, FreeBSD o Linux), if the RPC option has been selected that

installs squid together with OPTENET and also if Squid has been configured to request

NCSA basic authentication. In this way, it will be able to make OPTENET show in the

section “Filtration rules” -> “users”, the list of users that Squid is able to authenticate.

Actually OPTENET carries out a search of the tag "auth_param basic program" of the

configuration file of Squid (squid.conf) to obtain the user file, run it and, in this way,

extract the user list. NCSA authentication of Squid does not work with groups of users

and it is therefore not possible to set rules by group of users if your organisation is

navigating through Squid in which NCSA authentication is configured.

5.4.2. Activating your own authentication

If your proxy or appliance is not configured to carry out user authentication, all users will

be able to have internet access without identifying themselves introducing a user name

and a password). This means that OPTENET does not receive the information of what

user makes each request, not being able to apply filtration rules based on users or groups

and only being able to establish different policies by the IP’s of users accessing Internet.

To be able to set filtration policies by user or group of users, we have two options:

• A) Configuring you proxy or appliance so that it performs user authentication

(recommended option) or

• B) Configuring OPTENET so that it identifies the users who are navigating.

In the case of option A) in which it is the proxy or cache which is authenticating users, this

proxy sends to OPTENET with each WEB request, the user who has requested it.

OPTENET in this case must obtain the groups of this user for which it uses the origin of

the data that have been configured (LDAP or Windows domains. We must remember that

OPTENET proxy or Squid NCSA cannot establish filtration rules by groups).

Option B) consists of OPTENET identifying the users who are navigating. To activate it,

the tick of the box “Activate your own authentication” should be marked in the user

authentication window. This option can be useful for organisations in which the

proxy/cache does not perform user authentication or where this cache does not send

which user is making each request to the filter. In this way of working, OPTENET carries

out an association between the IP’s that it receives with each request and those users

navigating from these IP’s and it is therefore strictly necessary for those requests

identified by their IP of origin to reach OPTENET and not by the IP of an intermediate

gateway or router. There follows a description of the identification process performed by

OPTENET:

1. A user begins an Internet session, carries out the web requests to the proxy and this

passes them to OPTENET for it to decide whether to pass or block them.

2. OPTENET extracts the IP address of the request and checks it against its internal table

that contains IP and user pairs.

3. As this IP is new, OPTENET does not yet know which user is behind this request. To

find out, it has two methods:

3.1 If the “LDAP” data origin is being selected, OPTENET redirects this request

against its authentication server, requesting, at the same time, that the user who is

navigating introduces a user and password and it will compare the data with the LDAP

servers defined. To carry out these checks, the filter may query the “username” field

as defined in the LDAP server or access the LDAP directory directly with the

credentials supplied. Likewise, and only in the case where the “LDAP” is selected as

the data origin, it is then possible to authenticate the user with the data contained in

1 2 ... 49 50 51 52 53 54 55 56 57 58 59 ... 120 121

Comments to this Manuals

No comments

Blue Coat OPT-1000-2499-3YR User Manual Page 54

Comments to this Manuals