[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Controlling Internet access by users/groups


This is a long e-mail but I hope that the answer for this problem, if there is 
one, will be useful for many people. First, some background information:
Here at work we have been used MS solutions for a long time and since two 
years ago we have been migrating several services for Unix/Linux. For the 
last few months, I've been evaluating the feasibility of migrating 
workstations for Linux, but there's a problem about controlling Internet 
access that I've not been able to solve so far.
We use MS ISA server to restrict Internet access, by user and by application. 
For example, I can set it up so that user A can access HTTP servers and use 
instant messengers, while users from group B are allowed to access FTP 
servers and users from group C are forbidden any access (users and groups are 
stored in Active Directory).
In order to work this way, ISA Server provides a client that is installed at 
the Windows workstations. This client intercepts all TCP/IP requests and 
redirects them to the ISA server, along with the credentials of the current 
logged user. No additional configuration is needed in any application, they 
just "think" they are directly connected to the Internet.
I need a way to do the same with Linux clients. It may be a software that acts 
like the ISA Firewall Client, interoperating with MS ISA Server (this would 
be very useful during migration), or it may be an entirely Linux based 
solution (preferred long term solution).

I've tried the following so far:

1. Configure applications to use ISA Server as the proxy server.
   . Positive point: Firefox can do NTLM authentication and interoperates well
     with ISA Server.
   . Negative points: Many applications can't be configured to use proxies.
     Those which can are not able to authenticate against ISA Server.
     Even if they were, it would be necessary to configure each application
     for each user.
     In Firefox, the user have to retype his credentials every time he
     opens the browser and java applets do not
     work (JVM can't authenticate against ISA Server)

2. Use NTLMAPS / APServer on the client side
    . Positive point: Firefox can access Internet using APServer without
      requesting user credentials and java applets work fine. APServer can
      do NTLM authentication and interoperates well with ISA Server.
    . Negative points: It's usefull for HTTP access only. Other applications
      suffer from the same problems described in the previous solution.
      APServer is not user-friendly enough to be used by normal users
      and I can't configure it to start automatically (for that, I would have
      to set it up with a user account that would not match the current logged

3. Use squid on the server side
    . Positive point: HTTP access can be restricted by AD user accounts.
      squid is able to authenticate users against AD.
    . It's another HTTP-only solution. squid capabilities of restricting
      access by group are limited. Browser special configuration is

4. On the client side, use a script that creates iptables rules dinamically
    when a user logs on, according to his credentials.
    . Positive point: work for all applications. Works with ISA Server in
      NAT mode as well as with a Linux based NAT solution.
    . Negative points: administration is a nightmare. It's difficult to work
      with groups. The restrictions are enforced on the client side and
      not on the server side, what lowers down security. My network
      spans over a 800 km area, with many buildings. Each building
      has support personnel who must have local root access to the
      workstations in the building, but should not be able to set up
      their own restrictions for Internet access. It's not possible to
      prevent them from editing the local iptables rules, once they
      have root privileges at the workstations.

Is there a way to get the results I need using Linux clients?



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]