Websense Web Security Gateway Anywhere v7.6: Hybrid Web Tips : Chaining Hybrid Web Filtering with Squid Proxy

Chaining Hybrid Web Filtering with Squid Proxy

Topic 45023/ Updated: 19-April-2011

Applies To:

Websense Web Security Gateway Anywhere 7.6

Websense Web Security Gateway Anywhere supports the configuration of a chained Squid open source downstream proxy, in the following cases:

Basic chaining

For policies where NTLM is enabled and end users are asked to authenticate for hybrid filtering

The Squid proxy must be version 3.1.5 or later.

Basic chaining

In this case, Squid forwards requests to the hybrid proxy but performs no authentication. End users can be authenticated using manual authentication only: prompting users for a user name and password the first time they access the Internet through a browser.

Configure Squid to forward requests to the hybrid proxy as follows:

1.

Define one or more ACLs to identify sites that should be not be filtered through hybrid filtering. These must include certain service-specific sites, and should include any other sites that are not normally handled through the hybrid service. You can identify these sites by examining the service-generated PAC file available at http://hybrid-web.global.blackspider.com:8082/proxy.pac.

The following sites must be included in the ACLs:

acl WBSN dstdomain .mailcontrol.com

acl WBSN dstdomain www.blackspider.com

acl WBSN dstdomain home.hybrid-web.global.blackspider.com

acl WBSN dstdomain hybrid-web.global.blackspider.com

always_direct allow WBSN

2.	Force all other sites to use the hybrid proxy as follows:

never_direct allow all

3.	Tell Squid the location of the upstream hybrid proxy:

cache_peer hybrid-web.global.blackspider.com parent 8081 0 no-query default no-digest

NTLM chaining

The Squid proxy performs local NTLM identification, then forwards the appropriate Proxy-Authorization headers as an NTLM Type 3 message to the hybrid proxy for further transparent user authentication. Squid can maintain multiple connections to the hybrid proxy, allowing the sharing of connections across users but ensuring that each request is associated with the correct user. When Squid reassigns a connection to another user, only then is a new Proxy-Authorization header sent for that user.

To use this setup, configure Squid to do the following:

1.	Perform NTLM authentication.

2.	Forward requests to the hybrid proxy.

3.	Forward user information to the hybrid proxy.

Configuring Squid for NTLM authentication

To configure Squid to perform NTLM authentication of users, refer to the Squid documentation:

http://wiki.squid-cache.org/ConfigExamples/Authenticate/Ntlm

Forwarding requests to the hybrid proxy

To configure Squid to forward requests to the hybrid proxy:

1.

Define one or more ACLs to identify sites that should be not be filtered through hybrid filtering. These must include certain service-specific sites, and should include any other sites that are not normally handled through the hybrid service. You can identify these sites by examining the service-generated PAC file available at http://hybrid-web.global.blackspider.com:8082/proxy.pac.

The following sites must be included in the ACLs:

acl WBSN dstdomain .mailcontrol.com

acl WBSN dstdomain www.blackspider.com

acl WBSN dstdomain home.hybrid-web.global.blackspider.com

acl WBSN dstdomain hybrid-web.global.blackspider.com

always_direct allow WBSN

2.	Force all other sites to use the hybrid proxy as follows:

never_direct allow all

3.	Tell Squid the location of the upstream hybrid proxy:

cache_peer hybrid-web.global.blackspider.com parent 8081 0 no-query default no-digest

Forwarding user information to the hybrid proxy

To configure squid to forward user information, add option login=PASS to the cache-peer line:

cache_peer hybrid-web.global.blackspider.com parent 8081 0 no-query default no-digest login=PASS

 

Websense Web Security Gateway Anywhere v7.6: Hybrid Web Tips : Chaining Hybrid Web Filtering with Squid Proxy