Chapter Thirteen: Setting up URL-Filtering for school Environments with an existing Active Directory

Transcription

1 Chapter Thirteen: Setting up URL-Filtering for school Environments with an existing Active Directory Summary of Chapter: How to add Site lists to your NetPilot. A quick look at Active Directory How to add a User Group to your NetPilot that will match your Active Directory Security Group. How to add a User to the NetPilot to match an individual in a Security Group. How to set-up your NetPilot to use Active Directory Integration on a Windows 2000/2003 Server. Five Tips for this document and Setting students PC s for URL-filtering What you need: Knowledge of admin user account and valid password for your unit. A valid Smartfilter URL-Filtering licence on your NetPilot Active Directory turned on, on your PC of Windows XP or higher Software Revision Required: Applicable to software revision > on NetPilots You need to set up a User Group which will match your Security Group on your Active Directory. In this User Group you can block/allow certain sites by applying the Site Lists created below into the specific User Groups. You can make individual NetPilot Users to apply to individual user, e.g. Students and Teachers on your Active Directory as well. Predefined Site Lists and Groups: The NetPilot comes with some pre-defined Site Lists such as Forbidden sites, Controlled, Permitted Sites, which may already be suitable for your needs. If you want to create more Site Lists, please see the next section. If you would like to find out more information about the default Site Lists on the NetPilot please see Chapter 14. Adding a Site List: This section below will show you how to create Site Lists to go into the Groups which will be created later for Students and Teachers. Log on to the NetPilot as shown in Chapter One (b). From the left-hand side of the screen, select Web, then URL Filtering and then Site Lists. (All links are highlighted below). Version Five 05f- NTT1 - Chapter Thirteen Page 1 of 10

2 Select the Add button as highlighted in the image above. You will be presented with this screen below: A Site List consists of URL s that you wish to allow or block. There are three types of Site Lists: Whitelists that allow the specific URL s entered. Blacklists that block the specific URL s entered, or the categories selected on Smartfilter. Redlists are similar to Blacklist, but when someone tries to access one of the URL s entered, or categories selected, an alert will be logged. Choose which type of site list you want to create by selecting the relevant Radio Button. Once you have selected a Radio Button select the OK button. You will be presented with one of the screens below: White Lists Red Lists Black Lists As you can see, the Whitelist has been created for the Students and the Teachers. The Black and Redlist have been created for the students. You can create many Site Lists which are then placed in the User Groups which will integrate to your Security Groups on your Active Directory allowing different permissions. In the Whitelist there are sites that the students and teachers will permanently have access to, no matter what is selected in the Black or Redlist. You can also select items from the Smartfilter URL-Filtering exceptions categories list. In the Redlist, I have entered a few URLs into the text box provided. These sites will be blocked to the students, and this tried access will be logged. In the Blacklist, I have selected a few categories from the Smartfilter list provided, that I want the students to be blocked from. Please make sure that the address/es that you enter into the text boxes above in any of the Site list/s are correctly spelt. Version Five 05f- NTT1 - Chapter Thirteen Page 2 of 10

3 Using Active Directory integration: Select the Start button on the main screen of your Active Directory Server. Then select Programs, Administrative Tools and then Active Directory Users and Computers as highlighted below: You will be presented with a similar screen as below: Select your Active Directory Domain, as highlighted in the left column. Please take note of your Active Directory Domain as this is needed later to enter into the NetPilot. You will see a similar screen as shown left, double click the Users folder. (Highlighted in the right column). Adding a Security Group: The name of the Security Group entered below will be needed later for the User Group entered into the NetPilot. Once you have opened the Users folder you will see a similar screen as below. Right click on the Users folder in the left hand column as shown left. Then select New and Group. The New Object Group window will open, as shown below: Enter a name for your Security Group, this will be needed later for the User Group you enter into your NetPilot. Select OK You can add more Security Groups by repeating this process, but these will also need to be added as User Groups on the NetPilot (shown later) to allow the two to be matched. If users have already been entered on to your Active Directory please move on to Adding users to the Security Group section. Version Five 05f- NTT1 - Chapter Thirteen Page 3 of 10

4 Configuring a User: Due to the limitations of Active Directory, do not use spaces when entering user logon names and passwords below. Right click on the User folder again in the left hand column. Then select New and then User, as shown below: A New Object User window will open. The next screen is shown below: In the new window: Enter the relevant details of the user. When entering the user s logon name, make sure all the others are in similar format, so it is easier to remember, i.e. johnsmith@domain or jsmith@domain. When you have entered in all the details above select Next Enter a secure password (must contain a number, upper and lower case and must be more than 8 characters long). Select a tick box option. Select Next The next screen will display all the details you have selected, please check that these are correct and then select Finish. To add more users, repeat the above process. Adding Users to the Security Group : You should now see the users and the Security Groups you have created in the list in the right-hand column. Right click one of the Security Groups and select Properties, as shown on the left. Version Five 05f- NTT1 - Chapter Thirteen Page 4 of 10

5 You will see this window open: Select the Members tab (highlighted left) You will see this screen below; select the Add button, as highlighted: In the new window select Advanced (Highlighted below) In the next window that opens, select the Find Now button, highlighted below. Once you have selected this button search results will appear at the bottom. Find a user, as highlighted in the list and double click it. If you want to add more then one user, select the different Users from the list, so that they are highlighted and then select the OK button. The user s selected will show in the below window. To select more from here, select the Advanced... button again. Once you have finished, select OK and OK again. Repeat the above process to add the correct users into the different Security Groups you have created. I.e. Student users into the Security Group Students and Teachers into the Security Group Teachers. Version Five 05f- NTT1 - Chapter Thirteen Page 5 of 10

6 Adding a User Group (This will match your Security Group ): If you would like to find out more information about the default User Groups on the NetPilot please see Chapter 22. Log on to the NetPilot as shown in Chapter One (b). From the left-hand side of the screen, select User accounts, and then Groups. (All links are highlighted below). A Group consists of Site Lists & Time bands. These combined together create a rule. You can create as many User Groups as you like, and in these groups you can add the Site Lists you made earlier, which will give different permissions to each User Group. The User Group created below is for the Students. Select the Add button from the User groups. Then you ll be presented with the below: Enter a Group name, e.g. Group Students Group Teachers The User Group name must be the same as the Security Group on Active Directory. This will allow the Group to be mapped. Make sure the Web tick box is selected. Select the Insert button as highlighted left. As you can see there are two drop-down list boxes, highlighted below: The first drop-down list gives you the choice of Site Lists. For the Students we have set-up three Site Lists (created earlier). The second drop-down list gives you the different Time bands available. In the first drop-down list box, I have selected the Whitelist created earlier. If you create a Whitelist for any Group this should come first to override the Black/Redlists. For the Time band I have selected Always Version Five 05f- NTT1 - Chapter Thirteen Page 6 of 10

7 As I have made three Site Lists for the Students, I need to add two more rules. To add a second rule below the first rule, select the bottom Insert button highlighted left. You will need to repeat this process to add a third rule. You should now have three sets of drop-down lists, as shown below: In the second rule Site List drop-down list, select the Redlist you created. A Redlist entered into any User Group should come before a Blacklist. In the third rule Site List drop-down list, select the Blacklist you created. Select the desired Time band you want from the Time band drop-down list for both rules. The last drop-down list (highlighted above) has two options, Allow all other sites and Block all other sites. You should choose the option, which is the opposite of the last rule. For example: If the last rule is a Whitelist, select Block all other sites. If the last rule is a Black/Redlist, select Allow all other sites. When you have entered all the Rule/s that you want to apply to your User Group, select OK and OK again to confirm settings. Adding an Individual User: If you need to block one specific user on your Active Directory, then please follow the below. Log on to your NetPilot as shown in Chapter One (b). From the left-hand side of the screen, select User accounts, then Users and then the Add button. (All links and button are highlighted below). You will be presented with this screen shown below: The User name entered left must be the same as the User on Active Directory. This password isn t used for Active Directory. However, it is used on the fileshare of the unit; therefore it will need to be secure. Select the appropriate User Group, from the list. Select OK and OK again The User Group contains Site Lists you assigned or created earlier. Site Lists enclose the option to allow/block certain URLs. For more information please see earlier sections Version Five 05f- NTT1 - Chapter Thirteen Page 7 of 10

8 Setting up Active Directory on the NetPilot: From the left-hand side of the screen, select Web, then Advanced, and then Active Directory. (All links are highlighted below). You will be presented with the Active Directory screen as shown above. Enter the following: Server Address : Enter your IP Address of your Active Directory Server Domain : Enter your Active Directory Domain (Which you noted down earlier) User and Password : Enter a User and Password that has the properties of an Administrator on the Active Directory Server. If you want to change the Admin User name and Password, you must change this on Active Directory first. The screen below has the default Administrator highlighted. You can change the details here, or create another user with admin rights. Select OK in the Active Directory screen on the NetPilot. You will then be presented with the below screen: Select the Next' button as highlighted left. You will see the screen below. Select from the three options on the left, which device is going to do the authentication. Once you have chosen an option select the OK button. Version Five 05f- NTT1 - Chapter Thirteen Page 8 of 10

9 You will be presented with the screen below: Select Next, as highlighted left. You will now be presented with the Web access controls, as shown below: Select accept: url-filter, authorised users from the drop-down list of the Trust Group that you wish to use. When the Users try and access the Internet they will not be asked for Username and Password. They will be authenticated from the log on details they entered at the beginning of their PC session. Select OK and OK again to confirm the settings you have made. Five tips: To check that the connection of the Active Directory was successful or not. From the left-hand side of the screen, select Logs, and then System. (All links are highlighted below) If it was successful you will see something similar to this in the logs: Apr 21 11:24:32 winbind: winbindd shutdown succeeded Apr 21 11:24:32 kinit: Password for school.domain: Apr 21 11:24:32 winbind: Obtaining Kerberos ticket for school.domain: succeeded Apr 21 11:24:32 named[7886]: XX+/ /np web.example.com/A/IN Apr 21 11:24:32 net: [2006/04/21 11:24:32, 0] libads/ldap.c:ads_add_machine_acct(1405) Apr 21 11:24:32 net: ads_add_machine_acct: Host account for np web already exists - modifying old account Apr 21 11:24:33 named[7886]: XX+/ /NP WEB.example.com/A/IN Apr 21 11:24:33 net: Using short domain name -- school Apr 21 11:24:33 net: Joined 'NP WEB' to realm ' school.domain' Apr 21 11:24:33 winbind: Joining school.domain domain: succeeded If it wasn t successful you will see something similar to this in the logs: Apr 26 09:38:02 winbind: Obtaining Kerberos ticket for school.domain: failed Apr 26 09:38:17 net: [2006/04/26 09:38:17, 0] utils/net_ads.c:ads_startup(186) Apr 26 09:38:17 net: ads_connect: Interrupted system call Apr 26 09:38:17 winbind: Joining school.domain domain: failed If the connection is unsuccessful, please check the domain name and details entered are correct. Version Five 05f- NTT1 - Chapter Thirteen Page 9 of 10

10 To view your NetPilot in your Network Neighbourhood: From the left-hand side of the screen, select Maintenance, then Services, and then Workgroup. (All links are highlighted below). Enter the shortname of your Active Directory Domain in the text box provided. When the NetPilot is being used as a Proxy, the user will not be prompted for a Username and Password when accessing the Internet as this is automatically done in the background. If you have problems with the Active Directory/LDAP queries, please make sure that the clock on the NetPilot and the server is synchronised. If you need any help with this, the following link will tell you how to setup NTP on a windows 2003 unit If any changes are made to the Security Group or Users in Active Directory, please clear the cache on the NetPilot so these changes can be activated. Setting up Students PCs for URL-Filtering: This will need to be set on each individual computer that should have filtered web access. Open up the Internet browser on each PC and select Tools and then Internet options In the Internet Options window, select the Connections tab (as highlighted in the left screen). Then select the LAN Settings button, (as highlighted in the right screen). In the new window (shown right): Enter a tick in the Bypass proxy server for local address box and make sure that in the Port box is Version Five 05f- NTT1 - Chapter Thirteen Page 10 of 10