Setup Guide Revision A. WDS Connector

Setup Guide Revision A WDS Connector

COPYRIGHT Copyright 2013 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee CleanBoot, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundscore, Foundstone, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. Product and feature names and descriptions are subject to change without notice. Please visit mcafee.com for the most current products and features. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 WDS Connector Setup Guide

Contents 1 Introduction 5 Requirements................................... 6 Download the WDS Connector............................. 6 Steps to setup WDS Connector............................. 6 Setup Users for the WDS Connector.......................... 9 2 Reinstall WDS Connector 11 Steps to reinstall WDS Connector........................... 11 3 Change WDS Connector settings using AD Config Editor 13 4 Uninstall the WDS Connector 15 5 Manage WDS Connector logs 17 Turn on the WDS Connector logs........................... 17 View the WDS Connector logs............................ 18 6 Enable NTLM on Windows Client 19 7 Troubleshooting 21 Determine Embedded Communications......................... 21 WDS Connector Setup Guide 3

Contents 4 WDS Connector Setup Guide

1 1 Introduction The WDS Connector SM, which is an enhancement to the Web Protection Service, allows users to access the web through Web Protection using existing local network domain credentials. This capability, known as transparent authentication, eliminates the need for Web Protection to authenticate a user each time the user opens a browser. Instead, Web Protection validates users automatically whenever they open a browser. Administrators of the Web Protection service can continue to apply group policies to users, as well as track individual web usage, threats, and more. Contents Requirements Download the WDS Connector Steps to setup WDS Connector Setup Users for the WDS Connector WDS Connector Setup Guide 5

1 Introduction Requirements Requirements Before you install WDS Connector, ensure that the following requirements are met: Table 1-1 Checklist for WDS Connector Installation Review the following list before installing WDS Connector: Web Protection service must be enabled. A Domain Controller must reside within the customer's Intranet and must be running Active Directory. You need the DNS name or IP address of this controller. Each user that WDS Connector authenticates must have an account in Active Directory. That account must contain the same email address that the Web Protection Control Console contains. You must have Customer Administrator or higher privileges on the Web Protection Control Console. The local intranet must contain a Microsoft Windows server that can run the WDS Connector software and serve as a proxy server. This server must meet the following requirements: The server must be running Microsoft Windows Server 2003 or higher software and Microsoft Management Console (MMC) Services snap in. All available updates for the server's version of Microsoft Windows must also be installed. The firewall on the proxy server must allow access by user clients. Specifically, port 3128 tcp must be open outbound to the Internet. The proxy settings in Microsoft Internet Explorer on the proxy server must be turned off for installation. The time clock of the proxy server must be reasonably accurate, at least within one hour of the actual time within its time zone. It is recommended that your LAN use a network time server to ensure this synchronization. The proxy server must be running.net 2.0 or higher. If the server is not running.net 2.0 or higher, the installer notifies you during the initial setup and installs.net for you. NTLM enabled browser (FF or IE on Windows) NTLM information must be passed from the client machine. See Section 6 Although the installer installs.net 2.0, if the server also is running an earlier version of.net, the earlier version of.net can continue running normally. It is recommended that you implement the Directory Integration feature within Account Management before using WDS Connector. In this way, you greatly increase the likelihood that user email addresses in Active Directory match the email addresses in the Web Protection Control Console. Download the WDS Connector You must download the WDS Connector Setup from your Web Protection Control Console. Steps to setup WDS Connector To download the WDS Connector Setup, complete the following steps: Before you begin Ensure that the proxy settings in Internet Explorer on the proxy server are turned off. 6 WDS Connector Setup Guide

Introduction Steps to setup WDS Connector 1 Task 1 Log in to the Web Protection Control Console. The Web Protection Control Console appears. 2 Click the Setup tab. The Web Protection Setup window appears. 3 Click the Download WDS Connector link A Run window appears and asks if you want to Run or Save the installation program. 4 Depending on the computer from which you accessed the Web Protection Control Console, perform the steps for one of the following two scenarios: If you accessed the Web Protection Control Console from the Microsoft Windows server that will be the proxy server, do the following: 1 Select Run. The installer checks for Windows updates and the presence of.net 2.0. If.NET 2.0 is not installed, the installer installs it. The installer redisplays a Run screen. If all applicable Windows updates are not installed, the installation fails. 2 Select Run again. The WDS Connector Setup opens. 3 Continue with the Run the WDS Connector Setup section. If you accessed the Web Protection Control Console from a computer other than the proxy server, save the files on a portable media and transfer them to the proxy server. 4 On the proxy server, locate the file you downloaded and double click to run it. A Run screen appears, asking if you want to Run or Save the installation files. 5 Select Run. The installer checks for Windows updates and the presence of.net 2.0. If.NET 2.0 is not installed, the installer performs an installation of.net. The installer redisplays a Run screen. If all applicable Windows updates are not installed, the installation fails. WDS Connector Setup Guide 7

1 Introduction Steps to setup WDS Connector 6 Select Run again. The WDS Connector Setup opens. 7 Continue with the Run the WDS Connector Setup section. If your system receives the following error message during the Web Protection Setup, it means Short File Names are disabled. Continue with the following steps to enable this information. 5 Click OK. The following WDS Connector Install screen displays. 6 Click OK. The WDS Connector Installation screen displays. 7 Click Close to exit your installer. Restart your system to continue the Web Protection installer setup. After completing these steps you have to restart your system and begin to install the WDS Connector from the start. 8 After restarting your system, enter the username and password you normally use to access the Web Protection Admin Console, and click Next. The Setting Active Directory Connection Information window appears. Table 1-2 Setting Active Directory Connection Field AD Hostname FQDN Description Enter the fully qualified domain name (FQDN) of the Active Director AD Hostname FQDN domain controller in the local intranet. Although an FQDN is preferred because it minimizes network requests, a non FQDN domain name is also allowed in this field. Domain\Username Enter a user name for the domain controller, using standard Windows domain user name format. Standard Windows user name format includes the domain name, followed by a backslash (\), followed by the username (for example, (acme domain\johndoe). 9 Enter a password for the user name in the Password field. 10 Click Next. A confirmation information screen displays. The Test button can be used to validate your AD settings. For more information regarding this functionality. The Account setup screen appears. 11 Select Local System account or enter a User name and password for a unique WDS Connector account. If you set up a unique account for WDS Connector, you must also administer the account on the Active Directory domain controller. 12 Click Next. 8 WDS Connector Setup Guide

Introduction Setup Users for the WDS Connector 1 13 Click Close. 14 To verify that WDS Connector is running, access your Windows services window. Go to Start All Programs Administrative Tools Component Services. For most Microsoft Windows systems, access the Microsoft Windows services screen through the Windows Control Panel. Check the screen to verify that the WDS Connector has started. Setup Users for the WDS Connector The browser settings on each user s personal computer must be administered for the new proxy server. These settings must include port 3128 as the browser s access port on the proxy server. For example, to manually set the Windows Internet Explorer browser for an individual P.C., you access the Local Area Network (LAN) Settings screen in Internet Explorer and administer the Proxy Server section for the following: WDS Connector Setup Guide 9

1 Introduction Setup Users for the WDS Connector The use of a proxy server by the browser The IP address or host name of the proxy server Port 3128 for the proxy server connection Contact your local support Web site or local support personnel for information on various methods of configuring browser proxy settings to point to the WDS Connector. For the WDS Connector to authenticate a user, the user must already have an account in Active Directory (AD), and the AD account must include an email address that matches an email address in the Web Protection Control Console. If Microsoft Exchange is installed and running on the AD server and the user already has an Exchange account, the user s email address is automatically populated in AD when the user s AD account is created. However, when Exchange isn't already running on the proxy server, or when Exchange is running on a different server, the user s email must be added manually into the user s AD account. 10 WDS Connector Setup Guide

2 2 Reinstall WDS Connector If you must reinstall the WDS Connector, the installation software checks that the WDS Connector is not running before the installation software resumes the installation. Steps to reinstall WDS Connector To reinstall WDS Connector, complete the following: Before you begin During the reinstallation sequence, you might see the following screen: If this is the case, do the following steps: Task 1 Click No. A number of screens may appear and disappear as the WDS Connector shuts down. Then, the following screen appears. 2 Select the default Repair WDS Connector option, and click Cancel. The wizard prompts for confirmation on exit. 3 Click No. The Welcome screen appears again. 4 Click Finish. Continue with the installation as in the Run the WDS Connector Setup Wizard section of this document. WDS Connector Setup Guide 11

2 Reinstall WDS Connector Steps to reinstall WDS Connector 12 WDS Connector Setup Guide

3 Change 3 WDS Connector settings using AD Config Editor You can use the AD Config Editor to edit or update change settings for Web Protection. Before you begin To edit your change settings for Web Protection including the: Host Name Domain Password Task 1 From the Start menu, select All Programs WDS Connector AD Config Editor. The Edit Active Directory Connection screen displays. 2 Type the changes you want to make. 3 Click Test A Success Information window displays. 4 Click OK and then Click Save. 5 Restart your Connector: From the Start menu select All Programs Administrative Tools Component Services. WDS Connector Setup Guide 13

3 Change WDS Connector settings using AD Config Editor In the event that your AD Hostname is invalid, the following Failure Information pop up displays to alert you to one of these issues: This is an invalid AD Hostname The AD Hostname is not visible to this machine The AD is not running on that machine The AD Hostname machine is down. 6 Click OK to edit your information. 7 Click Test and if successful, Click OK and Save. A Success Information window displays. 8 Restart your Connector: From the Start menu select All Programs Administrative Tools Component Services. If the user name or password is invalid, the following failure Information pop up displays. 9 Click OK to edit your information. 10 Click Test and if successful, Click OK and Save. 11 Restart your Connector: From the Start menu select All Programs Administrative Tools Component Services. 14 WDS Connector Setup Guide

4 4 Uninstall the WDS Connector If needed, you can uninstall the WDS Connector. Task 1 From the Start menu, select All Programs WDS Connector WDS Connector Uninstall. A confirmation page appears 2 Click Yes The WDS Connector is removed from your server. WDS Connector Setup Guide 15

4 Uninstall the WDS Connector 16 WDS Connector Setup Guide

5 Manage 5 WDS Connector logs The WDS Connector can generate logs of activity. These logs are turned off by default, but for troubleshooting purposes in conjunction with support personnel, you might want to turn the logs on. The logs can generate a lot of data. You should only turn on the WDS Connector logs for troubleshooting purposes. Otherwise, the logs quickly begin to take up disk space. Contents Turn on the WDS Connector logs View the WDS Connector logs Turn on the WDS Connector logs To turn on the WDS Connector logs, perform the following steps: Task 1 From the Start button on the Windows Task Bar, select All Programs. The list of programs appears. 2 Select WDS Connector from the list. Then select WDS Connector Configuration Manager from the pop up menu. The WDS Connector Configuration Manager page displays. 3 Click Turn Logging On. The button changes to Turn Logging Off. WDS Connector Setup Guide 17

5 Manage WDS Connector logs View the WDS Connector logs WDS Connector is ready to send data to its logs. View the WDS Connector logs To view the WDS Connector logs, perform the following steps: Task 1 In your Windows Explorer, locate the directory in which you installed WDS Connector. The default location is within the Program Files directory at C:\Program Files\ WDS Connector. 2 From the WDS Connector directory, access the following path: WDS Connector Proxy\var\logs. The logs directory appears. 3 Double click any file name to view its contents. The individual log file displays. 18 WDS Connector Setup Guide

6 Enable 6 NTLM on Windows Client The WDS Connector requires NTLM information and the client must be configured to use NTLM. Unfortunately, newer versions of Windows operating systems (Vista and beyond) do not inherently provide NTLM information when used in conjunction with newer versions of Windows Server (2008 and beyond). To use McAfee SaaS Web Protection Service with the WDS Connector installed on a Microsoft Windows Server 2008 with a Windows Vista/Windows 7 system, complete the following: On the Windows 7 or Vista PC follow these steps: 1 From the Start menu, select Control Panel. 2 Change the view to small icons. 3 Click Administrative Tools. 4 Select Local security policies Local Policies. 5 Select Security options. 6 Find the Network Security: Lan Manager authentication level. Click on it and change the setting from undefined to Send LM & NTLM responses. If the previous steps are incomplete, continue to enable NTLM on a Windows client by adding the following entry to the Windows registry: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "LmCompatibilityLevel"=dword:00000000 This can be automated by using a login script to add the entry to the client machines upon logon. A.reg file must be created and then called from a batch file. In the script folder of the Windows Domain Controller machine, create a new text file and call it something like WDS_Connector_Fix.reg for convenience. This file should contain the following text (the blank line is necessary): Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "LmCompatibilityLevel"=dword:00000000 An associated batch file must contain the line similar to the one below (replace the Domain Controller Host and script share to include a valid UNC path to the script folder): regedit /s \\<Domain Controller host>\<script share>\wds_controller_fix.reg WDS Connector Setup Guide 19

6 Enable NTLM on Windows Client This batch file also needs to be added to the appropriate domain in the Group Policy Editor. McAfee recommends using caution when editing the registry on any computer. While the change suggested is relatively low risk, please note that changing the Windows Registry may have unexpected consequences. Be sure to back up all work prior to executing any changes. 20 WDS Connector Setup Guide

7 Troubleshooting 7 The WDS Connector requires NTLM session information in order to authentication requests. Some embedded applications (media players, Java applets, etc.) will access the proxy settings in the browser, but do not inherently support either NTLM session handling or any mechanism to provide authentication credentials to the system. The only way to allow these applications to connect to the internet is to bypass the WDS Connector. The effect of this issue is that the application will appear to hang or, potentially display an error or connection timeout. Instructions for finding the problematic request are listed below. Determine Embedded Communications The only way to handled embedded applications that themselves are not NTLM enabled is to bypass those sites. Most embedded Java applications pick up the browser proxy settings, but do not send NTLM data. The easiest way to bypass is to add the IPs or hosts of the Java request, etc. to the exception or bypass list of the mechanism used to set the proxy. Exceptions can be added to the manual browser proxy configuration, to a Proxy Auto Configuration (PAC) file, or to the exception list in the Windows registry view GPO or.reg file. Please reference the Web Protection Services Setup Guide for instructions on adding exceptions. The following are recommended steps to configure Java Applications: 1 Open the Control panel. 4 In Network Settings select Direct connection. 2 Open the Java application. 5 Click OK. 3 In the general tab select Network Settings. If these steps are incomplete, continue with the embedded issues exemptions. To find embedded issues: Examine the source HTML see where the player or applet is being called from and, more importantly, what the source of the stream is. Most media players will have this exposed in the source as a parameter to the embed or object, but it may be in an included.js file. Examine the request and response headers. Using a tool like http://www.blunck.info/ iehttpheaders.html (IE) or http://livehttpheaders.mozdev.org/ (Firefox) to view headers, or a more comprehensive debug tool like Firebug (http://getfirebug.com/ for Firefox) that lets you look at the requests and responses. A 407 error or response code is an authentication request, but often the resulting effect can be seen as well. WDS Connector Setup Guide 21

7 Troubleshooting Determine Embedded Communications Use a debugging proxy to look at the requests and results. Charles Debugging Proxy (http://www.charlesproxy.com/) or Fiddler (http://www.fiddler2.com/fiddler2/) are options that are available. Use a packet capture tool like Wireshark (http://www.wireshark.org/) to look at the network traffic In the request header from the browser, you should see the NTLM Authentication information as listed in the following: HTTP/1.0 407 Proxy Authentication Required Server: squid/2.6.stable18 Date: Wed, 09 Mar 2011 18:38:00 GMT Content Type: text/html Content Length: 1373 Expires: Wed, 09 Mar 2011 18:38:00 GMT X Squid Error: ERR_CACHE_ACCESS_DENIED 0 Proxy Authenticate: NTLM TlRMTVNTUAACAAAAHgAeADgAAAAFwomitx/ Ml9yhb9UgrZMAAAAAANYA1gBWAAAABQLODgAAAA9XAEQAUwAyADAAMAAzAEUAWABDAEgAMgAwADAANwACAB 4AVwBEAFMAMgAwADAAMwBFAFgAQwBIADIAMAAwADcAAQWAEUAWABDAEgAMgAwADAANwAtADYANAAEACYAdw BkAHMAMgAwADAAMwBlAHgAYwBoADIAMAAwADcALgBjAG8AbQADAD4AZQB4AGMAaAAyADAAMAA3AC0ANgA0A C4AdwkAHMAMgAwADAAMwBlAHgAYwBoADIAMAAwADcALgBjAG8AbQAFACYAdwBkAHMAMgAwADAAMwBlAHgAY wboadiamaawadcalgbjag8abqaaaaaa X Cache: MISS from exch2007 64.wds2003exch2007.com X Cache Lookup: NONE from exch2007 64.wds2003exch2007.com:3128 Via: 1.0 exch2007 64.wds2003exch2007.com:3128 (squid/2.6.stable18) Proxy Connection: keep alive Notice the header labeled Proxy Authentication followed by NTLM and a bunch of data. This is what is expected (although the content of the data will change, it should look similar in nature). If the NTLM information is missing, this is an indication that the requesting component does not provide support. Add the requested URL or host into the bypass list. Tools listed in this section are third party utilities not developed nor supported by McAfee. This information is provided for your convenience only and is not an endorsement or recommendation. 22 WDS Connector Setup Guide

Index WDS Connector Setup Guide 23

A00