M86 Security M86 Web Filter User manual

M86 Web Filter
USER GUIDE
for Authentication
Software Version: 4.0.10
Document Version: 06.08.10

II M86 SECURITY USER GUIDE
M86 WEB FILTER AUTHENTICATION USER
GUIDE
© 2010 M86 Security
All rights reserved.
828 W. Taft Ave., Orange, CA 92865, USA
Version 1.01, published June 2010 for software release 4.0.10
Printed in the United States of America
This document may not, in whole or in part, be copied, photo-
copied, reproduced, translated, or reduced to any electronic
medium or machine readable form without prior written con-
sent from M86 Security.
Every effort has been made to ensure the accuracy of this
document. However, M86 Security makes no warranties with
respect to this documentation and disclaims any implied war-
ranties of merchantability and fitness for a particular purpose.
M86 Security shall not be liable for any error or for incidental
or consequential damages in connection with the furnishing,
performance, or use of this manual or the examples herein.
Due to future enhancements and modifications of this product,
the information described in this documentation is subject to
change without notice.
The latest version of this document can be obtained from
http://www.m86security.com/support/wf/documentation.asp
Trademarks
Other product names mentioned in this manual may be trade-
marks or registered trademarks of their respective companies
and are the sole property of their respective manufacturers.
Part# WF-AUG_v1.01-1006

M86 SECURITY USER GUIDE III
CONTENTS
C HAPTER 1: I NTRODUCTION .............................................. 1
About this User Guide ................................................................1
How to Use this User Guide .......................................................2
Conventions ...................................................................................... 2
Terminology ...................................................................................... 3
Filtering Elements .......................................................................8
Group Types ..................................................................................... 8
Global Group .............................................................................. 8
IP Groups . .................................................................................. 9
LDAP Domain Groups . ............................................................. 10
Filtering Profile Types ..................................................................... 11
Static Filtering Profiles . ............................................................. 13
Master IP Group Filtering Profile......................................... 13
IP Sub-Group Filtering Profile ............................................. 13
Individual IP Member Filtering Profile ................................. 13
Active Filtering Profiles . ............................................................ 14
Global Filtering Profile......................................................... 14
LDAP Filtering Profiles ........................................................ 14
Override Account Profile .................................................... 15
Time Profile ......................................................................... 15
Lock Profile ......................................................................... 15
Filtering Profile Components ........................................................... 16
Library Categories . ................................................................... 17
M86 Supplied Categories.................................................... 17
Custom Categories ............................................................. 17
Service Ports . ........................................................................... 18
Rules ........................................................................................ 18
Minimum Filtering Level ............................................................ 18
Filter Settings ............................................................................ 19
Filtering Rules ................................................................................. 21
Authentication Solutions ..........................................................24
LDAP Authentication Protocol ......................................................... 24
Web Filter Authentication Tiers and Options ................................... 24
Web Filter authentication tiers .................................................. 24

CONTENTS
iv M86 SECURITY USER GUIDE
Web Filter authentication options . ............................................ 25
Authentication Solution Compatibility .............................................. 26
Authentication System Deployment Options ................................... 27
Ports for Authentication System Access ......................................... 28
Configuring Web Filter for Authentication ....................................... 29
Configuration procedures ......................................................... 29
System section.................................................................... 29
Policy section ...................................................................... 32
C HAPTER 2: N ETWORK S ETUP ........................................ 33
Environment Requirements .....................................................33
Workstation Requirements .............................................................. 33
Administrator ............................................................................ 33
End User ................................................................................... 34
Network Requirements .................................................................... 34
Set up the Network for Authentication ....................................35
Specify the operation mode ............................................................ 36
Specify the subnet mask, IP address(es) ........................................ 38
Invisible mode ........................................................................... 38
Router or firewall mode . ........................................................... 39
Enable authentication, specify criteria ............................................. 40
Net use based authentication ................................................... 42
Web-based authentication . ....................................................... 43
Enter network settings for authentication ........................................ 46
Create an SSL certificate ................................................................ 48
Create, Download a Self-Signed Certificate . ............................ 49
Create, Upload a Third Party Certificate ................................... 50
Create a Third Party Certificate........................................... 50
Upload a Third Party Certificate ......................................... 52
Download a Third Party Certificate ..................................... 53
Specify block page settings ............................................................. 54
Block Page Authentication ........................................................ 54
Block page ......................................................................... 56
User/Machine frame ..................................................... 57
Standard Links.............................................................. 57
Optional Links ............................................................... 58
Options page ...................................................................... 59
Option 1 ........................................................................ 60
Option 2 ........................................................................ 61

CONTENTS
M86 SECURITY USER GUIDE v
Option 3 ........................................................................ 62
Common Customization ........................................................... 63
Enable, disable features ..................................................... 64
Authentication Form Customization .......................................... 66
Preview sample Authentication Request Form .................. 68
Block Page Customization ........................................................ 70
Preview sample block page ............................................... 72
Set up Group Administrator Accounts ...................................74
Add Sub Admins to manage nodes ................................................. 74
Add a group administrator account ........................................... 75
Update the group administrator’s password ............................. 75
Delete a group administrator account ....................................... 76
View Log Results ......................................................................77
C HAPTER 3: LDAP A UTHENTICATION S ETUP ................... 79
Create an LDAP Domain ...........................................................79
Add the LDAP domain ..................................................................... 79
Refresh the LDAP branch ............................................................... 80
View, modify, enter LDAP domain details ....................................... 80
LDAP Server Type .................................................................... 81
Group Objects .......................................................................... 82
User Objects ............................................................................. 84
Workstation Objects ................................................................. 85
Address Info ............................................................................. 86
Account Info .............................................................................. 88
SSL Settings ............................................................................. 90
Alias List ................................................................................... 92
Default Rule .............................................................................. 94
LDAP Backup Server Configuration ................................... 96
Configure a backup server............................................ 96
Modify a backup server’s configuration ...................... 100
Delete a backup server’s configuration....................... 101
Delete a domain ............................................................................ 101
Set up LDAP Domain Nodes ..................................................102
Add nodes to the domain tree list .................................................. 102
Perform a basic search ........................................................... 103
Options for search results .......................................................104

CONTENTS
vi M86 SECURITY USER GUIDE
Apply a filtering rule to a profile .............................................. 104
Delete a rule ........................................................................... 105
Specify a group’s filtering profile priority ....................................... 106
Manually add a workstation name to the tree ............................... 107
Manually add a user’s name to the tree ........................................ 108
Manually add a group’s name to the tree ...................................... 109
Upload a file of filtering profiles to the tree .................................... 110
C HAPTER 4: M ANAGE N ODES ....................................... 113
Assign Sub Admin to an LDAP Node ....................................114
Create and Maintain Filtering Profiles ...................................117
Add a group member to the tree list .............................................. 118
View Container Details .................................................................. 119
Add or maintain a node’s profile .................................................... 120
Category Profile ...................................................................... 121
Redirect URL . ......................................................................... 124
Filter Options . ......................................................................... 125
Add an Exception URL to the profile ............................................. 126
Valid URL entries .................................................................... 127
Add URLs to Block URL or ByPass URL frame ...................... 128
Remove URLs from Block URL or ByPass URL frame . ......... 130
Apply settings ......................................................................... 131
Create a Time Profile for the node ................................................ 131
Add a Time Profile ..................................................................132
Remove a node’s profile from the tree .......................................... 136
Verify that an LDAP Profile is Active .....................................137
C HAPTER 5: A UTHENTICATION D EPLOYMENT ................. 141
Test Authentication Settings ................................................. 141
Test Web-based authentication settings ....................................... 143
Step 1: Create an IP Group, “test” .......................................... 143
Step 2: Create a Sub-Group, “workstation” ............................ 143
Step 3: Set up “test” with a 32-bit net mask ............................144
Step 4: Give “workstation” a 32-bit net mask .......................... 145
Step 5: Block everything for the Sub-Group . .......................... 146
Step 6: Use Authentication Request Page for redirect URL ... 147
Step 7: Disable filter options ................................................... 148

CONTENTS
M86 SECURITY USER GUIDE vii
Step 8: Attempt to access Web content . ................................149
Test net use based authentication settings ................................... 151
Activate Authentication on the Network ............................... 152
Activate Web-based authentication for an IP Group ..................... 153
Step 1: Create a new IP Group, “webauth” ............................153
Step 2: Set “webauth” to cover users in range . ...................... 154
Step 3: Create an IP Sub-Group . ........................................... 155
Step 4: Block everything for the Sub-Group ........................... 156
Step 5: Use Authentication Request Page for redirect URL ... 157
Step 6: Disable filter options ................................................... 158
Step 7: Set Global Group to filter unknown traffic . ................. 159
Activate Web-based authentication for the Global Group ............. 163
Step 1: Exclude filtering critical equipment ............................. 163
Step 1A: Block Web access, logging via Range to Detect . .... 164
Range to Detect Settings .................................................. 164
Range to Detect Setup Wizard.......................................... 165
Step 1B: Block Web access via IP Sub-Group profile . ........... 170
Step 2: Modify the Global Group Profile ................................. 172
Add Net Use command to Login Scripts ....................................... 176
Step 1: Modify the 3-try login script ........................................ 176
Step 2: Modify the Global Group Profile ................................. 177
C HAPTER 6: T ECHNICAL S UPPORT ................................ 179
Hours ........................................................................................ 179
Contact Information ................................................................ 180
Domestic (United States) .............................................................. 180
International .................................................................................. 180
E-Mail ............................................................................................ 180
Office Locations and Phone Numbers .......................................... 181
M86 Corporate Headquarters (USA) ...................................... 181
M86 Taiwan ............................................................................ 181
Support Procedures ................................................................ 182
A PPENDIX A: A UTHENTICATION O PERATIONS ................ 183
Authentication Tier Selections .............................................. 183
Tier 1: Net use based authentication ............................................ 183

CONTENTS
viii M86 SECURITY USER GUIDE
Tier 2, Tier 3: Web-based authentication ...................................... 183
Tier 1: Single Sign-On Authentication ..................................184
Net use based authentication process .......................................... 184
Re-authentication process ...................................................... 185
Tier 1 authentication method ......................................................... 186
Name resolution methods ............................................................. 186
Configuring the authentication server ........................................... 187
Login scripts ........................................................................... 187
Enter net use syntax in the login script ............................. 187
View login script on the server console .................................. 188
Block page authentication login scripts ............................. 188
LDAP server setup rules ............................................................... 189
Tier 2: Time-based, Web Authentication ...............................190
Tier 2 implementation in an environment ...................................... 191
Tier 2 Script . ........................................................................... 192
Tier 1 and Tier 2 Script . .......................................................... 193
Tier 3: Session-based, Web Authentication ......................... 195
M86 Authenticator ................................................................... 196
Environment requirements ............................................................ 197
Windows minimum system requirements ............................... 197
Recommended system requirements ............................... 197
Macintosh minimum system requirements .............................198
Workstation requirements ............................................................. 198
Work flow in environments ............................................................ 199
Windows environment ............................................................ 199
Macintosh environment . ......................................................... 200
M86 Authenticator configuration priority . ................................ 201
Windows............................................................................ 201
Macintosh ......................................................................... 202
M86 Authenticator configuration syntax . ................................ 203
Sample command line parameters ................................... 203
Sample configuration file ............................................ 203
Sample configuration update packet ‘PCFG’.............. 204
Table of parameters . .............................................................. 205
Novell eDirectory Agent ......................................................... 208
Environment requirements ............................................................ 208

CONTENTS
M86 SECURITY USER GUIDE ix
Novell eDirectory servers ........................................................ 208
Client workstations . ................................................................ 209
Novell clients .......................................................................... 209
Novell eDirectory setup ................................................................. 209
Web Filter setup and event logs .................................................... 210
Active Directory Agent ........................................................... 211
Product feature overview .............................................................. 211
Windows server requirements . ...............................................212
Work flow in a Windows environment ..................................... 212
Set up AD Agent ........................................................................... 213
Step 1: AD Agent settings on the Web Filter .......................... 213
Step 2: Configure the domain, service account ...................... 215
Step 3: AD Agent installation on Windows server .................. 216
Step 3A: Download DCAgent.msi ..................................... 216
Step 3B: Run AD Agent installation setup.........................216
Step 3C: Run AD Agent configuration wizard ................... 219
Use the Active Directory Agent console ........................................ 224
Activity tab .............................................................................. 224
Sessions tab . .......................................................................... 227
Session table spreadsheet................................................ 229
Session Properties window .............................................. 230
Workstation Interactive Probe window .............................. 231
Active Directory Agent Configuration window ......................... 233
Service page .................................................................... 235
Appliance page ................................................................. 236
Agent hosts page ............................................................. 237
Add a satellite ............................................................. 238
Remove a satellite ...................................................... 238
Configure a satellite .................................................... 239
Check the status of a satellite..................................... 241
Options page .................................................................... 243
Notifications page ............................................................. 245
A PPENDIX B: O BTAIN , E XPORT AN SSL C ERTIFICATE .... 247
Export an Active Directory SSL Certificate ..........................247
Verify certificate authority has been installed ................................247
Locate Certificates folder .............................................................. 248
Export the master certificate for the domain ................................. 251

CONTENTS
xM86 SECURITY USER GUIDE
Export a Novell SSL Certficate .............................................. 255
Obtain a Sun One SSL Certificate ......................................... 257
A PPENDIX C: LDAP S ERVER C USTOMIZATIONS ............. 258
OpenLDAP Server Scenario ...................................................258
Not all users returned in LDAP Browser window .......................... 258
A PPENDIX D: P ROFILE F ORMAT AND R ULES .................. 259
Username Formats .................................................................. 260
Rule Criteria ............................................................................. 260
File Format: Rules and Examples .......................................... 263
LDAP Profile List Format and Rules ............................................. 264
Workstation profile list format ................................................. 264
User profile list format ............................................................. 265
Group profile list format .......................................................... 266
Container profile list format ..................................................... 266
LDAP Quota Format and Rules ....................................................267
A PPENDIX E: O VERRIDE P OP - UP B LOCKERS ................. 268
Yahoo! Toolbar Pop-up Blocker ............................................269
If pop-up blocking is enabled ........................................................ 269
Add override account to the white list ........................................... 269
Google Toolbar Pop-up Blocker ............................................271
If pop-up blocking is enabled ........................................................ 271
Add override account to the white list ........................................... 271
AdwareSafe Pop-up Blocker .................................................. 272
If pop-up blocking is enabled ........................................................ 272
Temporarily disable pop-up blocking ............................................ 272
Mozilla Firefox Pop-up Blocker .............................................. 273
Add override account to the white list ........................................... 273
Windows XP SP2 Pop-up Blocker .........................................275

CONTENTS
M86 SECURITY USER GUIDE xi
Set up pop-up blocking ................................................................. 275
Use the Internet Options dialog box ....................................... 275
Use the IE toolbar . .................................................................. 276
Temporarily disable pop-up blocking ............................................ 276
Add override account to the white list ........................................... 277
Use the IE toolbar ................................................................... 277
Use the Information Bar .......................................................... 278
Set up the Information Bar ................................................ 278
Access your override account ........................................... 278
A PPENDIX F: G LOSSARY ............................................... 280
Definitions ................................................................................ 280
I NDEX ........................................................................... 287

CONTENTS
xii M86 SECURITY USER GUIDE

CHAPTER 1: INTRODUCTION ABOUT THIS USER GUIDE
M86 SECURITY USER GUIDE 1
CHAPTER 1: INTRODUCTION
The M86 Web Filter Authentication User Guide contains
information about setting up authentication on the network.
About this User Guide
This user guide addresses the network administrator desig-
nated to configure and manage the Web Filter on the
network.
Chapter 1 provides information on how to use this user
guide, and also includes an overview of filtering compo-
nents and authentication solutions.
Chapters 2 and 3 describe the Web Filter Administrator
console entries that must be made in order to prepare the
network for using authentication for LDAP domains.
NOTE: Refer to the M86 Web Filter Installation Guide, M86 IR
Web Filter Installation Guide, or M86 WFR Installation Guide for
information on installing the unit on the network. This document
also provides information on how to access the Web Filter Admin-
istrator console to perform the initial installation setup defined in
Chapter 2: Network Setup.
After all settings have been made, authentication is ready to
be used on the network. Chapter 4 explains how to assign
groups and members for management by Sub Admin group
administrators, and how group administrators create and
maintain filtering profiles for entities in their assignment.
Chapter 5 outlines the step you need to take to test and to
activate your settings before deploying authentication on
the network.
Chapter 6 provides support information. Appendices at the
end of this user guide feature instructions on authentication
operations; information on how to obtain or export an SSL
certificate and upload it to the Web Filter; notes on custom-

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
2M86 SECURITY USER GUIDE
izations to make on specified LDAP servers; filtering profile
file components and setup; tips on how to override pop-up
windows with pop-up blocker software installed; a glossary
on authentication terms, and an index.
How to Use this User Guide
Conventions
The following icons are used throughout this user guide:
NOTE: The “note” icon is followed by italicized text providing
additional information about the current subject.
TIP: The “tip” icon is followed by italicized text giving you hints on
how to execute a task more efficiently.
WARNING: The “warning” icon is followed by italicized text
cautioning you about making entries in the application, executing
certain processes or procedures, or the outcome of specified
actions.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
M86 SECURITY USER GUIDE 3
Terminology
The following terms are used throughout this user guide.
Sample images (not to scale) are included for each item.
• alert box - a message box
that opens in response to
an entry you made in a
dialog box, window, or
screen. This box often
contains a button (usually labeled “OK”) for you to click in
order to confirm or execute a command.
• button - an object in a dialog box,
window, or screen that can be clicked
with your mouse to execute a command.
• checkbox - a small square in a dialog
box, window, or screen used for indi-
cating whether or not you wish to select an option. This
object allows you to toggle between two choices. By
clicking in this box, a check mark or an “X” is placed, indi-
cating that you selected the option. When this box is not
checked, the option is not selected.
• dialog box - a box that
opens in response to a
command made in a
window or screen, and
requires your input. You
must choose an option by clicking a button (such as
“Yes” or “No”, or “Next” or “Cancel”) to execute your
command. As dictated by this box, you also might need
to make one or more entries or selections prior to clicking
a button.
• field - an area in a dialog box,
window, or screen that either
accommodates your data entry, or displays pertinent
information. A text box is a type of field.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
4M86 SECURITY USER GUIDE
• frame - a boxed-in area in a dialog
box, window, or screen that
includes a group of objects such as
fields, text boxes, list boxes,
buttons, radio buttons, check-
boxes, and/or tables. Objects within a frame belong to a
specific function or group. A frame often is labeled to indi-
cate its function or purpose.
• grid - an area in
a frame that
displays rows
and columns of
data, as a result of various processes. This data can be
reorganized in the Administrator console, by changing
the order of the columns.
• list box - an area in a dialog box,
window, or screen that accommo-
dates and/or displays entries of
items that can be added or removed.
• navigation panel - the panel that
displays at the left of a screen. This
panel can contain links that can be
clicked to open windows or dialog boxes
at the right of the screen. One or more
tree lists also can display in this panel.
When an item in the tree list is clicked,
the tree list opens to reveal items that
can be selected.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
M86 SECURITY USER GUIDE 5
• pop-up box or pop-up
window - a box or window
that opens after you click a
button in a dialog box,
window, or screen. This box
or window may display infor-
mation, or may require you
to make one or more entries.
Unlike a dialog box, you do not need to choose between
options.
• pull-down menu - a field in a
dialog box, window, or screen
that contains a down-arrow to the right. When you click
the arrow, a menu of items displays from which you make
a selection.
• radio button - a small, circular object in
a dialog box, window, or screen used
for selecting an option. This object allows you to toggle
between two choices. By clicking a radio button, a dot is
placed in the circle, indicating that you selected the
option. When the circle is empty, the option is not
selected.
• screen - a main
object of an appli-
cation that
displays across
your monitor. A
screen can
contain panels,
windows, frames,
fields, tables, text
boxes, list boxes, icons, buttons, and radio buttons.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
6M86 SECURITY USER GUIDE
• sub-topic - a subset
of a main topic that
displays as a menu
item for the topic. The
menu of sub-topics
opens when a perti-
nent topic link in the left panel—the navigation panel—of
a screen is clicked. If a sub-topic is selected, the window
for that sub-topic displays in the right panel of the screen,
or a pop-up window or an alert box opens, as appro-
priate.
• text box - an area in a dialog box, window, or screen that
accommodates your data entry. A text box is a type of
field. (See “field”.)
• topic - a
topic
displays as
a link in the
left panel—
the naviga-
tion panel—
of a screen.
By clicking
the link for a
topic, the
window for that topic displays in the right panel of the
screen, or a menu of sub-topics opens.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
M86 SECURITY USER GUIDE 7
• tree - a tree displays in the naviga-
tion panel of a screen, and is
comprised of a hierarchical list of
items. An entity associated with a
branch of the tree is preceded by a
plus (+) sign when the branch is
collapsed. By double-clicking the
item, a minus (-) sign replaces the
plus sign, and any entity within that
branch of the tree displays. An item
in the tree is selected by clicking it.
• window - a window displays on
a screen, and can contain
frames, fields, text boxes, list
boxes, buttons, checkboxes,
and radio buttons. A window for
a topic or sub-topic displays in
the right panel of the screen.
Other types of windows include
pop-up windows, login
windows, or ones from the
system such as the Save As or
Choose file windows.

CHAPTER 1: INTRODUCTION FILTERING ELEMENTS
8M86 SECURITY USER GUIDE
Filtering Elements
Filtering operations include the following elements: groups,
filtering profiles and their components, and rules for filtering.
Group Types
In the Policy section of the Administrator console, group
types are structured in a tree format in the navigation panel.
There are four group types in the tree list:
• Global Group
• IP groups
• LDAP domain groups
NOTES: If authentication is enabled, the global administrator—
who has all rights and permissions on the Web Filter—will see all
branches of the tree: Global Group, IP, and LDAP. If authentica-
tion is disabled, only the Global Group and IP branches will be
seen.
A group administrator will only see entities assigned to him/her by
the global administrator.
Global Group
The first group that must be set up is the global group,
represented in the tree structure by the global icon .
The filtering profile created for the global group represents
the default profile to be used by all groups that do not have
a filtering profile, and all users who do not belong to a group.