2

I have a HTTP proxy using Squid or similar, and the proxy is configured to require Proxy Authentication. As we all know, proxy authentication does not work in interception mode. I also have lots of mobile clients.

I am currently using WPAD, to configure these devices, but a recent answer reminded me that this opens a security issue.

What alternative methods exist, to configure the proxy on client machines, that must also be usable on foreign networks?

1

It's too bad you can't set Network Location specific Internet Explorer\Internet Settings GPOs because that would quite neatly solve this issue. Oh well.

WPAD is really just a protocol for clients to acquire their Proxy Auto-Config (PAC) file. The PAC file contains the information that browsers need to find and authenticate to their local proxy and is really just JavaScript. In this situation, I would create a PAC file that contains enough logic to check whether or not the client is connected to your internal network and can access the proxy locally, is connected to your internal network via a remote VPN connection (you may still want to proxy remote clients) or is connected to a completely foreign network and then pass the appropriate proxy information to the browser. See this question for an example of how to do this.

You could then build a GPO that:

  1. Pushes the PAC file out to client's C:\ so its available to them when they're not on the local network (User Configuration\Preferences\Windows Settings\Files)
  2. Configures Internet Explorer to use it (User Configuration\Polices\Windows Settings\Internet Explorer Maintenance\Connection\Automatic Browser Configuration)


I should also mention that many OEM's provide 3rd party tools to do "Network Profile" management. I believe Dell had one called Network Connection Manager that was bundled with their NIC drivers, although the inability to centrally manage it made it a non-starter in our environment. There is likely other paid 3rd party applications that provide Network Profile/Location-specific management of these settings.

  • A local pac, I guess that can work in some cases. I have no idea how I could deploy that to the iPads/iPhones, and similar devices which support wpad, but have no real way to deploy settings to. – Zoredache Aug 6 '13 at 19:30
  • 1
    @Zoredache - I think at that point you're looking at a MDM solution of some kind. Building a local PAC file is kind of hacky but works for organizations that don't have a full featured MDM tool. – kce Aug 6 '13 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.