We are currently evaluating Astaro for one of our secondary school clients. After installing Astaro, it looks like the only authentication methods available are via squid-auth which I don't believe will be sufficient for this client (and of course isn't transparent). I've listed the needs for the client below, I'd appreciate any suggestions on how (if at all) to achieve this with Astaro. Thanks, Jon
The school needs to authenticate all users before providing internet access. Once authenticated, the users web traffic must be tracked in the event that confirmation is later required of 'inappropriate' access. The preferred method would be for the firewall to block all traffic to the internet from an IP until the user has visited a web page and logged in.. this should be done without any configuration to the client (i.e. setting a proxy) although if absolutely necessary we may consider this. Simply blocking web access until authentication is insufficient because the user would still be able to use other ports for anonymous proxy or gaming... etc. We had been considering the use of nocatauth in combination with squid in transparent mode but the documentation for Astaro made it appear that ASL would do this. How can we achieve this goal?
Another possible (but not preferred) option is to provide transparent proxy for logging and log iptables and accounting to a high level and hope that the user we think is at a computer (IP) is in fact at that machine. If we do this, we would need to provide some confirmation that the IP isn't simply stolen (i.e. static dhcp entries aren't sufficient). Is there some way to tell ASL to only route packets from a list of MACs? The existing network infrastructure (switches) is inadequate to do this at that level.
I realize that there are ways around both of these methods like MAC cloning but we think this will be sufficient in combination with accounting (so we will see a bandwith spike if someone is doing something they shouldn't). I'd appreciate any suggestions on how to do this with ASL or any other inexpensive and confirmed method to achieve this goal.
Thanks, Jon
This thread was automatically locked due to age.