Anonymous access in Microsoft Proxy 2.0 in WIN NT

[hourang]

Ok heres the prob, i want to have anonymous access blocked for the

http://www service

in micorsoft proxy 2.0 because of the fact that i had someone using our proxy server with anonymous access and taking up our bandwidth. But when i have it disabled, no programs like real audio, aol IM, icq, mirc, etc will work on a pc. as soon as i enable anon access they work again. Why is this??? they are logging in with a valid user name and password, it gives me an authorization error or something. Is the only other way to stop people from using it by changing the html port to something other than 80?? im new to network security and need help. Thanks for any info.

Jeff

 

[tangram]

On the MMC, right click on the Web Proxy and click on Properties, then Permissions. I guess you’ve been here before.

It's been a long while since I had to set this up but I seem to remember that the default settings, even with 'Enable Access Control' enabled was that everybody could use the service so it was effectively anonymous. Two ways out of this depending on how many users you need to allow. I don't have many (just under 100) so I set the machine to allow specific, named, individuals only. You could also create a group with all the accounts in, but that's just the same effort. Once you've got a specific account name logged, you'll be able to see who's online at any given moment too. To add accounts, click Edit and add the groups, users in the usual way.

The AOL and other similar services are configured under the SOCKS section, not the

http://WWW config.

Have a look at the permissions here. They are a bit more complex so I won't bother going into detail here, but should you need to, you can allow access only to specific IP addresses or ranges. If the access to the site is by account rather then general access then you need to install the PSProxy Client software on the target workstations. (Installed from the mspclnt <\\root\msp\clients>) Just run Setup! Dangerous this though, beware. If all your people have access to AOL and the like, not only do you massively increase the chances of a Virus attack through these mediums, but, as with FTP, your allowing free-range downloading of potentially dangerous, configuration challenging and downright illegal software. Do your people actualy need access to this in your corporate environment?