Kent Community Network

Using Internet Explorer 7 and a FQDN in proxy settings improves internet performance

PeterBanbury — Thu, 09 Oct 2008 13:50:00 GMT

Why using Internet Explorer 7 and specifying the FQDN in proxy settings improves internet performance for schools with local Websense Servers

From our experience in the field, when setting proxy settings many schools seem to have used the IP address of the filtering server (not good practise in case the IP ever needs to be changed) or have specified the NetBIOS name (e.g. inet1-1234) we have also seen many schools are still using Internet Explorer 6 or Firefox.

Internet explorer 6 has a known limitation that it cannot support Kerberos authentication with a proxy server, Firefox also has this limitation unless specifically configured to use Kerberos.

http://support.microsoft.com/kb/321728/

When Kerberos authentication is not available, NTLM will be the preferred authentication.

There are several disadvantages of this. NTLM will create a secure channel to a single Domain controller, so the load will not be distributed to multiple DC’s.

There is also a built in limitation of 5 concurrent authentication requests when using NTLM, therefore in a busy environment such as a school, requests will be queued which may cause a lag and affect internet performance.

Illustration: Internet Explorer 6 or Firefox using NTLM authentication and proxy

When using Internet Explorer 7 with the fully qualified domain name of the filtering server specified in proxy settings, Kerberos authentication is utilised. There are several advantages to this:

• Removes the high intensive workload that we have from the ISA Server to a single Domain Controller;

• The client is responsible to obtain the authorization (Kerberos Ticket-Granting Service Request) from the Domain Controller when ISA Server requests authentication to access a web site;

• The authentication request will be distributed among all Domain Controllers (KDCs) available in the domain.

Illustration: Internet Explorer 7 using Kerberos authentication and proxy

In summary, using Internet explorer 7 and the FQDN name of the proxy server in proxy settings means that the clients will be responsible for authenticating themselves against a number of DC’s. Once authenticated the ticket is kept and sent with each request, opposed to NTLM whereby the ISA is responsible for authenticating users for every request sent against a single Domain Controller.

Regards

Marc Turner
Kent Community Network

Upcoming KCN works – 29/09/2008 & 30/09/2008

PeterBanbury — Wed, 24 Sep 2008 08:25:00 GMT

Essential works are required on KCN for the transition to the new KPSN network.

On Monday 29th September there is an at risk period whilst works are carried out on core KCN equipment. This work is not expected to cause an outage but the period between 16:00 and 19:00 should be considered at risk.

On Tuesday 30th September there will be an outage generated by the migration of the KCN core to KPSN. Works begin at 18:00 and will last for between 3 and 5 hours. These works will cause an outage for internal (inside KCN) users accessing core services, including KLZ, remote backup, Kent Parish Council websites, KentTrustWeb, the EIS website, any EISite2 and any resources hosted at KCN sites themselves. External (from outside KCN) access to these resources should not be affected, but should be considered at risk for the duration of the works.

Authenticating against a local directory service while using the KCN VPN

PeterBanbury — Tue, 29 Jul 2008 13:31:00 GMT

Following an update to the VPN concentrator, it is now possible for users to be authenticated against the directory service located within the school, opposed to the KCN RADIUS server.
All that's required is a RADIUS server is configured within the school according to criteria specified in the documentation available from the website (under the policies and technical information link)

www.eiskent.co.uk?broadband

Anyone wishing to implement local authentication should consider these points:

Should the server(s) configured as RADIUS servers fail, you will be unable to authenticate and therefore unable to establish a VPN connection to the school
This service is only available to those with servers running Microsoft Windows Server 2003 or 2008
The webVPN can only authenticate against a single RADIUS server (being the KCN RADIUS server) the webVPN will not be available to the school unless they use credentials configured on the KCN RADIUS server.
Schools wishing to use this service MUST conform to the KCN IP scheme assigned to the school

We hope you find this new feature useful

Marc Turner
Kent Community Network

KCN Support for BBC iPlayer Download

PeterBanbury — Tue, 24 Jun 2008 15:09:00 GMT

The BBC iPlayer service provides BBC programming on demand for 7 days on the BBC website. A download option is available which allows users to download content which will be available for 30 days via an application installed on the client PC.

The BBC iPlayer application utilises Peer to Peer Technology provided by Kontiki. Peer to peer technology (P2P) creates virtual “grids” which connect user’s machines together. Once a user on this “grid” has downloaded a file, any other user on the grid can access it.

The changes required to enable iPlayer download functionality on the KCN would also allow other peer to peer file sharing applications to run within the KCN.
Although the KCN recognises the additional educational benefits of being able to download content for 30 days opposed to 7, we also recognise the possibility of P2P services being misused. Internet safety is paramount within the KCN and therefore the download function of BBC Iplayer will not be accessible or supported.

To summarise

iPlayer uses P2P technology that could be misused
Player content CAN be accessed on demand from the BBC website for 7 days after the program is aired – this is supported
The download function of iPlayer will NOT function inside the KCN - this is not supported

We would be interested in your comments on this new policy, which we will review from time to time

Please accept our apologies if this causes any inconvenience, however the safety of young people in Kent and the security of the KCN must come first.

Regards

Marc Turner
Kent Community Network

Spare APC Racks - Free to a good home

PeterBanbury — Tue, 22 Apr 2008 11:02:00 GMT

After completing some work at our Canterbury Data centre we have 2x APC Netshelter racks spare (750mm wide 1020mm deep 42u high)

The racks have no side panels, but do have front and back doors + keys.

We are offering these for free to any KCN school that would like them, however this is on the condition that you can meet us at Canterbury University at 10am sharp on Thursday 24th with a vehicle big enough to carry them (a long wheel base transit van at the least) and only 1x Rack per school

If you would like to take us up on this offer, and can meet us at the specified time, please email marc.turner at kent.gov.uk to express your interest before 12pm on Wednesday 23rd.

If more than 2 schools show an interest, we will put the school names in a cup and choose 2 at random.

Regards

Marc Turner

Kent Community Network