CYAN SECURE WEB HOWTO AUTHENTICATION PROFILES · their parents and with an number extension within each level. E.g. profile1.2 and profile1.1 are both children of profile1. Inheritance

CYAN SECURE WEB HOWTO

AUTHENTICATION PROFILES

Apr. 4, 2008

Applies to: SECURE WEB Version 1.4 and above

CYAN SECURE WEB HOWTO PROFILES

Authentication ProfilesThis document shows you an overview of the configuration and use of authentication profiles in CYAN Secure Web. For a complete authentication overview please read the “CYAN Secure Web Howto: Authentication”.

Contents 1 Overview

1.1 Profiles 1.2 Profile tree and inheritance 1.3 Soft Use Policy

2 How to configure profiles 2.1 Profile setup 2.2 Use the profile tree 2.3 Profile settings

2.3.1 Setup 2.3.2 Inheritance Path 2.3.3 Categories (CYAN Secure List) 2.3.4 User Defined categories 2.3.5 Applications 2.3.6 MIME types 2.3.7 File types 2.3.8 Cookies

3 How to assign profiles to users, groups and IP addresses

© 2008 CYAN Networks Software GmbH 1


1 Overview

1.1 Profiles in CYAN Secure WebProfiles are configured rule sets for the Internet access. These profile can be assigned to users, groups and IP addresses to define, what is allowed and what is not allowed for a person.

1.2 Profile tree and inheritanceThe profiles in CYAN Secure Web are sorted hierarchically in a tree form. This means, that apart from the root profile, each profile has a parent profile, from which it can derive a part of it's settings. This is called inheritance. The inheritance can be stopped for each setting in each profile.

Here is a sample profile tree:

This tree consists of 5 levels, starting from the root profile (named organisation) to the lowest ranked profile (profile2.2.1.1). To have a better overview, the profiles here have been named after their parents and with an number extension within each level. E.g. profile1.2 and profile1.1 are both children of profile1.

Inheritance means that the settings from the parent profile are used for the child profile too. For example: Let's assume profile2 is configured to block the category “News” and profile2.2, profile2.2.1 and profile2.2.1.1 have inheritance enabled for this setting. A user, group or IP address which is assigned to one of these profiles, can't access any URLs in the “News” category. If profile2's “News” category setting is changed to allow, all of the above users can now access “News” URLs without any change to their profiles.To continue this example, if profile2.2 denies the category “News”, but profile2.2.1 is set to allow, thus breaking the inheritance, all users assigned to profile2.2.1 and profile2.2.1.1 (child profile of profile2.2.1 and still on inheritance) are allowed to access “News” URLs.

The inheritance allows you to quickly define your company policy in the root profile. Then you only need to configure exceptions to the company policy for the child profiles, as needed. All untouched settings remain set to the company policy.



1.3 Soft Use Policy (SUP)If a user requests a blocked URL, CYAN Secure Web will show a html page explaining the reason why this page is not accessible. If the user needs to see this page, Soft Use Policy provides the users with the possibility to make the decision to view the URL. A link on the blocking page lets the user suspend the blocking of this page for a defined amount of time. (5 minutes by default)After this time has elapsed, the blocking page will be displayed again.An email alert can be configured to be sent, if a blocked URL has been viewed.

2 How to configure Profiles

2.1 Profile setupThis dialog is used to configure the basic profile settings.Change to Profiles / Setup:

Allow users without profiles: If this setting is turned off, only users, groups and IP addresses with assigned profiles are allowed to have access. If it is turned on, the default profile (see below) is assigned to users without an assigned profile. (Default on) Default Profile: Select the profile, that will be used if no profile assignment can be found for a user and "Allow users without profiles" is enabled. Allow Soft Use Policy: Enables Soft Use Policy globally. This can be defined more gradually within each profile, if you want only certain users to be allowed to use it. (Default on)

Soft Use Policy timeout: If a Soft Use Policy request was sent, the blocking will be suspended for the duration (in seconds) set here. (Default 5 minutes)

Enable Email Notification: If you enable this setting, each time a Soft Use Policy override has been initiated by a user, results in an email sent to the email address configured here.Mail server: Mail server which processes the email. It must understand SMTP. Port: The mail server's listening port for incoming SMTP requests.



From address: Email address used as originator.To address: Email address used as recipient. Subject: Subject of the Email. Message: Message body of the Email. Subject and message body can contain a few variables, which will be replaced during the message generation:%%URL%%: URL of the request%%USER%%: Name (or IP address) of the user initiating the Soft Use Policy%%INSTANCE%%: Authentication instance of above user.%%TYPE%%: Type of override (Host, Category, Application, etc.)%%ALLOW%%: Target of override (e.g. Application Images or Category Finance)%%DATE%%: Date and time of override%%DURATION%%: Duration of the override Use '\n' as line break in the request body.

Authentication type: Type of mail server authentication. Supported are SMTP AUTH PLAIN and SMTP AUTH LOGIN. User: Name of authentication user. Password: Password of authentication user

2.2 Use the profile treeThis dialog displays a tree view of all configured profiles.The profile organisation is the default top level profile and cannot be deleted (only renamed).The profile defaultrestrictive is a child profile from the root profile and has all URL blocking categories denied.

Click the “Add” button to create a new profile. Using the “Add” button of a particular profile will create a child profile to this profile. Click the “Edit” button to modify a particular profile. Click the “Delete” button to remove a particular profile.

2.3 Profile settingsIf you click on the “Add” or “Edit” button in the profile tree, you will see the configuration dialogs for a profile.Many settings here have a threestate box to configure their values, which include “enable”, “disable” or “inherit”. Inherit means, that the setting is derived from the setting of the parent profile.



2.3.1 Setup

If you add a profile, you will see this dialog:

An arbitrary name can be specified for the profile here. This name will be used to reference this profile in the "Profile Assignment" dialog and in the log files. The parent of a profile shows the position of the current profile in the hierarchy.

Note: Be aware that when changing the parent profile, the inheritance information for this profile and all its sub profiles changes too.

After clicking on save a new menu banner will appear with the name of your new profile: Profile / <Profile name> / Setup

Allow Soft Use Policy: Allows users assigned to this profile to use Soft Use Policy. However it must be globally enabled on the Profiles/Setup dialog.

2.3.2 Inheritance Path

Displays all the parent profiles of the current profile.

2.3.3 Categories (CYAN Secure List)

CYAN Secure List is a database of web sites, each classified in one of 26 categories. Each category can be allowed or denied for a profile. That means that all web sites within this category are allowed or denied for users assigned to this profile. CYAN Secure List is updated on a daily basis and downloaded automatically to your CYAN Secure Web installation.



Category filtering: choose Enabled or Disabled to specify if category checks are to be applied in this profile. Set to Inherited to derive the setting from the parent profile. The result (enabled or disabled) and the profile the settings are inherited from will be displayed. Each category can be allowed or denied by selecting the radio button in the corresponding column. If “inherit” is selected, the setting of the parent profile will apply (see the "Inherited" column for the current state of the parent profile and the "From" column to identify the profile which the setting was inherited from).

Note: To use CYAN Secure List, the "URL Filter" must be enabled under "Server / URL Filter / URL Database".

Block uncategorized URLs: Enable this setting, if you want to block all URLs, which do not have a category assigned by CYAN Secure List.

2.3.4 User Defined categories

You can assign URLs to user defined categories via the Server / URL Filter / Private List dialog.These categories can be allowed or denied like the categories from CYAN Secure List above.



2.3.5 Applications

CYAN Secure Web analyses requests in various ways in order to detect embedded protocols, types of data transported and other typical traffic characteristics. Theses pieces of information build then a signature of the application and indicate its purpose. CYAN Secure Web allows you to permit or decline the usage of these applications per profile.Enables filtering based on known application behavior.

The application blocking checks include: – Header checks– Content types – File name checks– Low level protocol parsing – File type recognition

Exception List: No application filtering will be applied to hosts in this list. A host entry must look like: “www.google.com”.


http://www.google.com/


Inherit exception list: If enabled, all entries in the parent exception list are added to the entries made here.

2.3.6 MIME types

MIME types filtering is based solely on the content type of the request.

MIME filtering: Enable or disable MIME type filtering for this profile.

Inherit lists: If enabled, all entries in the mime type and MIME type exception list of the parent profile are added to the entries made here. List of denied mime types: Enter all MIME types which should be filtered. Entries should look like for example "image/gif". For groups of MIME types enter something similar to "image/", which matches all common image types.To add a new rule for MIME types filtering, click on the “Add” button and enter a mime type. List of trusted hosts: no MIME type filtering will be applied to hosts in this list.

2.3.7 File types

File type filtering is based on the file type (extension) of the requested file.

File type filtering: Enable or disable file type filtering for this profile.

Inherit lists: if enabled, all entries in the parent file type (and exception) list are added to the entries made here.



List of denied file types: Enter all file extensions which should be blocked. Entries should look like "gif" (without the dot).To add a new rule for file type filtering, click on the add button and enter an extension. List of trusted hosts: No file type filtering will be applied to hosts in this list.

2.3.8 Cookies

Cookie filtering deletes the cookie headers from the client request and server response.

Allow session cookies: Allow cookies for session handling (PHP, ASP, Java) Inherit list: If enabled, all entries in the parent exception list are added to the entries made here. List of trusted hosts: No cookie filtering will be applied to hosts in this list.



3 How to assign profiles to users, groups and IP addressesAfter you configured profiles and authentication instances, you can assign profiles to users, groups and IP addresses here.

Search profile assignments: Select which entries you want to see in the list below. The entry must satisfy all selections to be displayed:

Selectable are: Type: Users, groups and/or IP addresses Instances: All configured instances are listed here. Profiles: All configured profiles and " no profile " (which means no assigned profile) Filter entries for: Enter a user/group/IP name (or a part of it) to list only matching entries.

After you click on search a list will be displayed, where you can modify the profile assignments: Find the user/group/IP you want to modify and change the column "profile" to your desired value. Select " no profile ", if you don't want to assign a profile to the entry.

Remember: always click on the update button after saving!


Documents

CYAN SECURE WEB HOWTO AUTHENTICATION PROFILES · their parents and with an number extension within each level. E.g. profile1.2 and profile1.1 are both children of profile1. Inheritance