GFI Software

Welcome to the GFI Software community forum! For support please open a ticket from https://support.gfi.com.

Home » GFI User Forums » Kerio Control » Https Site login without authentication with kerio control (access Https site without authentication )
Https Site login without authentication with kerio control [message #135854] Tue, 20 June 2017 13:36 Go to next message
MSH is currently offline  MSH
Messages: 19
Registered: August 2016
Location: IR
Hi

in my network users must be authenticated for accessing internet web sites but the problem is for http sites this is ok and users should enter their usernames and passwords to access these sites but for https there is a problem users can access these websites without any authentication I used many rules but nothing happened except completely blocked https(according to this forum)and test it with any version of Kerio Control but this problem dose not solved yet!
I want to know if this is a BUG for kerio or there is a way to solve this. it seems this problem will not solve with writing traffic rule because I tried many rules.

BR
Re: Https Site login without authentication with kerio control [message #135858 is a reply to message #135854] Tue, 20 June 2017 17:14 Go to previous messageGo to next message
merc
Messages: 6
Registered: January 2015
I have exactly the same problem.
This is a BUG kerio !!!
My personal opinion, Kerio does not do quality control before releasing their versions
Re: Https Site login without authentication with kerio control [message #135860 is a reply to message #135858] Tue, 20 June 2017 17:48 Go to previous messageGo to next message
Kerio/GFI Brian is currently offline  Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California
This topic has been discussed in other threads. Unfortunately the firewall is not able to redirect HTTPS connections to the authentication page. This is due to the fundamental security architecture of HTTPS. So, the default behavior allows those HTTPS connections.
Rather than allowing these connections, you can create a traffic rule that permits HTTPS traffic only for authenticated users. This way, users will not be able to reach secure sites unless they are first authenticated. However, the redirection still will not work if the user first attempts to reach a secure web site. In this case, they will see only a white page as if they were not connected to the Internet.

There are some exceptions or alternatives. For example, if you use HTTPS filtering, then users can be redirected even if they are going to a secure site. You can use WPA2-Enterprise if those users are connecting over WiFi. You can assign the MAC or IP address of the device to the user (in the user properties in "Addresses" tab).


Brian Carmichael
Instructional Content Architect
Re: Https Site login without authentication with kerio control [message #135862 is a reply to message #135860] Tue, 20 June 2017 19:18 Go to previous messageGo to next message
merc
Messages: 6
Registered: January 2015
HTTPS filtering, I would like, but it's impossible to recognize the certificates in Ipad, IPhone. (V 10.3.2)
Why HTTPS filtering cannot be used with Content Filter instead of IP addresses groups?
Re: Https Site login without authentication with kerio control [message #135865 is a reply to message #135862] Tue, 20 June 2017 19:58 Go to previous messageGo to next message
Kerio/GFI Brian is currently offline  Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California
WPA2-Enterprise is the best option if you are using WiFi. HTTPS filtering is not ideal regardless of the device as it requires the client to accept the certificate of Kerio Control. And as you noted, some devices may not allow or easily enable you to add the certificate.
Regarding your question, I don't quite understand what you're asking. You can add IP address groups in the Content Filter by adding the column (it is hidden by default).


Brian Carmichael
Instructional Content Architect
Re: Https Site login without authentication with kerio control [message #135867 is a reply to message #135854] Tue, 20 June 2017 20:32 Go to previous messageGo to next message
merc
Messages: 6
Registered: January 2015
Quote:
Regarding your question, I don't quite understand what you're asking. You can add IP address groups in the Content Filter by adding the column (it is hidden by default).


Hep, my English is not good,
I ask my question with example:
In HTTPS filtering option it's not possible to exclude specific traffic from decryption by choosing the Finance/Investment in the Application and Web Categories.
and,
With the IP addresses groups we must to know all ip and it's not possible to use * EX: *domain*
Re: Https Site login without authentication with kerio control [message #135868 is a reply to message #135867] Tue, 20 June 2017 20:46 Go to previous messageGo to next message
Kerio/GFI Brian is currently offline  Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California
The reason you cannot use content rules is because the firewall would need to first decrypt the traffic to determine the application category. Note however that in the HTTPS exclusions, you are allowed to use domain names. For example, the default exclusions apply to dropbox.com, microsoft.com, and mozilla.org.

Brian Carmichael
Instructional Content Architect
Re: Https Site login without authentication with kerio control [message #136125 is a reply to message #135868] Thu, 13 July 2017 15:36 Go to previous messageGo to next message
giampos is currently offline  giampos
Messages: 82
Registered: May 2005
./fa/4677/0/Both Http and Https are intercepted by the content rule, but Http are redirected and Https deny, why??
Re: Https Site login without authentication with kerio control [message #136138 is a reply to message #135854] Fri, 14 July 2017 05:42 Go to previous messageGo to next message
fco18us is currently offline  fco18us
Messages: 6
Registered: August 2016

THE SOLUTION FOR THIS IS SIMPLE IF YOU NEED ALL COMPUTERS LOGIN WITH HTTP OR HTTPS:

1) FIRST CHECK IN WEB AUTHENTICATION ALWAYS REQUIRE USERS TO BE AUTHENTICATED WHEN ACCESSING WEB PAGES

2) IN CONTENT FILTER SELECT HTTPS FILTERING AND CHECK DECRYPT AND FILTER HTTPS TRAFFIC AND CHECK SHOW LEGAL NOTICE TO USER, IN HTTPS FILTERING EXCEPTIONS CHECK EXCLUDE SPECIFIED TRAFFIC FROM DECRYPTION AN AFTER IN TRAFFIC TO/FROM IP ADRESSES WHICH BELONG TO: SELECT HTTPS EXPLUSION AN AFTER IN TRAFFIC FROM THE FOLLOWING USER: ADD ALL GROUPS ARE YOU CREATED ON FIREWALL,

THIS WORK FINE FOR ME, ANY COMPUTER IN MY NETWORK THAT NO HAVE USER AUTHENTICATTION NO CAN SURF IN HTTP OR HTTPS, THEIR NEED USER AND PASSWORD FOR GET ACCESS ON INTERNET, ATTACH AND IMAGE OF CONTENT FILTER IN HTTPS FILTERING.

SORRY FRIENDS MY ENGLISH IS BAD, REGARDS
Re: Https Site login without authentication with kerio control [message #136143 is a reply to message #136138] Fri, 14 July 2017 14:55 Go to previous messageGo to next message
giampos is currently offline  giampos
Messages: 82
Registered: May 2005
Ok but are they always redirected to login page automatically??
Also if the fist page is Https?
Second Question:
Enabling Https filtering all clients will be prompted onto certificate page error?




fco18us wrote on Fri, 14 July 2017 05:42
THE SOLUTION FOR THIS IS SIMPLE IF YOU NEED ALL COMPUTERS LOGIN WITH HTTP OR HTTPS:

1) FIRST CHECK IN WEB AUTHENTICATION ALWAYS REQUIRE USERS TO BE AUTHENTICATED WHEN ACCESSING WEB PAGES

2) IN CONTENT FILTER SELECT HTTPS FILTERING AND CHECK DECRYPT AND FILTER HTTPS TRAFFIC AND CHECK SHOW LEGAL NOTICE TO USER, IN HTTPS FILTERING EXCEPTIONS CHECK EXCLUDE SPECIFIED TRAFFIC FROM DECRYPTION AN AFTER IN TRAFFIC TO/FROM IP ADRESSES WHICH BELONG TO: SELECT HTTPS EXPLUSION AN AFTER IN TRAFFIC FROM THE FOLLOWING USER: ADD ALL GROUPS ARE YOU CREATED ON FIREWALL,

THIS WORK FINE FOR ME, ANY COMPUTER IN MY NETWORK THAT NO HAVE USER AUTHENTICATTION NO CAN SURF IN HTTP OR HTTPS, THEIR NEED USER AND PASSWORD FOR GET ACCESS ON INTERNET, ATTACH AND IMAGE OF CONTENT FILTER IN HTTPS FILTERING.

SORRY FRIENDS MY ENGLISH IS BAD, REGARDS

Re: Https Site login without authentication with kerio control [message #136178 is a reply to message #136143] Mon, 17 July 2017 22:35 Go to previous messageGo to next message
fco18us is currently offline  fco18us
Messages: 6
Registered: August 2016

Ok but are they always redirected to login page automatically??
Also if the fist page is Https?

R: no redirect when open a page in https, only work in http, if you need login users use the login page:

https://192.168.2.1:4081/login (example)

Enabling Https filtering all clients will be prompted onto certificate page error?
R: yes always prompted certificate error, but need logon in the login page for use http or https.
Re: Https Site login without authentication with kerio control [message #137104 is a reply to message #135860] Tue, 03 October 2017 07:04 Go to previous messageGo to next message
bthertz is currently offline  bthertz
Messages: 2
Registered: October 2017
Quote:
Rather than allowing these connections, you can create a traffic rule that permits HTTPS traffic only for authenticated users. This way, users will not be able to reach secure sites unless they are first authenticated.

Brian,

I have tried to create a rule to just this in Kerio Control v9.2.3 and it essentially stops all HTTPS traffic for all users even authenticated users. Where would this rule need to land in the hierarchy of the traffic rules. It would be nice if there could be a custome redirect like there is with the content filter however I am okay with a blank page.

The rule is setup as follows.

Source: Authenticated Users
Destination: Any
Service: HTTPS
IP Version: Any
Action: Allow
Translation: N/A
Valid Time: Any
Re: Https Site login without authentication with kerio control [message #137159 is a reply to message #135854] Thu, 05 October 2017 20:40 Go to previous messageGo to next message
Kerio/GFI Brian is currently offline  Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California
Your rule needs source NAT as the translation. This rule should be above any deny rules.

Brian Carmichael
Instructional Content Architect
Re: Https Site login without authentication with kerio control [message #137199 is a reply to message #137159] Sat, 07 October 2017 19:34 Go to previous messageGo to next message
bthertz is currently offline  bthertz
Messages: 2
Registered: October 2017
Brian,

Here is a pic of my rules as you can see they are the default ruleset with the addition of the single rule in position 3. With this setup I am able to login to my children's laptop and type in https :// www foxnews com, etc... and it goes right to the website.
Re: Https Site login without authentication with kerio control [message #137253 is a reply to message #137199] Tue, 10 October 2017 19:22 Go to previous message
Kerio/GFI Brian is currently offline  Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California
You are reaching that site via the 'Internet access' rule. You can check the Active Hosts area to see which rule is allowing access to a user.
This help topic may provide some guidance http://manuals.gfi.com/en/kerio/control/content/traffic-rule s/configuring-traffic-rules-1312.html#sect-usersinrules


Brian Carmichael
Instructional Content Architect
Previous Topic: How to setup Kerio Vpn.
Next Topic: Removing LAN Switch virtual interface
Goto Forum:
  


Current Time: Sat Jun 10 20:39:04 CEST 2023

Total time taken to generate the page: 0.03048 seconds