Installation Requirements - Revision history

Steve: /* Wifi */ Add information about enabling interim RADIUS updates on UniFi

2023-09-26T14:58:22Z

Wifi: Add information about enabling interim RADIUS updates on UniFi

← Older revision		Revision as of 15:58, 26 September 2023
Line 159:		Line 159:

	==Wifi==		==Wifi==
	If you have any wifi networks which use WPA2-Enterprise / 802.1x authentication, they must be added to the [[RADIUS: Clients\|RADIUS Clients]] page and configured to send RADIUS accounting data to the Opendium system.		If you have any wifi networks which use WPA2-Enterprise / 802.1x authentication, they must be added to the [[RADIUS: Clients\|RADIUS Clients]] page and configured to send RADIUS accounting data to the Opendium system. Ensure that your wifi system is configured to send interim accounting updates (e.g. on Ubiquiti UniFi this is done by logging onto the controller, going to Settings -> Profiles -> Select Accounting Server, clicking Edit and ticking "Enable interim updates".

	The Opendium system also provides a RADIUS authentication service, so it may be desirable to configure the wifi networks to use the Opendium system for authentication.		The Opendium system also provides a RADIUS authentication service, so it may be desirable to configure the wifi networks to use the Opendium system for authentication.

Steve: /* Time synchronisation */ Added instructions for setting up the DCs to use the Opendium system's NTP server

2023-06-26T08:58:31Z

Time synchronisation: Added instructions for setting up the DCs to use the Opendium system's NTP server

← Older revision		Revision as of 09:58, 26 June 2023
Line 92:		Line 92:
	==Time synchronisation==		==Time synchronisation==
	Many services require clocks to be properly synchronised. In particular, Kerberos single sign-on authentication if very sensitive to clock drift and will not work if clocks have drifted by more than 5 minutes. The Opendium system provides an NTP service and your domain controllers should all be configured to synchronise against the Opendium's NTP service.		Many services require clocks to be properly synchronised. In particular, Kerberos single sign-on authentication if very sensitive to clock drift and will not work if clocks have drifted by more than 5 minutes. The Opendium system provides an NTP service and your domain controllers should all be configured to synchronise against the Opendium's NTP service.

			This can be done using the following commands on all of the domain controllers:
			w32tm /config /update /manualpeerlist:opendium /syncfromflags:manual /reliable:yes
			w32tm /resync /rediscover

			You can then verify that the server is using NTP with:
			w32tm /query /source

	==Trust relationship==		==Trust relationship==
Line 107:		Line 114:
	{\| class="wikitable"		{\| class="wikitable"
	!Name		!Name
	\|WPAD		\|WPAD
	\|-		\|-
	!Data type		!Data type
	\|String		\|String
	\|-		\|-
	!Array		!Array
	\|Unticked		\|Unticked
	\|-		\|-
	!Code		!Code
Line 126:		Line 133:
	This is because whilst the Opendium system can filter web traffic which is not sent via its web proxy server, there are certain capabilities that can only be provided by the proxy. It is therefore always best to use the proxy server where possible. It is possible to manually configure devices to use the proxy, but that can cause a number of problems, especially in situations where devices may be moved onto other networks, such as laptops which may be taken home. We therefore recommend using automatic configuration, which requires this DHCP option.		This is because whilst the Opendium system can filter web traffic which is not sent via its web proxy server, there are certain capabilities that can only be provided by the proxy. It is therefore always best to use the proxy server where possible. It is possible to manually configure devices to use the proxy, but that can cause a number of problems, especially in situations where devices may be moved onto other networks, such as laptops which may be taken home. We therefore recommend using automatic configuration, which requires this DHCP option.

	== Inspection certificate ==		==Inspection certificate ==
	In order for the Opendium system to be able to decrypt HTTPS traffic, devices on your network must have the appropriate certificate installed.		In order for the Opendium system to be able to decrypt HTTPS traffic, devices on your network must have the appropriate certificate installed.

Line 135:		Line 142:
	This certificate is unique to your Opendium system, and is separate from any certificate that is required to connect to your wifi network.		This certificate is unique to your Opendium system, and is separate from any certificate that is required to connect to your wifi network.

	== Proxy ==		==Proxy ==
	We recommend using automatic proxy discovery. If the Opendium system is being installed into a Windows network, ensure that Group Policy configures no proxy servers, and has "Automatically discover proxy settings" ticked.		We recommend using automatic proxy discovery. If the Opendium system is being installed into a Windows network, ensure that Group Policy configures no proxy servers, and has "Automatically discover proxy settings" ticked.

Line 151:		Line 158:
	You '''must''' use the address shown above, rather than the proxy's IP address, otherwise Kerberos Single Sign-on authentication will not work.		You '''must''' use the address shown above, rather than the proxy's IP address, otherwise Kerberos Single Sign-on authentication will not work.

	== Wifi ==		==Wifi==
	If you have any wifi networks which use WPA2-Enterprise / 802.1x authentication, they must be added to the [[RADIUS: Clients\|RADIUS Clients]] page and configured to send RADIUS accounting data to the Opendium system.		If you have any wifi networks which use WPA2-Enterprise / 802.1x authentication, they must be added to the [[RADIUS: Clients\|RADIUS Clients]] page and configured to send RADIUS accounting data to the Opendium system.

Line 158:		Line 165:
	We recommend setting up a completely unfiltered wifi network, to be '''only''' used for temporary testing and device onboarding. Since such a network is a potential risk, ensure that the password is kept secure, and consider restricting it only to certain parts of the school, such as the ICT office.		We recommend setting up a completely unfiltered wifi network, to be '''only''' used for temporary testing and device onboarding. Since such a network is a potential risk, ensure that the password is kept secure, and consider restricting it only to certain parts of the school, such as the ICT office.

	== Data protection policy ==		==Data protection policy==
	Since the Opendium system automatically examines network traffic, including encrypted traffic, you should ensure the users all agree to a usage policy that indicates that their network traffic may be monitored. Under data protection law, there are a number of requirements that must be met, which are discussed in our [https://www.opendium.com/blogs/gdpr-online-safety-your-school-compliant blog article] on the subject.		Since the Opendium system automatically examines network traffic, including encrypted traffic, you should ensure the users all agree to a usage policy that indicates that their network traffic may be monitored. Under data protection law, there are a number of requirements that must be met, which are discussed in our [https://www.opendium.com/blogs/gdpr-online-safety-your-school-compliant blog article] on the subject.

Line 164:		Line 171:

	Some filtering suppliers put an onus on the school to ensure that the supplier's engineers are not given access to any personal data. With such a restriction, we do not believe that it would be possible to offer the level of support, and would inevitably lead to schools committing routine data protection breaches by giving access to the supplier's engineers. Instead, the contract between the school and Opendium includes a data processing agreement, and we are therefore considered data processors of the data which are collected by the Opendium system.		Some filtering suppliers put an onus on the school to ensure that the supplier's engineers are not given access to any personal data. With such a restriction, we do not believe that it would be possible to offer the level of support, and would inevitably lead to schools committing routine data protection breaches by giving access to the supplier's engineers. Instead, the contract between the school and Opendium includes a data processing agreement, and we are therefore considered data processors of the data which are collected by the Opendium system.


	[[Category:Product Manuals]]		[[Category:Product Manuals]]

Steve: /* User synchronisation */

2022-11-10T11:07:30Z

User synchronisation

← Older revision		Revision as of 12:07, 10 November 2022
Line 88:		Line 88:
	dnscmd /config /enableglobalqueryblocklist 0		dnscmd /config /enableglobalqueryblocklist 0

	Your internal DNS servers should be configured to always forward DNS requests to the Opendium system. On Windows systems, this can be done by adding forwarders into the DNS server properties in DNS Manager. Ensure the "Use root hints if no forwarders are available" check box is ~~<nowiki>~~'''not'''~~</nowiki>~~ ticked. This must be done on all of your internal DNS servers.		Your internal DNS servers should be configured to always forward DNS requests to the Opendium system. On Windows systems, this can be done by adding forwarders into the DNS server properties in DNS Manager. Ensure the "Use root hints if no forwarders are available" check box is '''not''' ticked. This must be done on all of your internal DNS servers.

	==Time synchronisation==		==Time synchronisation==

Steve at 11:23, 13 October 2022

2022-10-13T11:23:18Z

← Older revision		Revision as of 12:23, 13 October 2022
Line 131:		Line 131:
	For devices connected to your Windows domain, this should be done through Group Policy by downloading the certificate from the [[Web]] tab and importing it into the domain's Trusted Root Certification Authorities. Please see [[Microsoft Windows Configuration#Shared devices\|Microsoft Windows Configuration]].		For devices connected to your Windows domain, this should be done through Group Policy by downloading the certificate from the [[Web]] tab and importing it into the domain's Trusted Root Certification Authorities. Please see [[Microsoft Windows Configuration#Shared devices\|Microsoft Windows Configuration]].

	The certificate will need to be installed manually onto stand-alone devices. There are a number of ways to make this easier, such as using the QR code which is displayed on the [[Web]] tab, or using the [[Splash Page]].		The certificate will need to be installed manually onto stand-alone devices. There are a number of ways to make this easier, such as using the QR code which is displayed on the [[Web]] tab, or using the [[Web: Permissions & Limits#Display splash page for new devices\|Splash Page]].

	This certificate is unique to your Opendium system, and is separate from any certificate that is required to connect to your wifi network.		This certificate is unique to your Opendium system, and is separate from any certificate that is required to connect to your wifi network.

Steve at 10:47, 13 October 2022

2022-10-13T10:47:01Z

← Older revision		Revision as of 11:47, 13 October 2022
Line 129:		Line 129:
	In order for the Opendium system to be able to decrypt HTTPS traffic, devices on your network must have the appropriate certificate installed.		In order for the Opendium system to be able to decrypt HTTPS traffic, devices on your network must have the appropriate certificate installed.

	For devices connected to your Windows domain, this should be done through Group Policy by downloading the certificate from the [[Web]] tab and importing it into the domain's Trusted Root Certification Authorities.		For devices connected to your Windows domain, this should be done through Group Policy by downloading the certificate from the [[Web]] tab and importing it into the domain's Trusted Root Certification Authorities. Please see [[Microsoft Windows Configuration#Shared devices\|Microsoft Windows Configuration]].

	The certificate will need to be installed manually onto stand-alone devices. There are a number of ways to make this easier, such as using the QR code which is displayed on the [[Web]] tab, or using the [[Splash Page]].		The certificate will need to be installed manually onto stand-alone devices. There are a number of ways to make this easier, such as using the QR code which is displayed on the [[Web]] tab, or using the [[Splash Page]].

Steve at 10:41, 13 October 2022

2022-10-13T10:41:21Z

← Older revision		Revision as of 11:41, 13 October 2022
Line 152:		Line 152:

	== Wifi ==		== Wifi ==
	If you have any wifi networks which use WPA2-Enterprise / 802.1x authentication, they must be added to the [[RADIUS Clients]] page and configured to send RADIUS accounting data to the Opendium system.		If you have any wifi networks which use WPA2-Enterprise / 802.1x authentication, they must be added to the [[RADIUS: Clients\|RADIUS Clients]] page and configured to send RADIUS accounting data to the Opendium system.

	The Opendium system also provides a RADIUS authentication service, so it may be desirable to configure the wifi networks to use the Opendium system for authentication.		The Opendium system also provides a RADIUS authentication service, so it may be desirable to configure the wifi networks to use the Opendium system for authentication.

Steve: /* Proxy */

2022-10-13T09:18:38Z

Proxy

← Older revision		Revision as of 10:18, 13 October 2022
Line 136:		Line 136:

	== Proxy ==		== Proxy ==
	We recommend using automatic proxy discovery. If the Opendium system is being installed into a Windows network, ensure that no proxy ~~is configured through Group Policy~~, and ~~that clients are set to autodiscover the~~ proxy settings.		We recommend using automatic proxy discovery. If the Opendium system is being installed into a Windows network, ensure that Group Policy configures no proxy servers, and has "Automatically discover proxy settings" ticked.

	However, if it is necessary to manually configure the proxy, the settings used should be:		However, if it is necessary to manually configure the proxy, the settings used should be:

Steve: /* Data protection policy */

2022-10-11T08:50:00Z

Data protection policy

← Older revision		Revision as of 09:50, 11 October 2022
Line 160:		Line 160:
	== Data protection policy ==		== Data protection policy ==
	Since the Opendium system automatically examines network traffic, including encrypted traffic, you should ensure the users all agree to a usage policy that indicates that their network traffic may be monitored. Under data protection law, there are a number of requirements that must be met, which are discussed in our [https://www.opendium.com/blogs/gdpr-online-safety-your-school-compliant blog article] on the subject.		Since the Opendium system automatically examines network traffic, including encrypted traffic, you should ensure the users all agree to a usage policy that indicates that their network traffic may be monitored. Under data protection law, there are a number of requirements that must be met, which are discussed in our [https://www.opendium.com/blogs/gdpr-online-safety-your-school-compliant blog article] on the subject.

			You are the data controller for the data which are collected directly by the Opendium system. Reports of miscategorised websites are passed directly to Opendium staff and Opendium is considered the data controller of those reports. Data for which we are considered the data controller are governed by our [https://www.opendium.com/content/data-protection-policy Data Protection Policy].

			Some filtering suppliers put an onus on the school to ensure that the supplier's engineers are not given access to any personal data. With such a restriction, we do not believe that it would be possible to offer the level of support, and would inevitably lead to schools committing routine data protection breaches by giving access to the supplier's engineers. Instead, the contract between the school and Opendium includes a data processing agreement, and we are therefore considered data processors of the data which are collected by the Opendium system.


	[[Category:Product Manuals]]		[[Category:Product Manuals]]

Steve at 13:11, 10 October 2022

2022-10-10T13:11:03Z

← Older revision		Revision as of 14:11, 10 October 2022
Line 129:		Line 129:
	In order for the Opendium system to be able to decrypt HTTPS traffic, devices on your network must have the appropriate certificate installed.		In order for the Opendium system to be able to decrypt HTTPS traffic, devices on your network must have the appropriate certificate installed.

	For devices connected to your Windows domain, this should be done through Group Policy by downloading the certificate from the [[Web ~~Proxy~~]] ~~page~~ and importing it into the domain's Trusted Root Certification Authorities.		For devices connected to your Windows domain, this should be done through Group Policy by downloading the certificate from the [[Web]] tab and importing it into the domain's Trusted Root Certification Authorities.

	The certificate will need to be installed manually onto stand-alone devices. There are a number of ways to make this easier, such as using the QR code which is displayed on the [[Web ~~Proxy~~]] ~~page~~, or using the [[Splash Page]].		The certificate will need to be installed manually onto stand-alone devices. There are a number of ways to make this easier, such as using the QR code which is displayed on the [[Web]] tab, or using the [[Splash Page]].

	This certificate is unique to your Opendium system, and is separate from any certificate that is required to connect to your wifi network.		This certificate is unique to your Opendium system, and is separate from any certificate that is required to connect to your wifi network.

Steve at 10:10, 10 October 2022

2022-10-10T10:10:29Z

← Older revision		Revision as of 11:10, 10 October 2022
Line 7:		Line 7:

	For larger sites, we may recommend that the Opendium system is connected to the internal network using an LACP trunk, which utilises multiple network links for improved redundancy and speed.		For larger sites, we may recommend that the Opendium system is connected to the internal network using an LACP trunk, which utilises multiple network links for improved redundancy and speed.

			See the [[Network Topology]] knowledgebase article for more comprehensive information.

	==Internet connectivity==		==Internet connectivity==