Installing WebMarshal

Before you install WebMarshal, please review the information in Planning your WebMarshal implementation. Determine the WebMarshal components that you want to install, and the computers where you plan to install each component. Collect the information required before you begin installation. Run the product installer to transfer the program files. Then use the WebMarshal Configuration Wizard to complete the product setup. (The Wizard runs on Array Manager or standalone installations only.) Finally, use the Console to customize your Web access policy. You can choose to install the WebMarshal Array Manager, Processing Server, and Console on different computers. The Console is usually installed on the WebMarshal Array Manager computer, and can also be installed elsewhere. If you are installing an Array with more than one Processing Server, you should install the Array Manager and complete the Configuration Wizard before installing additional Processing Servers. When you install a Processing Server you are prompted to connect to the Array Manager.

​

Setup Wizard

1. Run the WebMarshal installer from the Web download.
2. Carefully read the information given on the Welcome to the WebMarshal Setup Wizard page and the License Agreement page. When you click I Accept on the License Agreement page, you accept the terms of the License.
3. The installer checks for required prerequisite software that it can install. If any required prerequisites are not present, the installer offers to install them.
   You must install these prerequisites to continue with product installation.

   • Installation of .NET Framework may require system restart. As part of the .NET Framework installation you must accept a Microsoft license agreement.
   • Installation of the prerequisites does not normally interfere with any previously installed software.
4. On the Choose Destination Location page, choose the folder where the program files will be installed.
5. On the Select Components page, select the appropriate type of installation:
   1. If you are installing a single server complete installation, or an Array Manager with Processing Server: Select both Install Console and Install Services. On the Select Services page, select Standalone Server to install the Array Manager, Processing Server, and Console.
   2. If you are installing an Array Manager only: Select Install Services. On the Select Features page, select Array Manager Only to install the Array Manager.
      In most cases you should also select Install Console on the Array Manager computer. Installing the Console locally ensures that you will be able to manage WebMarshal. You can install the Array Manager without a Console for enhanced security (for instance, if the Array Manager is located in a DMZ). You must then install the Console in another location that can connect to the Array Manager.
   3. If you are installing a Processing Server only: Select Install Services. On the Select Services page, select Content Processing Node Only.
   4. If you are installing an additional Console, select Install Console and clear Install Services.
6. Click Next to continue.
7. If you are installing an Array Manager using the installer version that includes SQL Express, on the Select SQL Server page, you can select I want to install and use Microsoft SQL Express to start installation of SQL Express.
   If the installer identifies a usable installation of SQL Server or SQL Express on the server, this page does not display.
   1. Accept the Microsoft EULA.
   2. Click Install to install prerequisites. Click Next as required to continue with installation.
   3. If you choose to install SQL Express, you can accept all default values in the SQL Express installation wizard. For help with the fields and options on this wizard, click Help.
   4. Complete the SQL Express setup to continue with WebMarshal setup.
   To allow access to the database from other computers (for instance to allow the Marshal Reporting Console to connect from another server), this setup enables the Named Pipes and TCP/IP protocols. You can change these settings using the SQL Server Configuration Manager.
8. If you are installing a Processing Server, on the Array Manager Location page enter the name or IP address of the Array Manager. Enter the Port Number if you have changed this setting on the Array Manager (default: 19101). If you have restricted the accounts that can connect, select Connect using a specific account and enter account details.
   To set security at the Array Manager, see Configuring WebMarshal security.
9. On the Ready to Install the Program page, click Install to start installation.
10. If you are installing a Processing Server, the server will attempt to connect to the Array Manager using the details you entered. If the connection fails you can enter corrected details.
    If the connection continues to fail, you can still finish the product installation. After finishing installation, correct any problems preventing connection, and then run the WebMarshal Server Tool on the processing server to create the connection.
11. If you are installing a Processing Server or Complete installation, on the Anti-Malware Scanners page, you can choose to install or update one or more anti-malware scanners included in the installation package.
    • The list shows available scanners. Select a scanner to view details of the available version, installed version if any, and licensing status.
    • To install or update the selected scanner, click Install Anti-Malware Scanner.
    • At the end of installation of the selected scanner, you can choose to configure scanner updates. You can also configure updates later by running the scanner configuration tool, found in the WebMarshal program group on the Windows Start menu.
    • Once installation of the selected scanner is complete, control returns to the WebMarshal installer. You can choose to install another scanner, or click Next to finish WebMarshal installation.

    

    To complete integration of the scanner with WebMarshal, add it from the Configuration Wizard, or the Malware Scanners item in the WebMarshal Console.

    • WebMarshal checks the readiness of each scanner including initial download of updates. Configure and verify updates for each scanner before you add it in the Console.

​

WebMarshal Array Manager or complete installation

When the Setup Wizard Complete page displays, choose whether or not to launch the Console. You must run the Console and complete the Configuration Wizard to enter your license key and finish configuration.

​

WebMarshal Console installation (on a separate computer)

The first time you run the WebMarshal Console on a separate computer, you must specify the name of the WebMarshal server and a valid account to connect. You can browse the network to find the server.

​

WebMarshal Processing Server installation (on a separate computer)

When the installation is complete, the WebMarshal services start. The processing server connects to the Array Manager to update configuration settings.

​

WebMarshal Configuration Wizard

The first time you run the WebMarshal Console on a new installation, WebMarshal launches a wizard to gather configuration information needed to enable product functionality. For more information about the settings, refer to Chapter 9, Managing WebMarshal configuration. Complete the required information on each page of the wizard, and then click Next. Where possible, the wizard attempts to discover details automatically For more information about the fields on any window of the Wizard, click Help. The Wizard process includes the following steps:

​

Select configuration

This page of the Configuration Wizard offers three options for the initial configuration. Select an option using the radio buttons:

• Import the standard configuration: Select this option to import a default configuration. This configuration includes a suggested basic Access Policy and supporting URL Categories, TextCensor Scripts, WebMarshal Groups, Classifications, and other elements. After you complete the Wizard, you can customize the policy using the Console.
• Import a configuration backup: Select this option to import a complete configuration from a file. This option is useful for disaster recovery, or if you have obtained a custom “default configuration” from another source. Enter or browse to the name of the backup file you want to import.
  When you select this option and click Next, the remainder of the Wizard is not presented. To make any changes to imported configuration, use the main Console interface.
• Import an empty configuration: Select this option to import a configuration that contains no rules or elements. After you complete the Wizard, you can create your policy using the Console.

​

Registration and license

On this page of the Configuration Wizard, enter basic registration information:

1. Enter your company name.
2. WebMarshal generates a trial License Key automatically. If you have a full key, you can enter it.
3. Click Next.

​

Email notifications

On this page of the wizard, enter details that allow WebMarshal to send notifications about critical events and rule actions.

1. Enter the administrator’s SMTP email address in the first field. WebMarshal sends administrative notifications to this address. You can enter multiple addresses, separated by semi-colons. For example:
   postmaster@example.com;helpdesk@example.com
   
2. Use the From field to enter the email address that will be used as the sender address for messages.
3. Use the Server Name field to enter the IP address or name of an email server that will accept the email message for delivery to the administrator. This server must be accessible on the network from the WebMarshal Array Manager, and it must accept email from WebMarshal for delivery to the administrator’s address.
4. If the server listens for SMTP connections on a port other than port 25, enter the correct port number in the Server Port field.
5. Click Test Settings to send a test email notification.

​

System configuration

On this page of the configuration wizard, WebMarshal attempts to detect and configure environmental items that affect connectivity and authentication. If configuration cannot be completed automatically, WebMarshal presents a window that allows you to configure the values. The system configuration items are:

• Users
• Local Address Table
• Ports and Authentication
• Internet Connection

For details of these items, see the following sections.

​

Define users

On this window, you can set up directory connectors, import user groups, and create IP range groups. WebMarshal uses this information to control user browsing permissions. Automatic configuration attempts to create a directory connector and import a sample user group. The sample group is assigned standard browsing privileges based on the default WebMarshal rules. If no connector can be created, or if the connector needs login credentials, you can enter the required information. You can also add other connectors, or import additional groups. You can complete these tasks within the wizard, or in the User Groups section of the main Console. For a production installation, you should review the connectors and imported groups to ensure that all internal users will be able to browse through WebMarshal. For details of the fields on this window, see Help. For more information about Users and Groups, see User management.

​

Local Address Table

On this page, specify the range(s) of IPv4 and/or IPv6 addresses that are assigned to computers on your local network. By default, the LAT includes IPv4 address ranges that are always reserved for local use. Automatic detection adds entries based on the networking configuration of the server. If your local network uses different local IP addresses you can enter them. To enter a new LAT range:

1. Click New.
2. Enter a single IP address, a CIDR specification (such as the default IPv6 unique local address space fc00::/7) or starting and ending addresses of a range (such as 192.0.2.5-192.0.2.25).
3. Click OK.

To edit an existing entry, select it and then click Edit. To delete an existing entry, select it and then click Delete. Click Next to continue.

​

Proxy ports and authentication

On this page, select the server ports that WebMarshal will monitor, and the types of user authentication WebMarshal will accept on each port. WebMarshal checks the user account information for each request. WebMarshal supports authentication by integrated Windows authentication, Basic (clear text) authentication (including Novell NDS accounts), or computer IP address. Be sure to adjust all clients to send their requests to the IP address and port you have selected. For instance, if you have been using Squid, which listens on port 3128 by default, you can configure WebMarshal to accept requests on this port, or reconfigure clients to use the WebMarshal default port 8080.

1. If you want to edit an existing port assignment, select it and then click Edit.
2. If you want to add a new assignment, click Add.
3. Enter the required information and then click OK. See Help for details.

To configure import of user account information, see the Connectors item in the main WebMarshal Console menu tree.

​

Internet connection

On this page, select the method WebMarshal will use to request material from the Web. These settings define how all client browsing requests will be forwarded to external servers.

1. Choose the address resolution preference (IP protocol version to use when resolving outbound connections). This setting applies when WebMarshal resolves external websites or forward proxy names. IPv4 only is the default setting. For details of all options, see Help.
2. If WebMarshal can access the Web directly, choose the Request the page directly option. This is the default setting.
3. If WebMarshal will pass requests on to another proxy server then click the Forward option and enter the required information. For instance, if you want WebMarshal to pass requests to SquidNT running on the same computer, you can enter localhost as the computer name and 3128 as the proxy port (SquidNT listens on port 3128 by default).
4. Check the configuration of the other proxy server to ensure that it is using the port protocol version you have specified. If the other proxy server requires authentication, you can choose to enter a user name and password, and/or forward the client’s credentials. See Help for details.
5. You can choose to resolve names to IPv4 and/or IPv6 addresses. IPv4 is the default. See Help for details.

If your environment includes another proxy server, be sure to set up the other proxy software to accept requests only from WebMarshal. If you do not, then users may be able to bypass WebMarshal rules. You can configure the LAT settings on the other proxy server, or set the other proxy software to accept requests only from a specific Windows account, which is only used by WebMarshal.

​

System configuration summary

On this window you can review the system configuration settings that have been automatically detected or manually configured. Each section of the window summarizes the information entered on one of the previous windows of the Wizard. To see more details or edit the information, click Edit for the section. To continue with feature configuration, click Next.

​

Feature configuration

On this page of the configuration wizard, WebMarshal attempts to detect and configure items that enhance the filtering abilities of the product. If configuration cannot be completed automatically, WebMarshal presents a window that allows you to configure the values. The system configuration items are:

• URL Filtering Lists
• Malware Scanners
• Reporting Database
• Proxy Caching
• HTTPS Content Inspection
• TRACEnet
• Safe Search
• Google Web Risk
• Traffic Logging

For details of these items, see the following sections.

​

URL filtering lists

On this window, you can configure WebMarshal to use one or more externally maintained categorized lists of URLs. When a filtering list is configured here, you can use the categories that it provides in WebMarshal Rules and reporting. For details of the available lists, see Chapter 12, WebMarshal and filtering lists. The FileFilter list is enabled by default. If the installed Product Key supports the LevelBlue Web Filter Database, auto-detection enables this item.

​

Malware scanners

On this window, you can configure WebMarshal to use one or more third-party products to scan traffic for viruses or other malware activity. When a scanner is configured here, you can enable WebMarshal Rules to perform scanning. Auto-detection searches for and adds supported scanners that are installed on the server. For more information about supported scanners and other requirements, see Scanning overview.

​

Reporting database

On this window of the configuration wizard, you can configure logging of WebMarshal sessions and actions to a SQL database. Database logging is required if you want to report on WebMarshal activity using the Marshal Reporting Console application. Database logging is not enabled by default. You can enable logging on this window, or later using the Database Logging window in the Console Global Settings. To use database logging:

1. Select Enable Database Logging. The Create Database window opens.
2. On the Create Database window, enter the name of the SQL Server computer and instance in the SQL Server Name field. You can browse the network if necessary.
   If you installed SQL Express on the Array Manager from the WebMarshal installer with the default options, you can enter localhost\SQLEXPRESS. If you installed SQL Express on the Array Manager using the Marshal Reporting Console installer, you can enter localhost\MRC_SQLEXPRESS.
3. Enter the name of the new or existing database you want to use.
4. Enter a Windows or SQL user name with database creation privileges on the SQL server.
5. Enter the password for the user name.
6. You can connect to the database using TCP/IP by checking the box Connect using TCP/IP Protocol. You might need to use this option if the SQL Server connection is through a firewall.
7. If the database you selected already exists, you can choose to recreate it. Be sure that the existing database is not needed.
8. Click OK to create the database.

   

After you have created the database, you can configure a user with the minimum rights required by WebMarshal (known as the “operational user.” To start this process, click Change User. For details of this process, see Help for the Change Operational User window. You can also change the password associated with the database user on the server. To start this process, click Change Password. For details of this process, see Help.

​

Proxy caching

On this window, you can choose to enable or disable WebMarshal proxy caching. This feature is enabled by default. Caching retains local copies of items downloaded from the Web via HTTP or HTTPS, where appropriate. When WebMarshal later responds to a request for the same items, they are returned from the local copy, saving time and bandwidth. To enable caching, check the box. Then review the additional options. The default settings are reasonable for a trial installation. When setting up a production installation you should carefully consider the values. For more information about the options, see Configuring proxy caching. For information about the fields on this window, see Help.

​

HTTPS content inspection

This window allows you to perform basic setup required to use HTTPS Content Inspection in WebMarshal. You can generate a HTTPS Root Certificate and enable the HTTPS Content Inspection functionality. HTTPS Content Inspection allows WebMarshal to perform the full range of content filtering on HTTPS (secure) web requests. This feature is disabled by default. Before enabling HTTPS inspection in a production environment, you should review the legal implications of the feature, and notify users. For more information about the issues, see Configuring HTTPS content inspection. For information about the fields on this window, see Help.

​

TRACEnet

On this window, you can choose to enable or disable WebMarshal TRACEnet filtering. TRACEnet is a “zero day” protection framework supported by the LevelBlue Security Labs team. TRACEnet identifies malicious URLs and allows you to block access to these sites. The Security Labs team provides frequent updates to the listed URLs, based on data from a number of sources. This framework gives protection against “blended” threats and new risks. When TRACEnet is enabled, it receives updated URL information from LevelBlue. The TRACEnet digest collator reports summary data about blocked threats to LevelBlue over a secure Web connection. The Security Labs team uses the reported data as part of the threat identification process that feeds back in to TRACEnet updates. TRACEnet service is included for WebMarshal customers holding current maintenance contracts, as well as for product trials. The maintenance expiration for TRACEnet displays on the TRACEnet page. This information is provided by the TRACEnet update server.

​

Google Web Risk

On this window, you can choose to enable or disable WebMarshal Google Web Risk integration. Google Web Risk is a Google service that lets client applications check URLs against Google’s constantly updated lists of unsafe web resources. To enable Google Web Risk, you must enter a Google API key. For more information see LevelBlue Knowledge Base article Q21059. When Google Web Risk is enabled, WebMarshal retrieves URL listings from Google. WebMarshal validates individual URLs based on the locally cached information, or if necessary by an individual query to the Google servers.

​

Safe search

On this window, you can choose to enable or disable the Safe Search enforcement feature of WebMarshal. This feature is enabled by default. This feature allows you to enforce use of the “Strict Safe Search” function that some search engines provide. At this release, WebMarshal Safe Search supports Google, Yahoo!, and Bing safe search, as well as YouTube Safety Mode. When this feature is enabled, WebMarshal adds the “safe search” parameter to each request that a user makes to the supported search engines.

​

Traffic logging

On this window, you can configure logging of WebMarshal sessions and actions to text files in W3C or WELF format. You can use these logs to further analyze WebMarshal activity using external tools. Traffic logging is not enabled by default. You can enable logging later using the Global Settings section of the Console. To use text logging, select Enable Text Logging. For a production installation, you should review the file location and choose a retention policy. For details of the fields on this window, see Help.

​

Feature configuration summary

On this window you can review the system configuration settings that have been automatically detected or manually configured. Each section of the window summarizes the information entered on one of the previous windows of the Wizard. To see more details or edit the information, click Edit for the section. Click Finish to start WebMarshal services and run the WebMarshal Console.

​

Additional configuration steps

When installed, WebMarshal immediately begins accepting and filtering Web requests. The default and auto-detected settings are designed to ensure that users in a test environment will have basic browsing privileges. Before you put WebMarshal into production, you should complete some additional steps. Use the Console to complete these steps:

1. Verify user information: Since WebMarshal is an authenticating proxy server, each browser session must supply a logon credential before any browsing is permitted. Check the status of connectors, imported groups, and IP range groups. Adjust settings as required. See Users and groups.
2. Customize Rules: If you have chosen to use the WebMarshal default Rules, every authenticated user will have basic browsing privileges. To adjust permissions quickly, you can add Users to additional WebMarshal Groups. You can enable and edit Rules as required using the Console. See Chapter 6, Understanding web access policy, rule containers, and rules.
3. Configure Malware Protection (optional, but strongly recommended): If you plan to use Virus Scanners with WebMarshal, verify that the software is installed and initial signatures are downloaded, then enable Malware Scanning Rules. See Using malware scanning.
4. Configure Filtering Lists (optional): If you plan to use URL filtering lists with WebMarshal, you must enable them and ensure that the initial database downloads are complete before you enable them in any rules. See Configuring URL filtering lists.
5. Configure browser proxy settings to use WebMarshal: To use WebMarshal, in most cases web browsers must be configured with proxy settings. See Configuring web browsers.

​

Configuring web browsers

All web browsers within the organization should be configured to send web requests to the WebMarshal server on the appropriate port. By default, the port for proxy requests is port 8080. If browsers are already configured to send requests to another port (for example, if SquidNT has been listening on port 3128), you can configure WebMarshal to accept requests on the existing port assignment. For information on rolling the configuration out to a large number of workstations, please see LevelBlue Knowledge Base article Q10506. Web browser sessions are authenticated by WebMarshal. Authentication can use Microsoft accounts through Basic Authentication or Windows Integrated authentication, Novell NDS user information through Basic Authentication, or the IP address of the user’s workstation. If you are planning to use HTTPS Rules, you should ensure that the WebMarshal Root Certificate is installed for all browsers. See Generating and deploying a HTTPS root certificate.

​

Upgrading WebMarshal

You can upgrade to this version of WebMarshal from WebMarshal 7.5.0 or above. To upgrade, run the product installer on each computer where components are installed.

​

Uninstalling WebMarshal

1. Ensure that the WebMarshal Console is not running.
2. On the Array manager and any other Processing Servers in your WebMarshal Array, uninstall WebMarshal using Add/Remove Programs from the Windows control panel.
3. Uninstall any instances of the WebMarshal Console from other workstations.
4. If appropriate, drop the WebMarshal database from the SQL Server using the SQL administration tools.
5. If appropriate, remove other software that is no longer required from the Array Manager and any other Processing Servers in the array, using Add/Remove Programs from the Windows control panel. This could include integrated malware scanner software such as McAfee for Marshal. If you were using the LevelBlue Web Filter Database (or other filtering lists previously available), you should delete the list database, found in a subfolder of the WebMarshal installation folder.