SecureSchool, ISBossBox, LibraryDoor
First you must have the following setup and configured before you begin.
- Sign up for for a Google Apps for Education account (free) - http://www.google.com/enterprise/apps/education/
- Purchase at least one Chrome Management License ($30) - http://www.google.com/intl/en/chrome/education/devices/
- Must enable Proxy Authentication. (SSB, NT/2000, NTLM or LDAP)
- Disable firewall rule blocking proxy from the outside (if rule exists)
- Must have access to the proxy port (typically 8080) and port 81 from the outside. If SecureSchool is behind another firewall then the ports need to be forwarded.
- Must forward all DNS traffic to Secure School - http://kb.k12usa.com/Knowledgebase/Setting-up-DNS-Forwarders-in-Windows
- Contact K12USA so we can enable the wpad.dat file to be used from outside the local network and to supply you with the K12USA hostname for your SecureSchool appliance. (ex. secureschool.domain.nj.k12us.com)
Chrome Management Settings
8. Login to the Google Apps Admin Console, Select the Chrome Management
9. Then select Device Settings.
10. Change the following settings:
a.)Allow Guest Mode - Do not allow guest mode
Controls whether to allow guest browsing on managed Chrome devices or not. If you select Allow guest mode (the default), the main sign-in screen offers the option for a user to sign in as a guest. If you select Do not allow guest mode, a user must sign in using a Google Account or Google Apps account. When a user signs in using guest mode, your organization's policies are not applied and they will not use the proxy server.
b.) Restrict Sign-in - Restrict sign-in to list of users: - *@domain.com
Default - Keeping the default "Restrict sign-in to list of users:" will only allow users that have a valid account in the specified domain to sign-in to the chromebook. Then your organization's policies will be applied and they will use the proxy server.
11. When you are done click on the "Save Settings" button on the bottom of the screen and the the back arrow by the Chrome Logo in the top left corner.
12. Then select User Settings.
13. Change the following settings:
a.) Network - Proxy Settings - Always use proxy auto-config specified below
b.) Proxy Server Auto Configuration File URL - http://secureschool.domain.nj.k12us.com:81/wpad.dat
Specify the K12USA hostname for your SecureSchool appliance. Confirm that the name can resolve to the correct IP address when inside the network (internal IP address of SecureSchool) and outside the network (external IP Address of SecureSchool) on port 81. (important)
14. When you are done click on the "Save Settings" button on the bottom of the screen and then you can log out of the Google Apps Admin Console.
15. To confirm that the device is getting the latest policy or to reload the policy, on the device open the browser and goto: chrome://policy
16. To confirm that proxy setting are in effect, on the device open the browser and goto: chrome://net-internals/#proxy
17. Test - Open a website that should be blocked and you should see the "Access Denied" page for your school.