Automatic logout on Macintosh computers

Question

Hi there,
I have been asked to investigate how to automatically logout Macintosh computers from Bordermanager.
Currently, all of our copies of Firefox and Safari on those computers have a Bordermanager logout bookmark (pointing to proxy:1959/cmd/BM-Logout.htm). However frequently users fail to click this before leaving the computer, which means the next user can use up the previous user's entire data allocation.
My line of thinking is that the answer lies in Macintosh login/logout hooks, which are simply command line scripts that run on login and logout. So my theory is if we can load the Bordermanager logout page from the command line, then we should be able to force a disconnection from the server when a user logs in or out.
I was going to experiment with using 'wget' but I thought I had better run it past the Bordermanager community first to see if someone had done this before, and if so, how did they do it?
Thanks in advance,
Erik

Answer 1

In article <[email protected]>, Earok wrote:
> effectively a Macintosh equivalent of dwntrust.
>
I just realized something here, and thought it would be good to clarify
for anyone reading this. (Especially since I just had a call today on
this very subject).
Running dwntrust removes clntrust from the windows system tray/stops
running clntrust. This does NOT clear proxy authentication. Using the
url for the BMgr logout DOES clear proxy authentication.
Just because clntrust is running doesn't mean that the proxy isn't
still holding old proxy login information for your IP address.
The proxy uses proxy authentication to associate a browser's IP address
to an NDS user ID. In order to avoid authenticating a user for every
packet, the proxy must remember the association for some period of
time. In order to prevent associating the IP address to the same user
forever, there must be a mechanism to periodically clear the
association. So Novell engineered an idle timeout system. By default
(with clntrust - ssl login is configurable) the idle timeout is 3
minutes. After the idle time passed with the proxy seeing no
additional browse requests from the same IP address, it will clear the
authentication. Clntrust only ADDS the authentication, and dwntrust
does nothing about authentication - it just unloads clntrust.
There are 3 ways to clear proxy authentication:
1. Wait until the idle timeout expires
2. Use the clear authentication URL
3. Unload proxy.nlm
Just wanted to clarify there. I had a client of mine call me wondering
why her access rules weren't working. She changed a deny rule from Any
to just Students, and then she logged in as a student. She was still
allowed access. The reason was that the proxy was remembering her
previous login and still had her IP address associated to her
non-student user ID. So she had done everything right when changing
her access rule, but simply was not testing correctly. Had her very
confused for a bit.
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***