AllenS
asked on
Hotmail access via Proxy Server
I have recently begin to use Proxy Server 2.0. I have created a IE5 flat package to load on to my school systems. I wanted the browsers to point to the proxy server (used IEAK 5.0). After the installation of IE5, users are routed via the proxy to the internet, but now can not connect to certain sites (ie hotmail), page times out. What is so different between say hotmail and yahoo mail (the latter we get with no problems). I went through my set up of the package but can not see where I have enabled any restrictions. If I disable going through the proxy everything is fine. I am running PS 2.0 on an NT 4.0 (SP 4) server. I have installed the NT 4.0 Option Pack. I hope this makes sense, desperate for help. I also have an error msg in the event viewer that may or may not be linked to this. "W3SVC Event ID 100, The server was unable to logon the Windows NT account "Everyone' due to the following error. Logon failure unknown user name or bad password. The data is error code"
The only place I see 'Everyone' in the Proxy server is under the Anonymous logon in the WWW Service Properties.
I hope some one can make sense of this and help...
The only place I see 'Everyone' in the Proxy server is under the Anonymous logon in the WWW Service Properties.
I hope some one can make sense of this and help...
Housenet
-In the Proxy MMC, selecting the properties of web proxy & winsock proxy, is access control enabled under permissions ? If it is...assign a group for access rights. Otherwise uncheck it.
maybe ssl is what is common with the sites you are not able to access?
if you cannot browse any web sites beginning with https:// then you need to look at your 'secure' web proxy settings.
if you cannot browse any web sites beginning with https:// then you need to look at your 'secure' web proxy settings.
I am having the same problem with our MS Proxy server. I believe that the problem is not the proxy server, but something that Hotmail is doing in their redirect.
Here is a test for you.
Use a browser through your proxy server and go to www.msn.com. Click on the Hotmail button. It is a direct link to the login script. You should now be at the Hotmail start page.
The URL www.hotmail.com is a redirect and it is doing something funky that the proxy server cannot handle. I'm going to do a packet capture sometime this week to verify exactly what is happening.
A quick heads up for you as well. Students are remarkable clever. You can inadvertantly use Hotmail to mask your surfing to restricted site. Try sending yourself an email with a link to a restricted site say .... Playboy.com (usually not one of the education systems more favoured sites).
Hotmail opens the link for you and the traffic looks like its coming from the domain passport.com
You may not want to fix your problem after all.
Here is a test for you.
Use a browser through your proxy server and go to www.msn.com. Click on the Hotmail button. It is a direct link to the login script. You should now be at the Hotmail start page.
The URL www.hotmail.com is a redirect and it is doing something funky that the proxy server cannot handle. I'm going to do a packet capture sometime this week to verify exactly what is happening.
A quick heads up for you as well. Students are remarkable clever. You can inadvertantly use Hotmail to mask your surfing to restricted site. Try sending yourself an email with a link to a restricted site say .... Playboy.com (usually not one of the education systems more favoured sites).
Hotmail opens the link for you and the traffic looks like its coming from the domain passport.com
You may not want to fix your problem after all.
once again, i beleive that you will discover that hotmail is redirecting to an ssl encrypted site. check the urls after the redirect on a non-proxied browser.
cheers.
cheers.
You need to check port 443 is open on the Proxy server in order to let SSLs through.
If you've just setup Proxy server and blanked everything bar port 80, this will be your problem.
Yahoo mail doesn't use SSL (https:), so that's why you get in without problems...
meverest - you should know better !
If you've just setup Proxy server and blanked everything bar port 80, this will be your problem.
Yahoo mail doesn't use SSL (https:), so that's why you get in without problems...
meverest - you should know better !
I use hotmail from work through proxy2 with no problem using webproxy only, no WSP.
Got caught out though as I was using it like your students to access EE secretly but the logs show the real URL imbedded at the end of the enormous URL that hotmail generates if you use it as a public proxy.
Got caught out though as I was using it like your students to access EE secretly but the logs show the real URL imbedded at the end of the enormous URL that hotmail generates if you use it as a public proxy.
Not found a way to get round those logs yet then ?
:)
:)
ASKER
Yes, the site is responding the an https: address. This does not help me with what to do about it. I would like to allow users to get through to these sites.
Thanks
Thanks
My issue with Hotmail seems to be related to my firewall (Axent's Raptor) Your problem may not be at the proxy server level if your connection to the internet is through a firewall
Hotmail has moved their servers over to Microsoft-IIS/5.0. As near
as we can tell, the reason Hotmail no longer works is Hotmail is sending
the wrong syntax for a redirect.
Here is what we gathered from some network sniffs.
What Hotmail is sending:
HTTP/1.1 302 Redirected
Server: Microsoft-IIS/5.0
What a correct server sends:
HTTP/1.1 302 Found
Server: Apache/1.3.9 (Unix) PHP/3.0.12
The 302 is supposed to be found, not redirected.
In the meanwhile, you
can still access Hotmail if you go to the redirected URL of
http://lc3.law5.hotmail.passport.com/cgi-bin/login
I suggest maybe putting a hotlink to that URL on the students' homepage until Microsoft get's their act together.
Thanks, hope this helps everyone.
Hotmail has moved their servers over to Microsoft-IIS/5.0. As near
as we can tell, the reason Hotmail no longer works is Hotmail is sending
the wrong syntax for a redirect.
Here is what we gathered from some network sniffs.
What Hotmail is sending:
HTTP/1.1 302 Redirected
Server: Microsoft-IIS/5.0
What a correct server sends:
HTTP/1.1 302 Found
Server: Apache/1.3.9 (Unix) PHP/3.0.12
The 302 is supposed to be found, not redirected.
In the meanwhile, you
can still access Hotmail if you go to the redirected URL of
http://lc3.law5.hotmail.passport.com/cgi-bin/login
I suggest maybe putting a hotlink to that URL on the students' homepage until Microsoft get's their act together.
Thanks, hope this helps everyone.
jrowell, you're right, I can no longer access it via www.hotmail.com from behind MS proxy 2.
Got to it fine using www.netcraft.com's "what's the site running" then their go to site option.
Maybe "Certificate (common name) does not match URL" relates as well.
Got to it fine using www.netcraft.com's "what's the site running" then their go to site option.
Maybe "Certificate (common name) does not match URL" relates as well.
I think the problem is that the redirect page has a missing linefeed at
end of HTML. so the proxy rejects it as invalid. The webserver at
http://www.hotmail.com is not providing the terminating CR/LF.
The HTTP RFC specifies that both request and responses (e.g., GET /
HTTP/1.1 and 202 Yadayadayada) begin with the request/response header,
followed by a blank line (a CR/LF combination on a line by itself),
followed by optional body text. In both the request and response, the
blank line is *mandatory*. See RFC 2616 for details. Here is an excerpt
from section 6, which specifies the HTTP response format:
6 Response
After receiving and interpreting a request message,
a server responds with an HTTP response message.
Response = Status-Line ; Section 6.1
*(( general-header ; Section 4.5
| response-header ; Section 6.2
| entity-header ) CRLF) ; Section 7.1
CRLF <-- ***HIGHLY SIGNIFICANT***
[ message-body ] ; Section 7.2
6.1 Status-Line
The first line of a Response message is the Status-Line,
consisting of the protocol version followed by a numeric
status code and its associated textual phrase, with each
element separated by SP characters. No CR or LF is allowed
except in the final CRLF sequence.
Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF
The entire RFC is available at http://www.w3.org/Protocols/rfc2616/rfc2616.txt
This does not explain why browsers allow the response without a
CR/LF. Presumably, they get the connection termination (the web server
barfs its data up then closes the HTTP TCP session). They accept this as
an end-of-response even though it's not totally in spec. Hey, they're
there to facilitate, not secure, web browsing.
I realize this is getting beyond the scope of this question but the real issue here is Microsoft playing by their rules and ignoring the specifications. (Imagine that ever happening)
end of HTML. so the proxy rejects it as invalid. The webserver at
http://www.hotmail.com is not providing the terminating CR/LF.
The HTTP RFC specifies that both request and responses (e.g., GET /
HTTP/1.1 and 202 Yadayadayada) begin with the request/response header,
followed by a blank line (a CR/LF combination on a line by itself),
followed by optional body text. In both the request and response, the
blank line is *mandatory*. See RFC 2616 for details. Here is an excerpt
from section 6, which specifies the HTTP response format:
6 Response
After receiving and interpreting a request message,
a server responds with an HTTP response message.
Response = Status-Line ; Section 6.1
*(( general-header ; Section 4.5
| response-header ; Section 6.2
| entity-header ) CRLF) ; Section 7.1
CRLF <-- ***HIGHLY SIGNIFICANT***
[ message-body ] ; Section 7.2
6.1 Status-Line
The first line of a Response message is the Status-Line,
consisting of the protocol version followed by a numeric
status code and its associated textual phrase, with each
element separated by SP characters. No CR or LF is allowed
except in the final CRLF sequence.
Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF
The entire RFC is available at http://www.w3.org/Protocols/rfc2616/rfc2616.txt
This does not explain why browsers allow the response without a
CR/LF. Presumably, they get the connection termination (the web server
barfs its data up then closes the HTTP TCP session). They accept this as
an end-of-response even though it's not totally in spec. Hey, they're
there to facilitate, not secure, web browsing.
I realize this is getting beyond the scope of this question but the real issue here is Microsoft playing by their rules and ignoring the specifications. (Imagine that ever happening)
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I think the problem is that the redirect page has a missing linefeed at
end of HTML. so the proxy rejects it as invalid. The webserver at
http://www.hotmail.com is not providing the terminating CR/LF.
The HTTP RFC specifies that both request and responses (e.g., GET /
HTTP/1.1 and 202 Yadayadayada) begin with the request/response header,
followed by a blank line (a CR/LF combination on a line by itself),
followed by optional body text. In both the request and response, the
blank line is *mandatory*. See RFC 2616 for details. Here is an excerpt
from section 6, which specifies the HTTP response format:
6 Response
After receiving and interpreting a request message,
a server responds with an HTTP response message.
Response = Status-Line ; Section 6.1
*(( general-header ; Section 4.5
| response-header ; Section 6.2
| entity-header ) CRLF) ; Section 7.1
CRLF <-- ***HIGHLY SIGNIFICANT***
[ message-body ] ; Section 7.2
6.1 Status-Line
The first line of a Response message is the Status-Line,
consisting of the protocol version followed by a numeric
status code and its associated textual phrase, with each
element separated by SP characters. No CR or LF is allowed
except in the final CRLF sequence.
Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF
The entire RFC is available at http://www.w3.org/Protocols/rfc2616/rfc2616.txt
This does not explain why browsers allow the response without a
CR/LF. Presumably, they get the connection termination (the web server
barfs its data up then closes the HTTP TCP session). They accept this as
an end-of-response even though it's not totally in spec. Hey, they're
there to facilitate, not secure, web browsing.
I realize this is getting beyond the scope of this question but the real issue here is Microsoft playing by their rules and ignoring the specifications. (Imagine that ever happening)
end of HTML. so the proxy rejects it as invalid. The webserver at
http://www.hotmail.com is not providing the terminating CR/LF.
The HTTP RFC specifies that both request and responses (e.g., GET /
HTTP/1.1 and 202 Yadayadayada) begin with the request/response header,
followed by a blank line (a CR/LF combination on a line by itself),
followed by optional body text. In both the request and response, the
blank line is *mandatory*. See RFC 2616 for details. Here is an excerpt
from section 6, which specifies the HTTP response format:
6 Response
After receiving and interpreting a request message,
a server responds with an HTTP response message.
Response = Status-Line ; Section 6.1
*(( general-header ; Section 4.5
| response-header ; Section 6.2
| entity-header ) CRLF) ; Section 7.1
CRLF <-- ***HIGHLY SIGNIFICANT***
[ message-body ] ; Section 7.2
6.1 Status-Line
The first line of a Response message is the Status-Line,
consisting of the protocol version followed by a numeric
status code and its associated textual phrase, with each
element separated by SP characters. No CR or LF is allowed
except in the final CRLF sequence.
Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF
The entire RFC is available at http://www.w3.org/Protocols/rfc2616/rfc2616.txt
This does not explain why browsers allow the response without a
CR/LF. Presumably, they get the connection termination (the web server
barfs its data up then closes the HTTP TCP session). They accept this as
an end-of-response even though it's not totally in spec. Hey, they're
there to facilitate, not secure, web browsing.
I realize this is getting beyond the scope of this question but the real issue here is Microsoft playing by their rules and ignoring the specifications. (Imagine that ever happening)
It annoys compaq's tasksmart proxy box as well; "Http error 502, the server returned a mal-formed response" and uselessly "illegal gateway" or similar. but no doubt Microsoft will have the RFC re-written to cope with their bug on hotmail.
Thanks again jrowell, now up to AllenS to accept your comment as answer if it solved it for him. (once is enough though, use the "reload question" at the top of the page rather than the broser's back or refresh buttons to avoid multiple comments on EE.)
Thanks again jrowell, now up to AllenS to accept your comment as answer if it solved it for him. (once is enough though, use the "reload question" at the top of the page rather than the broser's back or refresh buttons to avoid multiple comments on EE.)