cancel
Showing results for 
Search instead for 
Did you mean: 
David_B
Level 7
Report Inappropriate Content
Message 1 of 10

SSL bypass for Spotify

Jump to solution

Hello,

 

In our organisation we have the category Streaming media blocked for general users.

But we want to have an exception for a certain AD-group. So far all is ok, the rule looks like this:

 

 Authentication.UserGroupsat least one in list

AD-Groups: Allow Spotify

ANDURL.SmartMatch (Spotify URLs)equalstrue

 

So after that users of the AD-group can visit spotify.com or go into https://open.spotify.com etc, but as soon as they try to play any music, nothing happens.

I found out that if longer up among the rulesets, we have the part about SSL scanning and there is an exception list there for URL that should not use SSL scanning. I put in "spotify.com" in that list and then playback is fine, but then spotify works for everyone which should not be the case.

I then tried to copy that rule and modify it into my own and put it where the Spotify rule is to just disable SSL scanning for spotify allowed users but I cannot get it to work whatever I do.

Any tips on how I can make such rule that disables SSL scanning ONLY for Spotify and ONLY for a certain AD-group?

Or is there any other smarter way to get the playback on spotify working  for a certain group without tampering with SSL?

1 Solution

Accepted Solutions
AaronT
Level 9
Report Inappropriate Content
Message 9 of 10

Re: SSL bypass for Spotify

Jump to solution

Here is what I was thinking in my rule (untested).  In the SSL Scanner ruleset, add a rule under "SSL Scanner" to do the bypass based on AD group AND URLs.  You would do a stop rule set, which would not process anything else on the SSL scanner rules and jump to the next ruleset.  This works IF the user is already authenticated and you have their groups.

 

ssl scanner spotify.jpg

9 Replies
McAfee Employee vkleineh
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: SSL bypass for Spotify

Jump to solution

Hello David,

When you disable SSL scanning, the proxy will only see a connection to the URL host i.e. www.spotify.com. Not any specific URL that is requested by the client. I guess this is why it is then working for everyone. You can test to use Applicaton Control instead teh URL.Smart.Match (Check against a list of appliactions). If you want to bypass SSL Scanning depending on the usergroup, the authentication needs to happen before the SSL ruleset.

David_B
Level 7
Report Inappropriate Content
Message 3 of 10

Re: SSL bypass for Spotify

Jump to solution

I have of course authentication before SSL rules, but that does not matter, I cannot get it to work anyway.

I tried playing around with application control, but do not really understand how it should work with spotify.

 

I could of course learn by reading and reading and watching videos for hour or days, but I feel like the most quick way of learning is to get an example of how the rule(s) should look like if I would like to allow Spotify playback for a certain AD-group.

The rules we have setup in general is imported from the McAfee suggested template, so everything from Authentication to SSL scanning and regular rules for users and groups comes in the suggested order from McAfee.

Can you or anyone else give an example to how I should set this up?

Attached is how the ruleset order is.

AaronT
Level 9
Report Inappropriate Content
Message 4 of 10

Re: SSL bypass for Spotify

Jump to solution

Have you tried adding a condition to that specific Spotify rule for specific User groups?

It would be something like Authentication.UserGroups contains "SpotifyUsers"?  You could also do Authentication.UserName is in list "Spotify Users" (assumes you created a list for spotify users in MWG called "Spotify Users"?

If that condition on that specific rule doesn't work, you should be able to enable rule tracing to see why it doesn't match, which should help on the path to determine what needs to be added.

AaronT
Level 9
Report Inappropriate Content
Message 5 of 10

Re: SSL bypass for Spotify

Jump to solution
You could also try the same conditional rule in the SSL inspection (if usergroup = SpotifyUsers, and url.smartmatch(Spotify), then stop ruleset - if SSL bypass is only needed for the specific users.
David_B
Level 7
Report Inappropriate Content
Message 6 of 10

Re: SSL bypass for Spotify

Jump to solution

For your first reply, Yes, this is what I have done to unlock spotify site for agents in that group, but playback of music is not working.

 

For your second reply, I have no idea how to implement that in the current rule which is based on an event in the rule. Please see attached screenshot.

AaronT
Level 9
Report Inappropriate Content
Message 7 of 10

Re: SSL bypass for Spotify

Jump to solution

It's under rule Criteria. Click Add ->User/Group Criteria then Authentication.UserGroups. See attached

 

clipboard_image_0.png

AaronT
Level 9
Report Inappropriate Content
Message 8 of 10

Re: SSL bypass for Spotify

Jump to solution
As a reminder to everyone:
Rule Criteria are when to execute the rule (Always run the rule, or only in specific cases).
Action is what to do (block, stop ruleset, etc).
Event is any event you want to happen (set variables, log activity, etc)

You can have multiple items under Rule Criteria, Action and Events.
AaronT
Level 9
Report Inappropriate Content
Message 9 of 10

Re: SSL bypass for Spotify

Jump to solution

Here is what I was thinking in my rule (untested).  In the SSL Scanner ruleset, add a rule under "SSL Scanner" to do the bypass based on AD group AND URLs.  You would do a stop rule set, which would not process anything else on the SSL scanner rules and jump to the next ruleset.  This works IF the user is already authenticated and you have their groups.

 

ssl scanner spotify.jpg

Re: SSL bypass for Spotify

Jump to solution

Of course, I feel very stupid now. That is something I should have thought of myself, but I was snowed in on other ways to do it.

 

Thank you, that did it 🙂

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community