Security Concepts in WinGate 2

WinGate 2.1 has been designed to provide a very high level of security, and to allow great flexibility of accounting for use of the Internet. There are a number of major concepts in the way that the security features of WinGate govern its actions. These center on the following security objects in WinGate 2:

Machines

A machine in WinGate is a record of a physical machine connected to WinGate. Machines are tracked according to their IP numbers, which are unique. Each machine has a confidence level associated with it, depending on how confident WinGate is about the identity of the user.

The three available confidence levels are:

Unknown WinGate has no prior information about the user

Assumed WinGate makes an assumption about who the user is, based upon the IP number of the machine connected or the network name of the computer (this is set up under ‘Locations’ in GateKeeper).

Authenticated WinGate knows who the user is, because that user has logged in with GateKeeper or the java login applet.

Note

In regard to WinGate, the terms ‘Logged in’ and ‘Authenticated’ are synonymous.

Users

A user is someone or something that is obtaining service from WinGate. To keep track of all the users in WinGate, there is a User Database, and the User Authentication Service (UAS - which is part of the remote control service) handles the authentication of users where required. User records in the database have a number of associated privileges and track data about the user’s use of WinGate.

Groups

An integral part of extending the user rules. Groups allow logical groupings of users into groups that share common features. Groups can have any number of members. Users can be in any number of groups. Groups can be nested, ie groups can be members of groups.

Policies

Policies can now be defined per service, per user, per group as well as per time of day, and can be restricted per request.

Services

Each service in WinGate has its own rule set. All services can use the global rule set. You can configure services to listen on a per-interface level for optimum security.