Tag Info

Hot answers tagged

34

What you have isn't really a technical problem, it's a management problem, don't try to make it a technical problem. You need to have an acceptable use policy that clearly defines what users can and can't do with the resources provided by your organisation. This should also detail what steps may be taken to enforce the AUP (monitoring usage/auditing machines ...


7

I think you need to ask Why you are trying to block Facebook? I'm assuming this is a corporate network not home. Why should you allow your staff to use myspace, twitter and amazon, friends-reunited etc but not Facebook? This sort of corporate content filtering (the organisation I work for does this as well) is almost always pointless. It tries to block ...


6

open open powershell then do get-hotfix | findstr "981889" for remote get-hotfix -computername svrname | findstr "981889"


6

Looks exactly like a generic Bluecoat proxy message to me Bluecoat can use a number of filtering engines including their own, i-FILTER, InterSafe, IWF, Optenet, Proventia, SmartFilter, SurfControl, Websense, and Webwasher. Administrators can also define websites manually to be in a certain category. If you google "content_filter_denied", you will see that ...


4

The harder you try to block it, the harder the users will try to get access to it.


4

Squid supports a feature called SslBump using Bump-Server-First. This basically means browsers will attempt to establish a secure connection between them and the host. The Squid cache gets the intercepted connection and Squid establishes the external connection. Then completes the secure connection to the user. Squid is essentially the certificate authority ...


3

What can I do? The old-fashioned means for enforcing similar "productivity policies" remains: get managers watching over employees' shoulders whenever a TPS report is late (or the wrong cover sheet is used).


3

The file versions listed are those included in the hotfix. If all the files are of the version listed or above, and the hotfix appears as installed in Add/Remove Programs (or Programs and Features for Vista and later) then the hotfix is installed. If the files are of the version listed or above, but the hotfix does not appear in Add/Remove Programs, then ...


3

Well, for starters (beyond what everyone else said about policy and governance), you should be blocking egress traffic on your network outside of what's required (and I generally don't allow client machines to make direct TCP/UDP connections anywhere; there's no need 99% of the time when you have a proxy server in-house), especially UDP/TCP 53 to outside DNS ...


3

I can't provide you with a "solution", but since you didn't mention it in your post, I thought I'd point this out: Your company (assuming it's in the United States) is filtering access to the Internet, probably in large part, because they want to show their "due diligence" in protecting against claims of a "hostile workplace environment" (see ...


3

First off... hang on. You say this is "recent" - all such systems take a while to bed in, and folk to get their usual sites correctly categorized. Give it a month. Secondly... cut the IT some slack. I work at SmoothWall, and the hardest web content filtering problems we hit when people use our filter is looking after technical staff. It is a tough thing to ...


2

A very lightweight solution is to utilize the services of http://www.opendns.com If you want total control, and have a spare machine to use as a server, the combination of Squid and SquidGuard is a pretty versatile solution.


2

First off, do you have a policy, backed at a high level, that forbids Facebook? If not, then you may be treading on the toes of your boss, or their boss, who actually want to use Facebook. Many companies are happy to accept reasonable levels of social network use at work anyway, and view an all out block as counter productive. I'll assume there is a ...


2

One of my Customers has a very similiar topology, albeit with a couple fewer sites on the MPLS. We looked at Websense, but in the end they opted for Barracuda filtering devices at each site. The cost was a little less for the Barracuda devices for their situation, and they liked the user interface a bit more. If you haven't looked at them, you may want to. ...


2

I suppose the next step would be to look at Facebook's URL's, headers or data. Just make sure whatever filtering you use (Squid is an example) doesn't affect the `Like' button, since many popular sites implement that now. To be honest, there isn't really a way to stop a user if they have some form of tunnel or VPN running.


2

The Barracuda Web Filter is convenient for this. There are recent options to disable proxying applications and workarounds.


2

Currently version 1.4.2 (and probably upcoming 2.0.0) supports only "url black list". But the filtering engine itself does not check that the list indeed comes from urlblacklist.com, so it is possible to trick the engine into using another black list provider. The only requirement is that the unpacked blacklist was stored in ...


2

Rather than go through all the issues I have with the article you've referenced, I'll skip to the chase. Use procmail as the delivery agent. It's a very powerful language which allows you to do all sorts of things, not least copy emails to a mailbox and pipe them through scripts (including PHP - you just read from stdin, write to stdout). It's not hard to ...


2

You should setup your firewall to block ports 80 and 443 so he is forced to use your proxy to get to the internet


2

The cause is usually HTTPS vs HTTP. The TOS/authentication pages are presented by having the router intercept all HTTP requests and reply with a redirect to the TOS/authentication page. However, HTTPS requests can not be intercepted in the same manner without causing a security warning on the user's PC. If you were to change https://www.facebook.com to ...


2

SCL thresholds do apply, actually. TechNet says: You can customize how the Content Filter agent assigns SCL values by configuring custom words. Custom words are individual words or phrases that the Content Filter agent uses to apply appropriate filter processing. You configure approved words or phrases with Allow phrases and unapproved words or ...


2

It depends exactly on what you are using to blacklist the ADs of course. If you are using an external tool like squidguard, then it will be somewhat difficult. If you are doing everything with Squid ACLs, then it should be easy. It would look something like this. I am assuming your would have an acl named ads_bl that describes the ads to blacklist. # ...


1

The file versions correspond to the files the hotfix installs.


1

Squid and Dansguardian are a reasonable solution if I understand what you are looking for. Also check out: Censornet - http://www.censornet.com/ IPCop - http://www.ipcop.org/ Smoothwall - http://www.smoothwall.org/ SME Server - http://wiki.contribs.org/Main_Page


1

FWIW, my company doesn't require us to block any social networking sites, and we have zero problems with users spending too much time on them. I completely agree with the "treat them like adults" mindset.


1

Don't close it fully! Just make a "happy hour" when users can use any social network they want facebook, hi5 etc, so that they will know that f.example at 14.00 when they can make a cofee break, eat donuts and check what's going on and be social. and they will not think to break the system. Otherwise they will do it hidden and all day long... Dont forget ...


1

This may sound rude, but avoid Webmin. Only if you intend NOT to learn something, you should use Webmin. So all your requirements can easily be done with Squid User/pw authentication and white list: http://www.screaming-penguin.com/node/3871 Time-based access: http://www.linuxhomenetworking.com


1

Some commercial web filters will let you do this - it is often referred to as "coach" or "soft block". One such filter is SmoothWall (Bias note: they are my employer!)


1

No, advisory filtering is not possible using DNS, at least not on its own. This is because by the time the DNS has been looked up and directed the user to your diversion page it's too late to allow the user to go to the original IP address. If a solution is to be had, it would need to rely on Squid knowing (on a per URL basis) whether the user has "opted ...



Only top voted, non community-wiki answers of a minimum length are eligible