Tag Info

Hot answers tagged

34

What you have isn't really a technical problem, it's a management problem, don't try to make it a technical problem. You need to have an acceptable use policy that clearly defines what users can and can't do with the resources provided by your organisation. This should also detail what steps may be taken to enforce the AUP (monitoring usage/auditing machines ...


7

I think you need to ask Why you are trying to block Facebook? I'm assuming this is a corporate network not home. Why should you allow your staff to use myspace, twitter and amazon, friends-reunited etc but not Facebook? This sort of corporate content filtering (the organisation I work for does this as well) is almost always pointless. It tries to block ...


6

Looks exactly like a generic Bluecoat proxy message to me Bluecoat can use a number of filtering engines including their own, i-FILTER, InterSafe, IWF, Optenet, Proventia, SmartFilter, SurfControl, Websense, and Webwasher. Administrators can also define websites manually to be in a certain category. If you google "content_filter_denied", you will see that ...


5

open open powershell then do get-hotfix | findstr "981889" for remote get-hotfix -computername svrname | findstr "981889"


4

The harder you try to block it, the harder the users will try to get access to it.


3

I can't provide you with a "solution", but since you didn't mention it in your post, I thought I'd point this out: Your company (assuming it's in the United States) is filtering access to the Internet, probably in large part, because they want to show their "due diligence" in protecting against claims of a "hostile workplace environment" (see ...


3

First off... hang on. You say this is "recent" - all such systems take a while to bed in, and folk to get their usual sites correctly categorized. Give it a month. Secondly... cut the IT some slack. I work at SmoothWall, and the hardest web content filtering problems we hit when people use our filter is looking after technical staff. It is a tough thing to ...


3

Well, for starters (beyond what everyone else said about policy and governance), you should be blocking egress traffic on your network outside of what's required (and I generally don't allow client machines to make direct TCP/UDP connections anywhere; there's no need 99% of the time when you have a proxy server in-house), especially UDP/TCP 53 to outside DNS ...


3

What can I do? The old-fashioned means for enforcing similar "productivity policies" remains: get managers watching over employees' shoulders whenever a TPS report is late (or the wrong cover sheet is used).


3

The file versions listed are those included in the hotfix. If all the files are of the version listed or above, and the hotfix appears as installed in Add/Remove Programs (or Programs and Features for Vista and later) then the hotfix is installed. If the files are of the version listed or above, but the hotfix does not appear in Add/Remove Programs, then ...


3

Squid supports a feature called SslBump using Bump-Server-First. This basically means browsers will attempt to establish a secure connection between them and the host. The Squid cache gets the intercepted connection and Squid establishes the external connection. Then completes the secure connection to the user. Squid is essentially the certificate authority ...


2

The cause is usually HTTPS vs HTTP. The TOS/authentication pages are presented by having the router intercept all HTTP requests and reply with a redirect to the TOS/authentication page. However, HTTPS requests can not be intercepted in the same manner without causing a security warning on the user's PC. If you were to change https://www.facebook.com to ...


2

SCL thresholds do apply, actually. TechNet says: You can customize how the Content Filter agent assigns SCL values by configuring custom words. Custom words are individual words or phrases that the Content Filter agent uses to apply appropriate filter processing. You configure approved words or phrases with Allow phrases and unapproved words or ...


2

Rather than go through all the issues I have with the article you've referenced, I'll skip to the chase. Use procmail as the delivery agent. It's a very powerful language which allows you to do all sorts of things, not least copy emails to a mailbox and pipe them through scripts (including PHP - you just read from stdin, write to stdout). It's not hard to ...


2

You should setup your firewall to block ports 80 and 443 so he is forced to use your proxy to get to the internet


2

The Barracuda Web Filter is convenient for this. There are recent options to disable proxying applications and workarounds.


2

Currently version 1.4.2 (and probably upcoming 2.0.0) supports only "url black list". But the filtering engine itself does not check that the list indeed comes from urlblacklist.com, so it is possible to trick the engine into using another black list provider. The only requirement is that the unpacked blacklist was stored in ...


2

One of my Customers has a very similiar topology, albeit with a couple fewer sites on the MPLS. We looked at Websense, but in the end they opted for Barracuda filtering devices at each site. The cost was a little less for the Barracuda devices for their situation, and they liked the user interface a bit more. If you haven't looked at them, you may want to. ...


2

First off, do you have a policy, backed at a high level, that forbids Facebook? If not, then you may be treading on the toes of your boss, or their boss, who actually want to use Facebook. Many companies are happy to accept reasonable levels of social network use at work anyway, and view an all out block as counter productive. I'll assume there is a ...


2

I suppose the next step would be to look at Facebook's URL's, headers or data. Just make sure whatever filtering you use (Squid is an example) doesn't affect the `Like' button, since many popular sites implement that now. To be honest, there isn't really a way to stop a user if they have some form of tunnel or VPN running.


2

A very lightweight solution is to utilize the services of http://www.opendns.com If you want total control, and have a spare machine to use as a server, the combination of Squid and SquidGuard is a pretty versatile solution.


1

No, advisory filtering is not possible using DNS, at least not on its own. This is because by the time the DNS has been looked up and directed the user to your diversion page it's too late to allow the user to go to the original IP address. If a solution is to be had, it would need to rely on Squid knowing (on a per URL basis) whether the user has "opted ...


1

Some commercial web filters will let you do this - it is often referred to as "coach" or "soft block". One such filter is SmoothWall (Bias note: they are my employer!)


1

This may sound rude, but avoid Webmin. Only if you intend NOT to learn something, you should use Webmin. So all your requirements can easily be done with Squid User/pw authentication and white list: http://www.screaming-penguin.com/node/3871 Time-based access: http://www.linuxhomenetworking.com


1

You might want to have a chat with the individual/group responsible as there may be reasons why those are blocked. For example, you cited that you can't download Fx - that is blocked where I work as well due to the fact that the web-based software used in the company is only certified by the vendor for use in IE. Stupid? yup. Sucks? certainly. But that's ...


1

Websense is a good program ... I suspect the issues you are attributable to having related to how websense is configured rather than to problems with websense. More candidly .. if the current admins implemented something else (like Astaro), they would configure it with similar restrictions. One note .. you need to have clean hands. If your issues are ...


1

I've not used it, but take a look at http://www.delegate.org/delegate/mitm/ - this in conjunction with dansguardian may provide HTTPS filtering.


1

Dug Song's dsniff package has a mitm tool that should be able to do this. The code, while old, is in C and available from his site and the license is attribution-only.


1

It seems that some webservers still deliver javascript and css as octet-stream data instead of setting their correct mime-types. In this case, I wonder if the Blackboard VLE on that site has something to do with it? Or is it setting application\octet-stream for sending some SSL data prior to changing to a SSL connection to the web server? According to an ...


1

I've seen all sorts of web servers publish content with the MIME type of application\octet-stream. The most bizarre was the delete button in a web mail application. Have you heard back from any students as to what the side-effects have been? Or has nobody noticed? Are you concerned with bandwidth usage or is it more what they're doing with the content once ...



Only top voted, non community-wiki answers of a minimum length are eligible