2

I run the IT Dept at a small high school with about 500 users on the network. We have been using SurfControl for this which has been handy because it backs into MS ActiveDirectory very well. We currently have it working on top of ISA. However, SC has now been end-of-lifed for some time and its Websense replacement is simply outside our budget.

I'm aware that there are things like Dan's Guardian amongst many others which allow content filtering over squid, but I'm not sure if any of them understand ActiveDirectory or AD's LDAP.

Has anyone had experience with this?

We use content filtering to block "obvious" categories that are unsuitable for minors and then block other categories during school hours to conserve our limited bandwidth. Blocking advertising is a great advantage of SC :-)

We require authentication and logging controls which worked seemlessly with the ISA proxy authentication.

I've installed a few linux desktops, but this is a little out of my depth. Where do I start?

Improve this question
1
  • We are an SC user, and were able to obtain a WebSense "upgrade" for essentially the same cost as the annual SC subscription renewal.
    – tomjedrz
    May 30, 2009 at 22:40

13 Answers 13

Reset to default
8

You might want to look into using Untangle (untangle.com). If you don't mind adding an additional server to your system. It doesn't integrate with ISA, but it does have content filtering and a “bridge” mode. I was using ISA with GFI WebMonitor, but switched to Untangle for budgetary reasons. I've been very happy with it, and it also has additional features as well. I know it has some AD integration capabilities, but I'm not sure if they are exactly what you are looking for.

Improve this answer
1
  • Looks like you beat me to it Corey. I'll give you the vote up on this.
    – Kevin Kuphal
    May 30, 2009 at 20:52
3

A quick and easy starting point would be OpenDNS http://www.opendns.com/ . It will not allow a per user policy on what to block and what not to block. But you could still use your ISA for managing Access to the internet based on Groups.

Squid will integrate into AD but thats only a startingpoint as it does not do contentfiltering out of the box

Improve this answer
2
  • Thanks. I've looked at OpenDNS but, as you say, it can't do per user filtering. The granular control from SC and its categorisation is very useful.
    – Philip
    May 30, 2009 at 20:08
  • i konw - but i guess that´s where those companies make their money. i could recommend eSafe esafe.com. They do everything you need but are commercial. Maybe they have education pricing?!
    – lepole
    May 30, 2009 at 20:34
2

You might consider a product like Untangle. In it's basic form it's the router for your network but it includes free add-on modules for web filtering and also a paid ActiveDirectory connector that has reasonable cost if you need the per-user filter.

Improve this answer
2

You can use Sun's proxy server which is free and has a nice installer for windows to track where people are going. It has the typical deny/allow pages but no listing of sites. Have it use the DNS servers from OpenDNS where you can setup that.

This way if someone tries to go to something they should not, the Sun Proxy will log the request and who did it (assuming you turn on the AD intergration) and the OpenDNS will block it. :)

Improve this answer
1

You may want to check out this how-to.

http://howtoforge.com/dansguardian-with-multi-group-filtering-and-squid-with-ntlm-auth-on-debian-etch

Improve this answer
0

OpenDNS is free and basic, Microsoft has also some free parental control and web content filtering but you need a free "microsoft live" account.

Improve this answer
0

For free... DansGuardian is your top choice. It is a bit of a "get what you pay for" job though - dg takes some installing, especially when you add AD into the mix but the issue with web filtering list maintenance. Keeping up with anonymisers, proxies, etc. is very tough when you're one IT dept. on your own.

I work for SmoothWall (bias alert!!) - http://www.smoothwall.net - we produce low cost content filters, and they're really not bad :) Websense is the "obvious" sucessor to surfie but is a bit pricy. There are other options, but i'd consider paying for your web content filtering (even if it is not a lot) and saving some cash elsewhere where there's no "daily work" like updates.

HTH

Tom

Improve this answer
0

opendns is probably one of the easiest. I am currently also using SQUID on 75 Windows machines and have been very happy with it. I have a custom DENIED page and can remotely disable it if a patron requests so. The blacklist lives locally and needs to be updated as opposed to opendns which does all of the work for you.

There are so many config options that I dont even know where to begin listing the features. Do Google search for 'squid proxy' for some great info.

Improve this answer
0

Be careful about you choose, some places such as the UK have some very strict policies about what maybe used in relation to filtering access to the internet.

Improve this answer
1
  • Care to elaborate?
    – Tom Newton
    Jun 10, 2009 at 9:49
0

You might consider FaceTime's Unified Security Gateway (USG) - a secure web gateway that does web filtering, prevents malware at the gateway, and controls real-time communications and Web 2.o apps like IM, P2P, VoIP, and social networking. When you buy USG before June 30, 2009 with anti-malware you get URL filtering for free. You can learn more at www.facetime.com/nofees.

Improve this answer
0

opendns.com its totally free and has special packages just for schools

Improve this answer
0

Squid+SquidGaurd is best option for web content filter.

simplewall uses squid+squidgaurd for content filter + IPS + much more in simplest way.

Improve this answer
-1

Squid with SquidGuard, runs on virtually any UNIX (Linux, BSD, etc.) and can be made to run on Windows, also supports authentication, yada yada.

Improve this answer
2

Not the answer you're looking for? Browse other questions tagged .