Unfilter <SITE> for <USERS> without staffproxy

[TBlax]

Hello all,

This may seem like I'm going 'full r3t4rd man.. never go full r3t4rd' < 1337 speak never gets old, but back to the topic. I've been asked if YouTube can be unblocked for specific staff members as well as for a specific PC. They're adamant that logging in with the staff proxy (SWGfL) isn't feasable and would like it to be automatic.

Can anybody shed some light if it'd be at all possible to unfilter YouTube without the need for authentication, but only for specific users? I know full well the whole point of the staff proxy and I'm not agreeing with what I'm asking here but I'm doing it out of curiousity, can't really be bothered with grumpy SMT this week!

Cheers.

[plexer]

Without some form of authentication to a service somewhere then no it's not possible.

It could be more seamless if you had on site filtering supporting ntlm/kerberos but doesn't sound like you do.

Ben

[TBlax]

Unfortunately on-site filtering won't happen here.. we're cheapskates ;D I already had the Staff Proxy setup anyway as I knew it'd most likely be the only method, but curiosity to ask never hurts!

Thanks for your quick reply Ben time to go and be the bearer of bad news to already-grumpy SMT. Highway To The Danger Zone?

[RTFM]

Unfortunately on-site filtering won't happen here.. we're cheapskates ;D I already had the Staff Proxy setup anyway as I knew it'd most likely be the only method, but curiosity to ask never hurts!

Thanks for your quick reply Ben time to go and be the bearer of bad news to already-grumpy SMT. Highway To The Danger Zone?

No point them being grumpy about this, tell them to put their hand in their pockets and get you the tools onsite to do the job they are asking you to do. If not its tough if something can't be done

[eddyc]

If you have an EES agreement you can use Forefront TMG as an internal proxy.
Allow YouTube at SWGFL for eveyone - then filter it for all bar certain users \ machines on the TMG box.
That's how we have it set up. The logs you can pull off from the TMG box per user \ site are really good for audit purposes too!

:-)

[RTFM]

If you have an EES agreement you can use Forefront TMG as an internal proxy.
Allow YouTube at SWGFL for eveyone - then filter it for all bar certain users \ machines on the TMG box.
That's how we have it set up. The logs you can pull off from the TMG box per user \ site are really good for audit purposes too!

:-)

Then why not go the extra step and get a clean feed from SWGFL and filter yourself entirely? Just curious your thoughts on it

Having never used Forefront TMG would you rely on that to do 100% of your filtering or is it not as advanced as a Smoothwall box, for example?

[Oaktech]

Then why not go the extra step and get a clean feed from SWGFL and filter yourself entirely? Just curious your thoughts on it


Having never used Forefront TMG would you rely on that to do 100% of your filtering or is it not as advanced as a Smoothwall box, for example?

because love or hate swgfl their education based block lists are worth their weight in gold... we only filter really tricky things on our isa/tmg boxes.

[RTFM]

because love or hate swgfl their education based block lists are worth their weight in gold... we only filter really tricky things on our isa/tmg boxes.

Fair enough, we arent an SWGFL school anyway but we stepped out of our LEA offering and went with BT

[TBlax]

If you have an EES agreement you can use Forefront TMG as an internal proxy.
Allow YouTube at SWGFL for eveyone - then filter it for all bar certain users \ machines on the TMG box.
That's how we have it set up. The logs you can pull off from the TMG box per user \ site are really good for audit purposes too!

:-)

I have no idea if we've got an EES Agreement or not, how does one obtain it? (Sorry for the silly question, 'PFY' here!) - Boss isn't in until Thursday so I'll ask him if we have one. I've heard of Forefront before but never realised it could be used as that, that's brilliant whether we could convince them to pay for the tools is another story. It's a pain in the arce really, they complain and demand to have things put in place - we give them a solution and unless it has the word 'FREE' stamped on it they won't bother. Vicious cycle!

As what @Oaktech said, @RTFM. SWGfL have a few uses. Albeit a few, but the filtering service does make life easier and credit due to them, they do have everything covered - one less thing to be responsible for!

[drdos256]

If you have an EES agreement you can use Forefront TMG as an internal proxy.
Allow YouTube at SWGFL for eveyone - then filter it for all bar certain users \ machines on the TMG box.
That's how we have it set up. The logs you can pull off from the TMG box per user \ site are really good for audit purposes too!

:-)

Hi,

We are looking to do the same (no staff proxy, configure youtube access though an ISA type box), I have youtube edu with ISA 2006 / header redirection working BUT enabling youtube via swgfl also enables the https connection to all of youtube, which I can't seem to block unless I enter an IP range ... which causes more problems as they are shared with Google.... Does TMG enable you to block https traffic to the https youtube url ? (without the need to install a firewall client?). How have you got this working for your school ?

Many thanks in advance for any tips ! (Before I commit to a Smoothwall demo!)

[Steve21]

Hi,

We are looking to do the same (no staff proxy, configure youtube access though an ISA type box), I have youtube edu with ISA 2006 / header redirection working BUT enabling youtube via swgfl also enables the https connection to all of youtube, which I can't seem to block unless I enter an IP range ... which causes more problems as they are shared with Google.... Does TMG enable you to block https traffic to the https youtube url ? (without the need to install a firewall client?). How have you got this working for your school ?

Many thanks in advance for any tips ! (Before I commit to a Smoothwall demo!)

We've been playing with YouTube Edu recently, and you can block HTTPS access via TMG while allowing http, however this will stop you logging into YouTubeEdu settings, so you can't allow teachers to request videos etc, but you can still do this via normal staffproxy etc for yourselves etc etc.

Steve

[TheScarfedOne]

Yes to the above. Im using the URL categorisation to allow and block categories of websites. You can also allow an "override" to staff users on some of the category rules in tmg. One small problem is that TMG is now an end of life project so unless you are already using it - I would suggest smoothwall, which I will also be moving to at some point in the future (when it can do the same sso that tmg can do with sharepoint, exchange etc all via one url... which is supposed to be coming soon).

[drdos256]

We've been playing with YouTube Edu recently, and you can block HTTPS access via TMG while allowing http, however this will stop you logging into YouTubeEdu settings, so you can't allow teachers to request videos etc, but you can still do this via normal staffproxy etc for yourselves etc etc.

Steve

Excellent - many thanks

[drdos256]

Yes to the above. Im using the URL categorisation to allow and block categories of websites. You can also allow an "override" to staff users on some of the category rules in tmg. One small problem is that TMG is now an end of life project so unless you are already using it - I would suggest smoothwall, which I will also be moving to at some point in the future (when it can do the same sso that tmg can do with sharepoint, exchange etc all via one url... which is supposed to be coming soon).

We have had the option to use TMG, but have not had the inclination to implement it..... until now ! Appreciate that it's "discontinued", but I need something before justifying the cost of purchasing Smoothwall in next years budget. Many thanks for the info, I will do a test install next week !

[TheScarfedOne]

no prob, if you need any help on the config, feel free to drop me a line