Censornet Case studies please

[Wizzer]

I'm trying to convince the SMT to give CensorNet a trial before our SurfControl license expires some time this year (not sure exactly when).

SurfControl is costing £££'s and doesn't do a great job anyway.

Those of you that are using CensorNet could you please answer the following for me to try to convince the powers that this is the way to go.

1. How long have used CensorNet?
2. Has it failed on you, if so how seriously and how frequently?
3. How many users are in your school/college?
4. What spec is the server you run it on?
5. Did you switch from another web filter? If so which one and how have you found CensorNet better?

I think that will do for now. I'm really banging my head against a wall on this one, any help would be really appreciated.

[OutToLunch]

Two sites, both residential so require extra care in evenings/weekends. Two installs of Censornet...

Site A -
1) Over 2 years now
2) Never
3) Approx 50 students - 20 PCs plus all staff/student laptops accessing the CN box which is connected to a 1 meg ADSL line.
4) (Don't laugh) Pentium 2, 266mhz, 20gb HD, 512mb RAM.
5) We were originally using client based filtering (Weblocker). Censornet is in a totally different league - no proxy but this gave students full access if they plugged their own equipment in, we had no control over who could/couldn't use the net, client side filter was easily disabled with the usual tricks. Censornet has been a godsend. We don't use the blacklist update service or image filter, just the basic install plus a few choice phrases.

Site B)
1) 1 month
2) Only because I forgot to apply the patches listed on the CN website after installing.
3) 100 students / 100 staff, about 60 PCs plus staff/student laptops accessing the CN box connected to 512k ADSL ( )
4) 1Ghz AMD, 512mb, 40gb HD. Feels nippy enough when accessed via the web interface.
5) Originally the client side filtering as detailed above, then switched to a vanilla Squid/Dansguardian setup which wasn't sat directly in front of the net. This led to similar problems of students plugging in their own laptops/picking up wireless where they shouldn't/doing the unplug the Cat5 when logging in to dodge picking up proxy settings... Censornet box is now sat between the net and everything else, happily blocking anything that isn't registered as usuable - after hours control much better, ICT staff can ban students from the net instead of waiting for me to hack the conf files for Dansguardian. Everyone happy Again, no blacklist or image filter.

I have also recommended it to and set it up at various other schools within our parent company. All staff it has been demonstrated to have been suitably impressed and pleased with the end result...

[paradox78]

1. How long have used CensorNet? ---------- 3
2. Has it failed on you, if so how seriously and how frequently?------once a month
3. How many users are in your school/college? ----800 200 concurrent
4. What spec is the server you run it on? p2 450 2 cpu 768 ram
5. Did you switch from another web filter? If so which one and how have you found CensorNet better? Used to have client based filters, censornet rulezzz..

[Wizzer]

OutToLunch, it's interesting you mention the residential aspect as we are a boarding school. We have 2 independant networks for residential rooms and teaching rooms which each have their own ADSL and SurfControl so we have to buy it twice!!

Seems like we might be able to save on hardware too. Surfcontrol requires AT LEAST 1GB RAM, our servers have 2GB and one has dual 3GHz processors!!
We could buy lower spec servers and use the beefy ones for something else such as Moodle & LAMS.

Thanks for your feedback, more appreciated.

[tom_newton]

At this point I might point out that we at SmoothWall have some case studies of people switching from Surfcontrol to our product - no-one has ever gone back, either.

I commend the idea of switching away from "Surfie" as it's known round here - it really is horrible. CN is OK, but I shouldn't bother with the image filter - i don't believe in those at the best of times!

If we can be of any help, feel free to give me a call.

Tom

[Geoff]

what's your opinion of Smartfilter tom?

[localzuk]

OutToLunch, it's interesting you mention the residential aspect as we are a boarding school. We have 2 independant networks for residential rooms and teaching rooms which each have their own ADSL and SurfControl so we have to buy it twice!!

Seems like we might be able to save on hardware too. Surfcontrol requires AT LEAST 1GB RAM, our servers have 2GB and one has dual 3GHz processors!!
We could buy lower spec servers and use the beefy ones for something else such as Moodle & LAMS.

Thanks for your feedback, more appreciated.

May I ask why you run 2 seperate networks rather than one network which is VLAN'd off so each half can't contact the other half?

[ChrisH]

I tried the image filter about 2 years ago and it wasnt very good but that was 2 years ago so hopefully it will be better now if not I just wont use it.
I have enjoyed the open source aspect of CN 3 although it wasnt as polished as other products its done the job and done it well.
I am currently testing CN 4 beta which you will have to pay for but the pricing structure seems very reasonable so I will make my final decision at a later date. I may have a trial of School Guardian in the meantime if possible.......

[Sylv3r]

1. How long have used CensorNet? 3 Years

2. Has it failed on you, if so how seriously and how frequently? Up to now fingers crossed it hasn't failed on us. We are still using the free version without any problems. We were on the beta tester list but we had problems getting our SATA drives to work, so we are waiting for a fix.

3. How many users are in your school/college? 1375 Students and 120 Staff

4. What spec is the server you run it on? Can't remember of the top of my head, It is only an old workstation that was lieing about so its nothing fantastic but does the job fine here. The more RAM you can put in it the better.

5. Did you switch from another web filter? If so which one and how have you found CensorNet better?

We used the LEA filtering that was in place, but as its not terrific we now run our Censornet box alongside it.

Andrew

[Wizzer]

[quote="localzuk
May I ask why you run 2 seperate networks rather than one network which is VLAN'd off so each half can't contact the other half?[/quote]

I'm not entirely certain. I inherited the way things are about 18 months ago. I think they are paranoid about security and don't really understand things.

[Geoff]

VLAN's are not a sensible security measure. You must air gap your network for the desired effect.

[tom_newton]

what's your opinion of Smartfilter tom?

Ooh do I not like Smartfilter

Nah it's not particularly smart, and its integration with squid is iffy at best.

[localzuk]

VLAN's are not a sensible security measure. You must air gap your network for the desired effect.

Tell that to Lancaster university which runs its residential network as a vlan of the overall network (with much other messing around too). To split it into 2 seperate networks just seems like creating work for yourself to me (although in this case it is inherited).

[Geoff]

Tell that to Lancaster university which runs its residential network as a vlan of the overall network

I can turn up with a Linux laptop and demonstrate if required.

Anyway, just google on 'VLAN Hopping' and 'Arp Poisoning'. Plenty of fun things to read/try.

Also, here's a Cisco document showing a couple of example situations where VLANs can fail.

http://www.cisco.com/univercd/cc/td/...8x/aleakyv.htm

[tom_newton]

Geoff is absolutely spot on - VLANs only ever intended as a management tool, its not security except in the face of an adversary with very limited privs on the host.