Censornet help.

Just installed Censornet on an old box to play with but its driving me crazy! Internet will not work with its proxy.

 

Put 2 network cards in it as it said too (even though i only need 1 as its being a filtering proxy not a firewall)

 

Gave Private card 10.134.32.5 and the public one 10.134.32.6. Subnet 255.255.252.0 Put the upstream proxy in that i know works, put the countys DNS servers IP's in.

 

I can now connect to the web interface, i have imported my users from Active Directory, the status of all the services is OK. So why when i put the proxy as 10.134.32.5 port 8080 will nothing happen? Just page cannot be displayed?

 

Its driving me crazy

Have you added the MAC addresses of the PC(s) that you want to test with to the list of permitted computers?

 

If you don't set them up, you'll be able to get at the web interface, but web browsing will just sit there ignoring you. Lovely for kids who like to try plugging their own laptops into your network points, not much fun when you're testing it and forget to set up the MACs...

Nope, i did not do that, it works now.

 

Do not think i'm going to use this, its great apart from one thing. You have to login! It needs to be intergrated. Might have to wait for version 4.

I nearly didn't go with Censornet for exactly the same reason - I'm glad I stuck with it. It took the kids all of a week to get used to and the ban/unban and reporting features are a godsend... If you have the opportunity, I'd go with it and see what happens - you may be suprised how well people cope after the initial "Why does the internet want a password?" phase.

 

If it all goes horribly wrong you can always nobble it so it doesn't need any login at all, but you lose most of the usefulness of the reporting tools.

 

On my other site I'm running vanilla Squid, Dansguardian and an IdentD service on the Windows workstations to pass usernames to the proxy. This means usernames get into the logs automatically with no authorisation box but keeping up with bans/reports etc is a nightmare compared to the shiny Censornet interface - I'd much rather be running Censornet, waiting to get round to installing my new domain server first though.

My concern is kids typing in other kids usernames and passwords, as they like to share passwords (Stupid kids).

 

So that would mean, internet blocked, i'll use my mates logon. or lets logon as person X who i do not like and search for porn. If they are stupid enough to let others know there passwords then its there fault i know, but its not going to stop that problem.

It does limit concurrent connections - so people will find if they decide to 'borrow' their friends logon, their friend isn't amused when they find they can't get on the net because their banned friend is already using their password.

 

If you have a problem with kids using other kids passwords to logon, whatever system you use will still have problems - the passwords used for censornet are the same as the domain logon passwords, so if a student can log on as another student any software that grabs the username from a machine or authenticates with it automatically is still going to end up with the wrong user.

 

We quickly found that the level of logging provided meant it didn't take long for the kids to realise that we could tell who they were even if they used someone elses internet password - and crucify the both of them instead of just one of them

 

e.g. someone logs on at PC1 as John, connects to the net with the username Steve. Steve shows up in the logs on Censornet, but when you check the time and workstation IP against the domain server logs, you'll see John was logged on. Both of them lose their internet access for a week (assuming it was deliberate sharing).

 

Kids soon stopped sharing their passwords (and taking a lot more care not to let people see them!) after a month or so... :twisted:

The logon box is annoying but it means they dont forget that password as often as they have to type it in more . Another thing to watch out for is the DHCP server. Cant remember if they fixed it or not as Im running a slightly older version but even if you disable DHCP in the setup it still seems to be there to respond to clients but nack them. I found the ip in my workstation logs as it always found that DHCP server before the windows one

ISA Server 2004 + Smart Filter

All ya need

And its not that expensive. Setup the rule to allow net access out for only people with say "Web User" group.

Then get smart reporter (included) to weekly email you a report.

Also isa blocks file downloads too

Smart filter does not check the content though just URLs ?

I think isa does a better job. Like the firewall in control.

If you want a better firewall then a modded Smoothwall would be good. URL filtering is only as good as the list you feed it. Content filtering has the ability to filter alot more stuff simply because the page has to pass though it.

Blocking downloads is easy with these setups as well as you can block/allow any file/mime types you like.

But at the end of the day people use what they like and find to perform well. I just like solutions that are based around Dansguardian.

I'm currently using ISA Server. We have an RM Not So Smartcache too that the county gave us, used it for a very short while then stopped using it, its an awful peice of crap and went back to ISA Server. I'm sure our county is getting a backhander off RM since nobody in there right mind would buy one of these not so smartcache's and they put one in every school (along with recommending CC3 and the broadband coming via these idiots, but thats another story/thread)

 

This Censornet is 99.9% perfect, so when version 4 comes out i think i'll be changing to it. I'm just not happy over the whole asking for your login details again, it began to piss me off when i was just testing and playing with the box.

Im considering a few options here

 

ISA 2004, Censornet, Smoothwall or Dansguard.

 

All have their advantages

 

At the moment we rely on Salford for our proxy, but they cant get their filtering right, and it takes 24 hours before any block/unblock request is dealt with (they objected to blocking all but the www section of Google!)

 

Passwords shouldnt be a problem cos they already use a password now

 

At moment the plan is to go with ISA 2004, but gonna test the other methods as well.

ISA - noooooooooo! It does nothing of any use to us here. The blocking is shocking (and I'm a poet), you can't block by keyword, the application blocking doesn't appear to work... need I go on?

 

Censornet looked excellent when I saw it, Smoothwall was also a very nice piece of kit, and if I'd been in this school before they agreed to pay whatever extortionate amount it was for ISA, I'd have asked them to reconsider for something that would do the job, and better...

 

(nb: I may be biased as the setup here is probably nowhere near perfect, and I haven't the time to properly investigate it)

I'm having a rather different problem with censornet, it seems to be killing my network when switched on! Clients are unable to logon displaying domain unavailable, when I check there assigned IP address they apear to have a correct address but the DNS suffix instead of displaying the correct domain states "local". Have checked to make sure DHCP is disabled on the censornet box, as soon as i power the box down all is well, anyone any idea?

Just FYI, I'm using IPCop with the AdvProxy and URLFilter addons, with integrated Windows authentication and users don't get the popup logon box, yet all usernames are still logged :-)

Paul: I can't get to the censornet forum at the moment but I'm sure I read on there this morning about the dhcp daemon still running even when you have it set to disabled in the config.

 

There was a post about either a fix or a workaround.

 

Ben

I posted about this a few posts up. If you dont know how to disable it in the startup files just log on as root and

/etc/init.d/dhcp stop

To kill it permanently as posted by censornet support:

 

Log into the command line as root and perform the following commands :-

 

cd /etc/rc2.d

rm S20dhcp

 

Ben

I had a small glitch, which I think was Censornet related, my machines instead of showing 192.168.0.1 for the DNS server on my clients, they had my ISPs DNS listed, and the only external connection was into the Censornet box, rather strange, if you repair the connection it goes back to normal and works fine, worked right until Censornet appeared, but seems to have stopped now, so I will monitor it.

 

I take it that Censornet V4 is going to have integrated Windows / AD Authentication? Also, any timescale for it? I know the local primary has mentioned they are not too keen on logging on again (they wanted the XP machines to auto log on like they do on XP home now - YUCK!) but they have given over with that moan, but the Censornet is just pushing it a bit I think, but they are happy, they have saved over £250 on there previous solution (which stopped Sophos updating - yes, I have the joys of getting that to go through Censornet - any advice or is it simple??)

If you want transparent auth then you will have to go with a modded smoothie/IPCOP and find something to do the reporting options as well.

I wouldnt hold your breath for V4 as I suspect it will be the end of the year when they release it properly.

You can also turn of the authentication as well which maybe something that would be an option for a primary school maybe?

To build a squid/DG box which will use AD groups for access etc isnt too hard either. My Linux skills arent too hot but I managed it in about 2 days of learning from scratch. But ofc you then need to sort something out for blocking computers and reporting.

A smoothwall/IPCOP box with the advanced proxy and classroom extensions will give you all the stuff you desire currently apart from the reporting options.

Im sure someone can suggest something you can put on for that though.

If you do go with Censornet make sure you kill the DHCP server.

Looking at all these options in Censornet, am i right in thinking that you can have it so internet is off by default in a group of PC's , but still allow certain sites in at all times (such as office clip art, bytesize if i wanted)

You can apply a whitelist but you can only do it by user. So generally the best my groups get organized is by year so I have to whitelist the whole year. It's a feature they are going to introduce in V4 hopefully.

You can apply a whitelist but you can only do it by user. So generally the best my groups get organized is by year so I have to whitelist the whole year. It's a feature they are going to introduce in V4 hopefully.

 

Looks like i'm defo going to hold off for version 4 then. Version 4 should kick ass.

I am going to use it, and so long as V4 looks good upgrade PDQ!