Roger Posted February 1, 2006 Posted February 1, 2006 I have had file downloads for students disabled via GP for some time now, as yuo would expect it has proven very effective in keeping the network free from `Junk` However I am having problems with website access to a number of sites that require valid use eg MFL dept: use Linguascope, when access is attempted to certain pages the file download disabled message appears, not sure what file (s) it is blocking? (logging on as a user without the policy in place does not give any clues) How are you people managing file downloads ?? Roger
Geoff Posted February 1, 2006 Posted February 1, 2006 On the proxy. Blacklisting the various mime types then whitelisting the sites staff/students need to use.
Roger Posted February 1, 2006 Author Posted February 1, 2006 Thanks Geoff, unfortunately we don`t have a proxy server here. Will make it part of the ICT development plan. Roger
Geoff Posted February 1, 2006 Posted February 1, 2006 Using Linux + Squid + Dansguardian if you need to write that down too. I'm unaware of any other proxy filtering software that can do mime filtering.
GrumbleDook Posted February 1, 2006 Posted February 1, 2006 I'll have to check ... but WebBlocker (as part of of the software on the WatchGuard Firebox) does MIME types ... and I am sure Web Marshall does too ... But they cost ...
Geoff Posted February 1, 2006 Posted February 1, 2006 All the school has to pay for was the hardware and the URLBlacklist.com subscription. http://urlblacklist.com/?sec=subscribe
ChrisH Posted February 1, 2006 Posted February 1, 2006 I thought you were running Censornet roger? Or am I mistaking you for another Lancaster school?
Norphy Posted February 1, 2006 Posted February 1, 2006 Using Linux + Squid + Dansguardian if you need to write that down too. I'm unaware of any other proxy filtering software that can do mime filtering. I'm pretty sure ISA Server can.
flyinghaggis Posted February 1, 2006 Posted February 1, 2006 We testing this on ISA 2004 just now. Seems to work really well. Lets you easily specify which users/groups can get access to which type's of file downloads.
mullet_man Posted February 2, 2006 Posted February 2, 2006 You could try adding this Linguascope in as a trusted site in GP, and allow file downloads for that trusted site. We are currently doing this for the DIDA site. We deny all file downloads from every site expect DIDA.
spc-rocket Posted February 2, 2006 Posted February 2, 2006 ISA Server 2004 does a good job when it comes to things like this. It allows you to define mime and content type and block these per group/per user/pernetwork basis if you want to. It does cost money but its worth it!. From the spec side it doesn't require too much 512mb ram would be enough and a 40Gb HDD would fine fine. However if you can afford a better spec than this, it always help. We have ISA Serve 2004 as the main firewall and its also got SurfControl webfilter for filtering out web content. It also allows for bandwidth management - added bonus. Works well. Ashok.
Norphy Posted February 2, 2006 Posted February 2, 2006 http://www.hglan.com/Norphy/isa.jpg ISA is a memory hungry sonofabitch. It'll take all you can throw at it. This is snapshot of the w3proxy service on our server. That server was our first with 2GB RAM :|
DMcCoy Posted February 2, 2006 Posted February 2, 2006 ISA is a memory hungry sonofabitch. It'll take all you can throw at it. This is snapshot of the w3proxy service on our server. That server was our first with 2GB RAM :| Isn't that the idea? I should think its caching as much as possible in memory to keep response times down.
Geoff Posted February 2, 2006 Posted February 2, 2006 True, Linux does the same: root@hydra:~# free total used free shared buffers cached Mem: 484364 440136 44228 0 34860 252392 -/+ buffers/cache: 152884 331480 Swap: 851404 12904 838500
spc-rocket Posted February 2, 2006 Posted February 2, 2006 Yeah it uses the memory for caching. Maybe you can limit the memory used to cache in the caching properties. I think you have specify this in terms of percentage of RAM. I don't know the exact details but its somewhere in the ISA 2004's cache settings. Also there are some tips to reduce the amount of memory used to log the request i.e. especially if you are using the MSDE logging. Have a check on isaserver.org for more info. BTW, SP2 is available now for ISA Server 2004. Ashok.
Roger Posted February 9, 2006 Author Posted February 9, 2006 You could try adding this Linguascope in as a trusted site in GP, and allow file downloads for that trusted site. We are currently doing this for the DIDA site. We deny all file downloads from every site expect DIDA. Started to work this route, we have DIDA also, hence original question. However I have hit a problem, having had file downloads (Pupil policy only) disabled for some time I changed the GP to enable downloads as a starting point but I cannot get file downloading enabled again !! Looked at the policy for ages, ran Gpupdate, Group Policy Modeling, All show downloads enabled, IE zones at default settings. Have tried copying profile from working user to default user profile on a test PC but has no effect. - having some senior moments here !! what am I missing ?? Roger
ChrisH Posted February 9, 2006 Posted February 9, 2006 Hve you done a proper gpupdate or secedit or whatever the one is you need to use with a 2000 box?
Roger Posted February 9, 2006 Author Posted February 9, 2006 Chris, server2003 here, believe I ran gpupdate correctly from client. However I believe updates occurr automatically every 90mins, started this on Monday, should have updated by now.
ChrisH Posted February 9, 2006 Posted February 9, 2006 Thinking about this there maybe multiple locations this can be stopped. I vaguely remember there were 2 settings about the specific stoppping of downloading and something to do with the menus or context menus or something stupid like that.
tarquel Posted February 9, 2006 Posted February 9, 2006 I'm interested in doing this also. Is there a way of telling the GP not to allow *.exe downloads but only allow *.jpg, *.zip, etc [for example]? ....or is this the realms of proxys only? Roger, I have them turned off for me but not for staff/pupils - tho i think I'm gonna have to play with the settings due to recent events here. Is there reason it still isnt applying is because you have made a custom IE install which has specifically said not to allow saving of downloads [or whatever the setting is]? I've done that before hehe I also do this with the Win98 PC's - but alas, its computer wide with those but its not like i have to use a 98 machine to do my work anymore *big thumbs up* Cheers Nath
Roger Posted February 9, 2006 Author Posted February 9, 2006 Geoff, GPMC lists all `File download` as Enabled, that`s what is confusing. Something else I have just noticed - on one of the sites that we need access to it is a *.pdf document that needs opening, if you click on the link you get the `Restrictions` error message, but if you type the full URL to the document in the browser it opens OK !
Roger Posted February 9, 2006 Author Posted February 9, 2006 Nath, not sure what you mean by custom install of IE these are XP clients with SP2. Configured to suit, then image created. Do you mean if you disable file downloads in IE security settings during configuring the image, you cannot change it via GP later?? Roger
Geoff Posted February 9, 2006 Posted February 9, 2006 Geoff, GPMC lists all `File download` as Enabled, that`s what is confusing. In the results or the modelling?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now