Enforce Google SafeSearch

[dhicks]

Perfect, does exactly what I want, saves me having to look stuff up in the SquidGuard manual!

 

...Drat, actually it seems to do exactly what I want recursively - any Google image search URL gets rewritten to include a safe=images on the end, then gets rewritten again and again and again until the server gives up and reports an error. Anyone know how to stop SquidGuard doing this?

 

--

David Hicks

[dhicks]

...Drat, actually it seems to do exactly what I want recursively

 

Okay, sorted - I just removed the "ir" at the end. I'm guessing "r" stands for "recursive"...

 

--

David Hicks

[Ryan]

Nicely self-troubleshot that man

[Petrucci914]

Sorry to wake up an old thread.

 

We want Safe Search enforced in our environment. We are on a 2003 AD Environment with no roaming profiles. We are also utilizing Websense for our web filtering. A few questions:

 

1. What are the steps to retrieve the cookie once you have enabled safe search?

2. Where do I have to place this cookie? Default User profile on a clean machine?

3. Can the appending be done with our Websense? Our network admin says no but I would have to think that it would be possible.

4. Can any of this be done with Group Policy?

 

Thanks!

[elsiegee40]

Sorry to wake up an old thread.

 

We want Safe Search enforced in our environment. We are on a 2003 AD Environment with no roaming profiles. We are also utilizing Websense for our web filtering. A few questions:

 

1. What are the steps to retrieve the cookie once you have enabled safe search?

2. Where do I have to place this cookie? Default User profile on a clean machine?

3. Can the appending be done with our Websense? Our network admin says no but I would have to think that it would be possible.

4. Can any of this be done with Group Policy?

 

Thanks!

 

When you say no roaming profiles... what do you use?

 

Mandatory?

 

Since this thread was created, we now lock strict safe search usuing a google account within the mandatory profile. It cannot then be changed.

[Petrucci914]

When you say no roaming profiles... what do you use?

 

Mandatory?

 

Since this thread was created, we now lock strict safe search usuing a google account within the mandatory profile. It cannot then be changed.

 

 

Just regular local profiles. Each time they log in they get their own local profile which is a copy of the Default User profile.

[_Adam_]

We are also utilizing Websense for our web filtering.

 

If you are running Websense click on Settings -> Filtering and put a tick in the "Enable search filtering" box. As it says on the page this enforces safe searching on Yahoo!, Lycos, Ask, Bing and Google.

[Petrucci914]

If you are running Websense click on Settings -> Filtering and put a tick in the "Enable search filtering" box. As it says on the page this enforces safe searching on Yahoo!, Lycos, Ask, Bing and Google.

 

I would think that we would already be doing that but I'll pass that information along and verify. Thanks!

 

So that just enforces the Safe Search variations of each of those sites? Is there any way to bypass that then?

[_Adam_]

Not that I have found, tried a few "tricks" but the results we're always strictly safe.

[tom_newton]

Generally, it is impossible (or very very difficult) to bypass these safesearch checks. I can think of a few ways you might trick the way we do it by obfuscating your URL so it doesn't get rewritten, but most of these tricks would get you blocked for being a tit in any case.

 

Some search engines (bing) I can give you more assurance - their images are all served from explicit.bing.com if thay are not safe, so that's nailed on. Some (eg youtube) are less difficult to bypass because of limitations at their end.

 

In general though it is not something I would worry about too much - hard to bypass, and the profit is generally low

[Petrucci914]

If you are running Websense click on Settings -> Filtering and put a tick in the "Enable search filtering" box. As it says on the page this enforces safe searching on Yahoo!, Lycos, Ask, Bing and Google.

 

Our network administrator just informed me that enable that only does 'Moderate Filtering,' it doesn't enable the strict safe search. Any other way to do this with Websense?

[Petrucci914]

So is there a way to enforce strict search with Websense then?

[tom_newton]

Can you get websense to do arbitrary URL manipulations? If so, you could do it that way.

 

Moderate *may* be enough for you, I am having difficulty remembering, given that it's sunday morning, and I have reluctantly crawled from my pit after a mate's 30th birthday, and reaffirmed that i can't do hangovers any more.... but i think the difference between strict and moderate isnt all that big. I'll ask around when I get into the office Tuesday, see if i can rustle up some more coherent advice

[_Adam_]

I am pretty sure it enforces strict, I will check next time I am at work.

 

Our previous content filter enforced moderate and this was fine, blocking anything dodgy.

[Petrucci914]

Thanks for checking on it, everyone.

 

Our network administrator says that it only enforces Moderate and that things still show up that the students shouldn't see. If strict could be enforced that'd be great, as the cookie method isn't very foolproof and what is preventing a student from searching on Bing or Yahoo?

[tom_newton]

Sorry, got hauled off to a meeting in sunny scunny - moderate and strict can both be enforced with the same method.. why is websense playing silly devils?

[Petrucci914]

Sorry, got hauled off to a meeting in sunny scunny - moderate and strict can both be enforced with the same method.. why is websense playing silly devils?

 

How does one choose strict over moderate then using that method? The Websense instructions seem to show just one options - on or off.

[_Adam_]

I have just checked at work, Websense forces the user to use strict for Google Images.

[link470]

I'm using the Barracuda Web Filter 310 here at the high school I'm at. Works great, has strict safe search as an on/off option out of the box and has always worked. I'd be surprised if Websense of all companies didn't have that built in. Is it something you can ask a Websense support representative about?

[tom_newton]

@link - yeah, it would seem pretty basic, as functionality goes, but websense is very "corporate" and may not be so geared to education. Sure they must have it though.

[Petrucci914]

Our network administrator said she opened a ticket with Websense and they said it would only do Moderate Safe Search, not Strict...........so I'm not sure.

[tom_newton]

Well, if you are looking for a filter that *can* - do feel free to drop me a line.

Only other choice is see if you can put your own URL mangling rules into websense - I don't know if you can.

[Shuriken1]

Right guys and girls, I might have an answer to this!

 

I've spent sooooo much time trying to work out how to do this with just an ISA server (2006) and I think I've finally cracked it - in a messy but seemingly effective kind of way.

 

I have set up a Firewall Policy in ISA 2006 denying HTTP and HTTPS from 'All Protected Networks' to a URL Set I've made called 'Banned Sites' and applied it to 'All Users'. I've put it higher in the firewall list than the main web rule, obviously so it kicks in before it.

 

In my 'Banned Sites' URL Set I have:

 

http://www.google.co.uk/preferences*

http://www.google.co.uk/setprefs*

http://images.google.co.uk/preferences*

http://images.google.co.uk/setprefs*

 

The preference ones stop them from clicking 'Search Settings' and changing the Safe Search settings from that page, the setprefs one stops them using the dropdown on the image search to do a kind of inline update of the filter setting. Now granted, there's probably a number more url's I'm going to need to include in that set, but it seems to work!

 

I've spent ages trying to get a solution for this and this seems as near as damn it, so I had to share it. I hope it's of some use to other people!

 

Shuriken1.

 

ps. I'm thinking that a quick insertion of the correct cookie into the student mandatory profile could also make it default to Strict rather than Modrate too but from what I've understood, Strict just enforces the filter on the web searches as well as the images whereas moderate just filters the images. We shall see.

Edited April 15, 2010 by Shuriken1

[_Adam_]

Our network administrator said she opened a ticket with Websense and they said it would only do Moderate Safe Search, not Strict...........so I'm not sure.

 

I have Websense v7, it enforces strict for the websites I previously stated. Not going to comment any further on this thread.

 

As for Shuriken1s tip, they can still manually modify the URL to change the results if they are smart. We use ISA 2006 and although there are solid preventative measures you can take with it, I could see them being bypassed by the more devious students.

[Shuriken1]

I have Websense v7, it enforces strict for the websites I previously stated. Not going to comment any further on this thread.

 

As for Shuriken1s tip, they can still manually modify the URL to change the results if they are smart. We use ISA 2006 and although there are solid preventative measures you can take with it, I could see them being bypassed by the more devious students.

 

Ah yeah, fair point. I've somehow managed to disable it though, even by editing the url it's defaulting back to Strict. Safe Search isn't locked either so I don't know how I've managed that but I agree, I would expect it to be editable via the URL. Forgot that.

 

Edit: Sorry, ignore that, Impero is enforcing the Safesearch. It would seem that Impero combined with my ISA rule will stop them changing it too, so may still be of some use to people.

 

Shuriken1.

Edited April 15, 2010 by Shuriken1