pfSense for school security

[andy2017]

I've just configured pfSense with all the filters (squid guard, light squid) with user log activities and I just need to configure one other thing, which i'm struggling with, I need to find a way to log users search engine queries. Does anyone know how to accomplish this?

[MS2011]

Dear Andy

 

Did you configured on a vm or physical machine? Single nic?

 

Did you follow any step by step doc?

 

Thanks

[andy2017]

Physical machine, actually the hardware is Sophos UTM 320 and I just installed pfSense instead of using Sophos. I went through pfSense forum and some youtube videos. i did configure pfSense many years ago but I just couldn't remember all the options.

[Blue_Cookeh]

Are you doing SSL man in the middle with Lightsquid? You'll need to since most search engines run over SSL now. I don't believe there are any packages to do this natively, but you can *very* easily pull such queries out of the logs of whatever filter you're using, since they usually get passed in the URL anyway. You could write a simple Python script to do that.

[andy2017]

Yes SSL is important or I wouldn't get the info i need. The certificates has been installed in my test lab, i was hoping for something easier like Sophos UTM/XG search engine logs. I guess python script maybe the only option for now.

 

Is this essential (the google search logs) for the new PREVENT law? If it's not I could probably not spend so much time dwelling into it.

[epoch_roots]

pfsense logs can be output via syslog which can then be ingested by Graylog / Splunk or similar for search/analysis. I've used pfsense extensively in the past but never for web monitoring (outside of snort), so YMMV.

[MatthewL]

You got any guides to configuring squid guard and light squid?

[andy2017]

Here's a nice guide https://www.youtube.com/watch?v=W2gy1bLHm5o

 

Also looks into e2guardian

[Wave9_Lee]

Hi Andy, out of curiosity, how many users/devices do you have?

[andy2017]

80 device about 250 users

[Wave9_Lee]

Thanks Andy - did you give up on Sophos because of price or other issues? Don't take this the wrong way, but including your time and effort as well as the fact you're re-using old kit and opensource software, wouldn't it possibly better value to go for a new platform? For that amount of users, you could get a fully featured new UTM including all your reporting requirements for between £800-1,200 / annum including unlimited helpdesk, advance replacement warranty etc.

 

As I said, don't take it the wrong way, I appreciate 'free' is good value, I'm just curious at the thinking behind the routes that are sometimes taken?

 

cheers

 

Lee

[andy2017]

We are using Sophos enterprise for the antivirus and web control (I got an excellent deal for sophos enterprise for 3 years), Netsupport DNA is used for the safeguarding and has other useful features like print monitoring, and finally we have pfsense for the firewall. Regarding Sophos UTM and Sophos XG I have setup and used both of them and they are very good and user friendly, however, initial costs can be very expensive so the setup we have it worked out cheap and does the job.

[Wave9_Lee]

Hi Andy, no worries, thanks for the info. Just fyi in future, when we provide our managed service with Sophos there are no/little upfront charges.

 

regards

[andy2017]

Thanks for that Wave9_Lee. Example to use Sophos XG 135 with our own hardware we still had to pay around £1700 to use their appliance, and for the bigger schools the price just went higher and higher. While Sophos is making the big money a lot of school are struggling with money to pay for these equipments and services, so I look for alternatives.