Proxy with keyword blocking

[CAWJames]

Afternoon all,

 

Another thread on filtering...

 

Having sorted the YouTube restrictions with Google Suite, I am now wanting to implement some kind of keyword blocking.

 

I am looking at using a squid server as a proxy, but I am not sure how this works with HTTPS.

 

From my understanding Squid uses a man in the middle attack for inspection, which would usually need a cert installing on all clients, as the inspected site will effectively have the SSL trail of security broken. Is there anyway for squid to break open the SSL site, look for the keywords, block if needed, if not then allow access to the site without needing the cert installed on all the clients. As I am not sure how this kind of thing works with client we have no control over, ie wireless devices, guest devices etc?

 

Is this even possible?

 

Thanks

 

James

[ADMaster]

The short answer is no, that is not how ssl works.

We do ssl on our own devices, and do not on byod / guest devices.

 

There are some client side options you have that would not use ssl, but forcing a guest device to sign in with their school account is another matter.

 

Gat+ Shield can do keyword monitoring client side with an extension.

 

I think go guardian and securly could do this too, most chromebook specific filtering solutions will rely on an extension. There are several out there.

 

These solutions all rely on your users using the chrome browser, and signed into it with their gsuite account.

 

I know its not the answer you want, but I'd start with doing ssl on your own devices.

You could simply block youtube for guest devices if it becomes an issue. I'd think at the higher ed / college level there would not be as great of a need to filter.

[tom_newton]

A solid answer from @admadster there - without certs, or inspection "in browser" you won't be able to see anything in SSL. Also, once you broke it, that's done there's no way to "un-MITM" the stuff you don't want to block (otherwise people could snoop your stuff without you knowing).

[CAWJames]

Good points well made. It's all well and good protecting fixed domain controlled clients, it's all the lovely students personal devices hanging off our wifi! We are expecting OFSTED in weeks/months, and I won't be the weak link I think restrict.youtube.com on all wifi will be the way forward for the moment.

 

Thanks

 

James