Smoothwall - Psiphon VPN

[stgoodyeara]

we have the app store dissabled on all our ipads, if you want an app i gets delivered via MDM or you do without.

 

we have 1:1 also

 

Im and IT support team of 1 (just me) support a secondary school of 780 pupils + 3 primary school sites with a further 600 pupils across them. Doing this will result in either:

 

1. Unmanagable workloads of app installation requests

2. Future rollouts of 1:1 devices students will bring their own rather than buying the school offered devices

 

Not an option in current climates

[stgoodyeara]

Regarding sanctioning 2/3 of the students, maybe arrange an amnesty: remove it from your device within a week and we'll say no more, anyone who doesn't gets sanctioned? (Clearly explaining that the amnesty is a one-off and anyone caught with a VPN in future will be punished).

 

Good idea...but ive already done this once, we had a similar things about 12 months ago with betternet a similar vpn app. Which prompted me to delete and re-write all my firewall rules. So other than the new intake into year 7 they have already had the offer of a "get out of jail free" card. So dont think its appropriate to do it again.

[DGardiner]

Im and IT support team of 1 (just me) support a secondary school of 780 pupils + 3 primary school sites with a further 600 pupils across them. Doing this will result in either:

 

1. Unmanagable workloads of app installation requests

2. Future rollouts of 1:1 devices students will bring their own rather than buying the school offered devices

 

Not an option in current climates

 

 

how so? most mdm's now offer a self service portal of managed apps. as for 2 we've avoided that

[stgoodyeara]

Although the MDM can't stop the installation of Psiphon, can you perhaps have the MDM automatically remove it if it is installed? (run this as a regular job and it's almost as good as preventing the installation in the first place).

 

Can you automate this process in lightspeed or are you simply refereing to forcing app management and removing it.... a manual process...and repeating it regularly.

[stgoodyeara]

how so? most mdm's now offer a self service portal of managed apps. as for 2 we've avoided that

 

Never considered the self service portal. I force app installations of apps that are chargeable in itunes and then leave them to get the rest of the free ones from the app store themselves. Definitely worth some consideration doesn't sound like much of a headache to manage.

[Opendium_Steve]

Good idea...but ive already done this once, we had a similar things about 12 months ago with betternet a similar vpn app. Which prompted me to delete and re-write all my firewall rules. So other than the new intake into year 7 they have already had the offer of a "get out of jail free" card. So dont think its appropriate to do it again.

 

I guess that's your answer then - they have already been warned and have ignored the warnings. I can understand not wanting to sanction the whole school, but if they are already on their second chance I don't see much option. A letter home to the parents maybe?

[Opendium_Steve]

Can you automate this process in lightspeed or are you simply refereing to forcing app management and removing it.... a manual process...and repeating it regularly.

 

I don't have a lot of experience with MDMs I'm afraid. I was assuming you could do an automated "remove this app from every device" job once a day or similar. If not, I'm outta ideas :-/

[stgoodyeara]

I guess that's your answer then - they have already been warned and have ignored the warnings. I can understand not wanting to sanction the whole school, but if they are already on their second chance I don't see much option. A letter home to the parents maybe?

 

Its in the hands of Pastoral/SMT. But i think the outcome has basically already been given. They view this as a technical issue and it should be resolved as one. I have explained the until smoothwall come up with a solution then it cant be. To which they say "smoothwall is alot of money, maybe we should find one that works." Even though i explained its an industry wide issue.

 

To a none technical person they can't understand how a webfilter can handle data and NOT be able to know what it is.

[DGardiner]

I don't have a lot of experience with MDMs I'm afraid. I was assuming you could do an automated "remove this app from every device" job once a day or similar. If not, I'm outta ideas :-/

 

Could always just use MDM to hide/disable the app completely

[stgoodyeara]

Could always just use MDM to hide/disable the app completely

 

i don't know how to do this in lightspeed.

[Opendium_Steve]

Its in the hands of Pastoral/SMT. But i think the outcome has basically already been given. They view this as a technical issue and it should be resolved as one. I have explained the until smoothwall come up with a solution then it cant be. To which they say "smoothwall is alot of money, maybe we should find one that works." Even though i explained its an industry wide issue.

 

Fair enough. But even if smoothwall come up with a solution for Psiphon, this will just rear its head again when the next VPN appears.

 

Harkens back to the days when I started in the educational filtering industry a couple of decades ago. Schools expected a technological solution to a social problem: if a child managed to get to any porn after intentionally searching for it, that was almost universally regarded as "the filter's fault" rather than the child doing anything wrong. Thankfully things have changed a lot now and schools recognise that a filter isn't going to be 100% accurate and you need the social stuff to go along with it (education, discipline, etc.)

[DGardiner]

i don't know how to do this in lightspeed.

 

go to the ou you want to restrict

 

policies > app permissions

 

press add, then search for the app on the app store, and flick the block app switch

Edited March 16, 2018 by DGardiner

[AlanD]

I, for one, don't really understand this VPN problem. I had to close/block all outgoing ports on smoothwall (not sure why the default position was open...). And so only traffic from our email or other specific devices is allowed out on any port - and usually only to a known destination. So if smoothwall is decrypting https traffic ...well it can't be doing a very good job of that if traffic is still being let through...and if it doesn't understand it - why isn't the default state to block it? Or is traffic getting through the ports I blocked?

[Opendium_Steve]

So if smoothwall is decrypting https traffic ...well it can't be doing a very good job of that if traffic is still being let through...and if it doesn't understand it - why isn't the default state to block it? Or is traffic getting through the ports I blocked?

 

Firstly, your filter won't be decrypting *all* HTTPS traffic - quite a few applications use pinned certificates, which means they will break if you decrypt their traffic (can your school live without working Adobe updates, Skype, Whatsapp, many ChromeOS features, Facebook and Twitter apps, etc? All of these things are incompatible with HTTPS decryption). Similarly, you probably don't want it to decrypt banking sites for obvious reasons. So filters generally have a list of websites that they don't decrypt, and if the VPN can convince your filter that it is connecting to one of those websites then it won't be decrypted. Hotspot Shield is a good example here - it replays recorded HTTPS handshakes for legitimate connections, so it's very hard for a filter to know the difference between a replayed recording (i.e. the VPN) and the real thing (legitimate traffic). I wrote a blog article explaining in detail how Hotspot Shield gets through filters last year - it really is quite clever, and the authors probably deserve some respect for their ingenuity even if they are making our lives hard.

 

Psiphon is a bit simpler, but doesn't mind decryption at all. It spoofs domain names so it isn't trivial to just tell your filter "block this domain", and does fairly normal looking web transactions with the servers. Unfortunately the "normal looking" web transactions contain an encrypted payload containing the VPN data. Your filter has to be able to figure out if that payload is VPN data or something legitimate.

 

You're suggesting that a filter needs to be able to identify traffic from every single legitimate application that could be used and block anything it doesn't understand. That's pretty impractical - you're talking about it understanding the traffic associated with several million different applications, including every legitimate webapp your users may ever want to use. And that's before you have to deal with all the legitimate applications that encrypt their traffic and look identical to a VPN that's encrypting its traffic. Even if a filter did manage to do that, it would break an application every time the application vendor changes the way the app works. In short - almost nothing on your network would work and your users would be screaming at you to fix it... and you still wouldn't be protected against VPNs that manage to convince your filter that they *are* one of the legitimate applications.

 

Imagine that you're given recordings of millions of conversations and you're told to identify anyone who is not conducting legitimate business based on what they are saying... except their conversations are being held in every language on the planet, not just English, and some of them are, quite legitimately, encrypting their conversations. Telling whether an application is legitimate is like that but many times harder.

[Katy]

On our Meraki MDM we have prevented apps being installed onto the student devices, but it still allows managed apps to be pushed out via VPP, so it is possible if you can get the devices on the MDM. Problem the comes with it being BYOD you have to basically cripple their personal device for it to be used at school (and it's not feasible to remove/re-install the management when they go home/come back in).

 

(On the staff devices we allow the app store and they have to sign in with their own apple ID)

[AlanD]

Thanks for the informative reply. I think I’m beginning to see why it’s difficult..but I still can’t help thing these packets have IP addresses...and stuff leaving your firewall for a destination that doesn’t match that of any allowed site should be blocked.

[caffrey]

I'm going to suggest in the next school ICT strategy meeting that we totally abandon BYOD before there's a serious safeguarding issue as it's untenable. I don't see the point in wasting vast amounts of time, money and resources trying to fight it.

[Opendium_Steve]

Thanks for the informative reply. I think I’m beginning to see why it’s difficult..but I still can’t help thing these packets have IP addresses...and stuff leaving your firewall for a destination that doesn’t match that of any allowed site should be blocked.

 

How do you know if the IP address is related to an allowed site?

 

1. You can do a reverse DNS lookup on the IP address. This almost never resolves to anything resembling the host name you're accessing the website on, so this method is pretty much useless.

 

2. You can do a forward DNS lookup on the host name the client is connecting to and see if any of the IP addresses returned match the address the client is connecting to. Unfortunately, its common for DNS replies to be used for load balancing purposes, which means each DNS reply has a different set of IP addresses.

If everything handled DNS cache expiry correctly and you could guarantee that everything on your network only ever looks up through the same DNS server, you should be able to get away with this. Unfortunately, in the real world, you're dealing with devices hopping on and off the network, so a mobile phone may well sit on your network referring to DNS relies it received when it was last on 3G. Also, 99% of client software is badly written and doesn't expire ancient cached DNS replies. The upshot is that whatever IP addresses your filtering system thinks are valid for a particular web site are frequently totally different to the IP addresses that the client devices think are valid for that website.

 

3. Ownership lookups can tell you who owns the IP address (i.e. you can tell roughly which datacentre an IP address is hosted from). Very fragile - web sites move between datacentres all the time, so your filtering system is constantly going to be blocking websites whenever it gets slightly out of date. Not to mention that an awful lot of stuff is being consolidated into the cloud hosting providers these days (AWS, Azure, Google Cloud), which happen to also be where most of the VPNs are hosted.

 

VPNs are a problem because blocking them without blocking a load of legitimate stuff is *really* hard - it isn't because the filtering providers are too stupid/lazy to bother blocking them. If this were easy, people in China wouldn't be able to VPN through the great firewall!

[AlanD]

Hmmm....well maybe the firewall needs to at least sample outgoing traffic...and if it’s going somewhere not ok maybe it Ed’s to isolate that client and report on it. I can understand it can’t do this for every packet....but a sample should soon pick up vpn usuage...and there probably needs to be closer integration between filter and firewall so firewall knows what the filter has permitted.

[stgoodyeara]

go to the ou you want to restrict

 

policies > app permissions

 

press add, then search for the app on the app store, and flick the block app switch

 

Thanks for this. Do this has lessened the occurrences of the app being used meaning my WiFi and broadband aren't getting as badly hammered. Still 50% BYOD that are being let down by the smoothwall. I am begining to question my smoothwall contract. Their resoponse to the psiphon app has been less than satisfactory. Been over 4 weeks since i initially logged the call and there is still no sign of a technical solution.

[caffrey]

I'm probably shifting away from Smoothwall this year , no idea to what yet as I've not had the time to investigate

[stgoodyeara]

I'm probably shifting away from Smoothwall this year , no idea to what yet as I've not had the time to investigate

 

I hear good things about the sophos UTM. Its going to be a hard call to make.

[mcolbourn]

We use Lightspeed as our web filter and Watchguard which is our UTM, and dont have too much trouble keeping vpns etc off our byod network.

[stgoodyeara]

We use Lightspeed as our web filter and Watchguard which is our UTM, and dont have too much trouble keeping vpns etc off our byod network.

 

@mcolbourn Any chance you could run a test of psiphon on a ipad/iphone?

 

https://itunes.apple.com/us/app/psiphon/id1276263909?mt=8

[caffrey]

I've had a single quote for Sophos which was quite attractive (a lot cheaper than SW) but it was a 3 year upfront contract - I've yet to go to other suppliers. Sophos won't fix anything as far as I can gather, it's just cheaper