ISA and...?

[indiegirl]

I'll start a new topic on this as all your thoughts are welcomed.

 

We have ISA 2004. I have been told by my NM that "under no circumstances are we getting rid of it".

 

So, in lieu of my need to block by keyword and not just by URL, suggestions are welcomed for products that will work with ISA, but cost as little as possible.

 

Censornet is the recommendation that's stood out so far (currently pulling that down and hope to play in the next week or so)...

[webman]

IPCop + Advanced Proxy Addon + URL Filter Addon

 

Includes keyword filter, AD authentication and enchanced log viewer amongst other things. Highly recommended.

[eejit]

Burst Technology do a nice add on that should totally cater for your needs. You can completely customise it to your needs, but tbh, the default configuration is good enough.

 

http://www.burstek.com/

[Geoff]

Squid and Dansguardian. You can do seamless (ie, no prompts) NTLM authentication too. If you do, you can do per group filtering (staff/students/IT techs).

[CyberNerd]

We have ISA 2004. I have been told by my NM that "under no circumstances are we getting rid of it".

 

so don't get rid of it, just bypass it

[ChrisH]

Thats how my other box is setup I keep swopping inbetween them both while I get it working as I want it. Here is a screen shot of the admin panel which shows the options available and the components it's made up of. It's good to start off with but like me you may find yourself doing your own solution later on when the logon box becomes a pain and or you need to put it on some unsupported hardware.

[john]

I am going to do a Censornet deploy in a small primary school at Easter, so I may be nudging you Chris if I mess it up! I have tried playing with it recently and it works well, and seems idiot proof, but as a Linux newbie, I am stuffed if it goes badly wrong

[ChrisH]

Its a good one to start with as its all setup for you so you can have a look at how things are setup. Id be happy to answer any questions the Censornet forums tend to be a little slow.

[john]

Thanks for that Chris, Basically, they A cannot afford Websense / Surf Control (or A N Other big name) and B, they will end up on a County LEA service for the internet in the next 2 years, so its pointless spending £1000's on fancy solutions when the county will practically force them onto there system from there own setup they have now. So we are spending the money that would have been spent on Surf Control on more PCs for the classrooms and better software such as Photoshop elements etc....

[ChrisH]

You dont need a big name these will do do the job admirably. They may not be quiete as polished and easy to use (or are they) but you cant argue with £0 for the sake of a little learning. Especially when the savings can be annual in a lot of cases

[alan-d]

You won't get rid of it You would just be updating it Besides - from what you tell us about him - he won't put the effort in to change it back, but you could make him justify doing so to the management

[indiegirl]

I'm conscious that a lot of money will have gone to waste if I bypass the ISA server... so, I'm going to try and set up Censornet in the next month (he's away from Friday, hurrah!) to prove that my solution works and is free, whereas he got on the phone to his suppliers yesterday, demanding the 'best solution' (and then went cap in hand to the head and told him it'd cost £4k!)

 

As an aside, I got in touch with Burstek, and they quoted me $4500 US (2600 GBP) for 250 workstations... :-o

 

 

Still, one awaits the day when it's mine (all mine!) and I can do as I please :-D

[ChrisH]

Guaranteed they will moan about the logon prompt new version out later this year though although probably late this year. I also have some very rough instructions for getting Squid and DG working with AD groups under debian with transparent autentication.

[indiegirl]

Guaranteed they will moan about the logon prompt

 

They being the NM here?

 

He's just said to me: "I'm not having them login twice, most of them can't manage it the first time around. Mind you, in the same breath he imparted this piece of wisdom on me:

 

"IT support is about doing as little as possible as the systems should run themselves"

(that explains his constant Googling over the past month planning for his holiday / searching for Liverpool related items / telling me how to make a lightsabre / buying Oakley sunglasses... etc etc)

 

Those instructions would be useful, I'll PM you my email addy

[pete]

He's just said to me: "I'm not having them login twice, most of them can't manage it the first time around.

 

If my users can do it, so can yours. Admittedly they have been indoctrinated from Y7 and it's a case of "Learn or do not use". You just have to ensure that _any_ attempt to access the web triggers the "log on" page rather than breaking.

[webman]

The problems we used to have with the logon box popping up for the users going on the Internet were a) students banned from using the internet could use someone else's credentials in this box and b) teachers got confused with 2 authentication boxes when trying to access our LEA Extranet (even though one said "Bishop Barrington Proxy" (which needed their local username nad password) and another that said "Durhamlea schools extranet" which needed the global username and password for the LEA site.

 

We solved all this though with IPCop

[CyberNerd]

"I'm not having them login twice

 

In a way it could be quite a good thing to have them log on twice, it makes users *think* about what they are doing, using a web-browser, accessing the internet and that the authentication will mean that their actions are being monitored. It sounds dumb to us but for your average yr7/teacher its an important thing to know.

[CyberNerd]

2 authentication boxes when trying to access our LEA Extranet

 

 

bypass your authentication in your proxyconfig, its an extranet site.

[webman]

2 authentication boxes when trying to access our LEA Extranet

 

 

bypass your authentication in your proxyconfig, its an extranet site.

 

We didn't think of that at the time, but like I said.. we don't have the logon popup now we moved to IPCop, yet everything is still logged

[indiegirl]

See, now I agree with all the views here - I personally think that two logins is a damn fine idea... although the kids here don't take their passwords seriously at all and allow them to be used left right and centre...

 

NM has now got onto the LEA / our provider and has put the onus on them to start blocking by keyword as well (a block of the keyword 'proxy' would solve 98% of my problems here!)

 

Now, if I can get the time to play, play with Censornet / IPCop / etc, I will...

 

.... if the NM didn't lump the KS3 testing on me, that is... (his idea of a handover was to show me the installation book and install it on one workstation in the room behind us...)