Web Filtering

[SpuffMonkey]

OK - its time to get on and lock down access to the internet. What do you guys use - and how well does it work, how much does it cost, how much does it annoy staff and kids?

 

I'm looking for a system that has

 

1) Transparent authentication to AD (we use 2003 & XP)

2) Set different blocking for users/AD groups/rooms (if poss)

3) Different blocking at different times of day

4) "Turn off" internet in particular rooms

5) Locks down search engines to "nice" things

6) Chops out any P2P time stuff

7) Minimal configuration as I've don't have much time to play

8) Blocks those flippin Anonymiser sites

 

Hey that last one started out as number 8, honest!

 

Not much to ask, is it?

[GrumbleDook]

We are just moving over from Symantec Web Security to Smoothwall Corporate Guardian.

 

Seems to be doing what we need at the moment ... and the intelligence of the filter is far better than SWS.

[Gatt]

I'm using ISA 2004 - currently set up with Block Lists, but gonna swap to white lists, this is then upstreamed to the LEA's ISA server.

 

Looking to move to a linux solution (Dansguardian?) at some point but for now its ISA...

[Simcfc73]

I use Smoothwall 2.0 Express with loads of Mods including Dansguardian. Its very very good at blocking but obviously you don't get any support except from the forum.

 

Thinking of going over to the corporate version of Smoothwall School Guardian in the summer with the money I save by ripping out Interjigsaw.

 

http://www.smoothwall.net/products/schoolguardian4/

 

Don't think it does time based blocking but I may be wrong. I would recommend Browsecontrol for that. Its not that expensive and allows the teachers to turn off the interent in their room as well as the IT guy controlling all the machines.

[openhgs]

We use Bloxx. You can lockout a particular machine, or a group of machines. You can setup different filtering criteria for different times of the day. It has excellent reporting. It auto-updates every night. The Bloxx people are very helpful and quick to respond to problems. We chose an off the self solution for an easy implementation. I was going to roll out a Dansguardian box but time (as ever) was short.

[SpuffMonkey]

We use Bloxx. You can lockout a particular machine, or a group of machines. You can setup different filtering criteria for different times of the day. It has excellent reporting. It auto-updates every night. The Bloxx people are very helpful and quick to respond to problems. We chose an off the self solution for an easy implementation. I was going to roll out a Dansguardian box but time (as ever) was short.

 

Yeah - I haven't time to do a diy thing - does the Bloxx do user/group filtering too?

[openhgs]

Yeah - I haven't time to do a diy thing - does the Bloxx do user/group filtering too?

Yes - it tracks users and you can add them to whatever group you like, or filter at the individual user level. We use two groups, the default being strict filtering and the staff group not so strict.

 

Bloxx filters both url and page content. The page content filter is very good. If you do a google search for "hardcore" the results are blocked, but "hardcore concrete" is OK. Similarly "sex" is blocked, but "sex education" is OK, "strippers" is blocked but "paint strippers" is OK, etc. You can tailor both filters to your sites requirements, for instance you might decide that the content filter doesn't apply to one group, but the url filter does. When we implemented it, designing the rules was a challenge. I setup very strict default filtering, and waited for the staff to say that they needed access to a site. I then setup staff groups (teachers and admin) and adjusted the filtering for groups based on the complaints. It's very quick to change a filter too. The staff can ask me to block or unblock a site and it's done immediately.

[pete]

We use SWS, you shouldn't. It's quite inflexible and blocklists are proprietary / undisclosed, so you can't remove stupid entries.

 

We're looking at Dansguardian / Smoothwall / home-rolled on new hardware as a replacement. Hippy with large fries please.

[NetworkGeezer]

Can the ISA users speak up. I know its produced by M$ and cost M$ but what has been your experiences with it?

[Geoff]

Dansguardian box here. Homemade.

[mrforgetful]

I use ISA 2004.

 

A lot of stuff is blocked by the authority using Network Box, but I don't like that as it blocks me too.

 

ISA works great I think. It's easy to set up for everything that you asked for, except maybe keeping Search pages clean - though I suspect it's possible by blocking a keyword expression.

 

If you want any specific details on my setup, feel free to ask.

[GrumbleDook]

Actually ... I was talking with Paul Shoesmith (Assistant Director for Technical Policy and Standards at BECTA) today about filtering and he is aghast that there is no specification or standards for filtering in schools, other than those that the RBCs or accredited service providers have to meet.

 

Any feedback that we can give him would be appreciated about what we find handy in filters (ie ... it is not just about blocking porn ... allowing groups, blocking by time, delegation of roles, etc).

 

This also covers other filters to though ... email, IM, etc

[sahmeepee]

We use Websense integrated into ISA 2000. We aren't using any of ISA's web filtering abilities, but we do use it to control what network traffic goes in and out of the LEA network.

 

We don't really have any problems with Websense. The reporting is pretty thorough and logs to SQL Server in our case although I think that's probably optional.

 

From the OP's spec, it does everything except 4 (and therefore the "rooms" part of 2) with the way we have it configured. If teachers need to turn off web access in a room they can use NetOp here. They only ask about once/twice a year.

[Sylv3r]

We use http://www.censornet.com. It seems to do a lot of the things you are looking for and best of all its free, although you can pay an annual subscription for its Blacklist update.

[john]

At one place its Websense with ISA 2004, and another its Censornet

[NetworkGeezer]

OK John (while Geoff isn't looking) which one do you prefer and why?

[john]

uum, Censornet is free, but its giving me annoyances today so I have fallen out with it, but even when you look a a BLUD sub for it and even paying a few support charges with Adelix it still is cheaper by a long way than Websense or SurfControl! Its not as quick to do things as Websense is though so I prefer doing some things in that over CN, so the moral of the story is, uuuum, errrrr, just get someone else to do it

[NetworkGeezer]

When you say not as fast do you mean the configuration is long winded or do you mean the performance under normal daytime loads is not as good?

[john]

I mean when modifying site blockings such as catagories. Websense is very very flexible where as CN is rather limited in what you can do with its filtering. Performance Websense needs a powerful machine to run it, remember as I say to all people, minimum specs are a MINIMUM not what you can get away with.

[NetworkGeezer]

Isn't there a deterent effect from the kids knowing there wevery surf is logged?

[john]

Nope, not where I have been, it doesn't scare them at all, even when they are presented with a log of there personal browsing.