Restrict filetypes

Gatt · June 19, 2006

How do you lot prevent kids from saving unwanted files to they're homedrives?

At present I just delete certain files when they logoff but this isnt stopping them doing it

Also finding that they are storing them in ZIP files and extracting them the next time they log in

But have now added that to the delete.bat file

sahmeepee · June 19, 2006

You can do it with WS2003 R2:

http://www.windowsnetworking.com/articles_tutorials/Implementing-File-Screening-Windows-Server-2003-R2.html

sahmeepee · June 19, 2006

(not that I have, just that I know you can!)

ChrisH · June 19, 2006

I have a new R2 file server ready to implement for these purposes in the holidays

flyinghaggis · June 19, 2006

We set up software restriction policies that stop pupil/staff from running executables from their my documents area's and local/removable drives. It doesnt stop them copying files into these areas but we're found that as soon as users realise they cant run files they copy into these areas it stops them from doing it.

Never realised that 2003 could do this. Handy to know it can filter file types in shares! (though unfortunately our main file servers are still 2000)

If anyone wants any advice on how to set up Software Restriction Polcies you can PM me :!:

ChrisH · June 20, 2006

We set up software restriction policies that stop pupil/staff from running executables from their my documents area's and local/removable drives. It doesnt stop them copying files into these areas but we're found that as soon as users realise they cant run files they copy into these areas it stops them from doing it.
Never realised that 2003 could do this. Handy to know it can filter file types in shares! (though unfortunately our main file servers are still 2000)

If anyone wants any advice on how to set up Software Restriction Polcies you can PM me :!:

Only the R2 version can do the filtering.

apeo · June 20, 2006

w00t! i have a new R2 server to build over summer

Simcfc73 · June 20, 2006

I installed it and it seems to work pretty well.

It would have been nice for Microsoft to create a different error message when they try and save it though rather than the access denied. I can see them thinking its a problem with the network rather than they doing something wrong.

Also, how long will it be before they realise they can could just change the file extension to make them work. Interent filtering will stop them downloading them but they could still bring them in on USBs.

NetworkGeezer · June 29, 2006

Can the *nixers describe how they would do something similar. I know you can have non-excutable mounts or filesystems.

I more interested in stopping things like launching MOVs and MP3s from home areas but allowing teaching resources in a shared reference area.

ChrisH · June 29, 2006

Im no expert and I may have this wrong but I remember someone mentioned this once to do with samba and using the veto directive/function/thingerydufferemy.

ITWombat · June 29, 2006

Is that anything to do with foomatic filters

MouseAT · June 30, 2006

We set up software restriction policies that stop pupil/staff from running executables from their my documents area's and local/removable drives. It doesnt stop them copying files into these areas but we're found that as soon as users realise they cant run files they copy into these areas it stops them from doing it.

I'm just implementing this on our test system at the moment, and it's working brilliantly. Hopefully I'll be enabling this on the live system over the summer holiday.

Geoff · September 21, 2006

Can the *nixers describe how they would do something similar. I know you can have non-excutable mounts or filesystems.

I more interested in stopping things like launching MOVs and MP3s from home areas but allowing teaching resources in a shared reference area.

Sorry, missed this thread the first time round for some reason. Anyway there's two ways depending on the situation:

1) if your in a native linux enviroment, then you set the /home to be a seperate mount point. This is likely anyway for quota support. You must use the noexec, nodev and nosuid to prevent user naughtyness. (If you interested in furtuer mount options look at this thread on the Linux Elitists mailing list[/url]). Linux has no concept of 'file extensions' of course.

2) If your using Samba on a linux box as a fileserver you can use a file extension filter on a per share basis. You can do this with the 'veto files' option. For example, to ban mp3s:

[homes] 
  comment = Home Directories 
  browseable = no 
  writable = yes 

  veto files = /*.mp3/*.MP3/

MkII · September 21, 2006

I've used TrustNoExe to stop executables that works pretty well.

Kids are now running .SWFs tho' which is a royal pain. Looks like upgrading to 2003 R2 is the only answer - unless anyone knows different?

ITWombat · September 21, 2006

Kids are now running .SWFs tho' which is a royal pain. Looks like upgrading to 2003 R2 is the only answer - unless anyone knows different?

If you use software restriction policies in GPOs you can decide what counts as an executable.

MkII · September 22, 2006

Thanks Wombat - didn't spot that - testing now.

Face-Man · September 22, 2006

If you think .swf are an issue I found these in excel spreedsheets the other day...

Tetris.xls,pacman.xls,sonic.xls and golf.xls

Smart kids whould have renamed them thought..

ChrisH · September 22, 2006

What we need is some kind of filter with the same technology as webfiltering like dansguardian that can scan mime type etc? Anyone any ideas on this?

NetworkGeezer · September 22, 2006

@face-man

LOL Don't you just love script kiddies. They have the brains to embed the SWF but not the nouce to use a less obvious file name

Geoff · September 22, 2006

What we need is some kind of filter with the same technology as webfiltering like dansguardian that can scan mime type etc? Anyone any ideas on this?

Linux has the 'file' command which can do this. For example:

root@anubis:/var/www/vle.carrhill.lancs.sch.uk/htdocs/moodledata/1# ls -l
total 224
-rwxrwxrwx 1 www-data www-data  5156 2006-09-06 07:04 800px-Canon_Digital_Ixus_40.jpg
drwxr-xr-x 2 www-data root      4096 2006-09-12 19:23 backupdata
-rwxr-xr-x 1 www-data root      7080 2006-05-19 16:10 cpt3.JPG
-rwxr-xr-x 1 www-data root     10872 2006-05-19 16:10 diodes2.JPG
-rwxr-xr-x 1 www-data root      5697 2006-05-19 16:10 diodes3.JPG
-rwxr-xr-x 1 www-data root     20308 2006-05-19 16:10 diodes.JPG
drwxr-xr-x 2 www-data root      4096 2006-05-16 12:50 flash
-rwxr-xr-x 1 www-data root      4375 2006-05-19 16:10 game.JPG
-rwxrwxrwx 1 www-data www-data 19746 2006-09-06 07:01 Image_Canon_Digital_Ixus_40.jpg
-rwxr-xr-x 1 www-data root      1634 2006-05-19 16:10 images.jpg
-rw-r--r-- 1 root     root      6624 2006-06-27 14:26 ipod2.JPG
drwxr-xr-x 4 www-data root      4096 2006-05-16 12:50 moddata
-rwxrwxrwx 1 www-data www-data  8516 2006-06-24 14:53 onepointsix.JPG
-rwxrwxrwx 1 www-data www-data   434 2006-09-15 19:06 pdficon_large.gif
-rw-r--r-- 1 www-data root     42700 2006-05-19 16:10 rev1.jpg
-rw-r--r-- 1 www-data root      6057 2006-05-19 16:10 rev2.jpg
-rw-r--r-- 1 www-data root      8636 2006-05-19 16:10 rightlogo1.jpg
-rw-r--r-- 1 www-data root      6625 2006-05-19 16:10 rightlogo1.OLD

Scanned with 'file' gives:

root@anubis:/var/www/vle.carrhill.lancs.sch.uk/htdocs/moodledata/1# file *
800px-Canon_Digital_Ixus_40.jpg: JPEG image data, JFIF standard 1.01
backupdata:                      directory
cpt3.JPG:                        JPEG image data, JFIF standard 1.01
diodes2.JPG:                     JPEG image data, JFIF standard 1.01
diodes3.JPG:                     JPEG image data, JFIF standard 1.01
diodes.JPG:                      JPEG image data, JFIF standard 1.01
flash:                           directory
game.JPG:                        JPEG image data, JFIF standard 1.01
Image_Canon_Digital_Ixus_40.jpg: HTML document text
images.jpg:                      JPEG image data, JFIF standard 1.01
ipod2.JPG:                       JPEG image data, JFIF standard 1.01
moddata:                         directory
onepointsix.JPG:                 JPEG image data, JFIF standard 1.01
pdficon_large.gif:               GIF image data, version 89a, 32 x 32
rev1.jpg:                        JPEG image data, JFIF standard 1.02
rev2.jpg:                        JPEG image data, JFIF standard 1.01, comment: "Created with The GIMP\377\333"
rightlogo1.jpg:                  JPEG image data, JFIF standard 1.01, comment: "Created with The GIMP\377\333"
rightlogo1.OLD:                  JPEG image data, JFIF standard 1.01, comment: "Created with The GIMP\377\333"

I believe 'file' is part of cygwin too, so it should be usable on windows.

ChrisH · September 22, 2006

Thanks Geoff that should be worth looking into with maybe a little front end as well

.

MkII · September 22, 2006

Kids are now running .SWFs tho' which is a royal pain. Looks like upgrading to 2003 R2 is the only answer - unless anyone knows different?

If you use software restriction policies in GPOs you can decide what counts as an executable.

hmm - not working

[set in user config > windows settings > security settings > software restrictions > enforcement]

Restrict filetypes

Recommended Posts

Gatt

sahmeepee

sahmeepee

ChrisH

flyinghaggis

ChrisH

apeo

Simcfc73

NetworkGeezer

ChrisH

ITWombat

MouseAT

Geoff

MkII

ITWombat

MkII

Face-Man

ChrisH

NetworkGeezer

Geoff

ChrisH

MkII

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New