Restrict filetypes

[Gatt]

How do you lot prevent kids from saving unwanted files to they're homedrives?

 

At present I just delete certain files when they logoff but this isnt stopping them doing it

 

Also finding that they are storing them in ZIP files and extracting them the next time they log in

 

But have now added that to the delete.bat file

[sahmeepee]

You can do it with WS2003 R2:

 

http://www.windowsnetworking.com/articles_tutorials/Implementing-File-Screening-Windows-Server-2003-R2.html

[sahmeepee]

(not that I have, just that I know you can!)

[ChrisH]

I have a new R2 file server ready to implement for these purposes in the holidays

[flyinghaggis]

We set up software restriction policies that stop pupil/staff from running executables from their my documents area's and local/removable drives. It doesnt stop them copying files into these areas but we're found that as soon as users realise they cant run files they copy into these areas it stops them from doing it.

Never realised that 2003 could do this. Handy to know it can filter file types in shares! (though unfortunately our main file servers are still 2000)

 

If anyone wants any advice on how to set up Software Restriction Polcies you can PM me :!:

[ChrisH]

We set up software restriction policies that stop pupil/staff from running executables from their my documents area's and local/removable drives. It doesnt stop them copying files into these areas but we're found that as soon as users realise they cant run files they copy into these areas it stops them from doing it.

Never realised that 2003 could do this. Handy to know it can filter file types in shares! (though unfortunately our main file servers are still 2000)

 

If anyone wants any advice on how to set up Software Restriction Polcies you can PM me :!:

 

Only the R2 version can do the filtering.

[apeo]

w00t! i have a new R2 server to build over summer

[Simcfc73]

I installed it and it seems to work pretty well.

 

It would have been nice for Microsoft to create a different error message when they try and save it though rather than the access denied. I can see them thinking its a problem with the network rather than they doing something wrong.

 

Also, how long will it be before they realise they can could just change the file extension to make them work. Interent filtering will stop them downloading them but they could still bring them in on USBs.

[NetworkGeezer]

Can the *nixers describe how they would do something similar. I know you can have non-excutable mounts or filesystems.

 

I more interested in stopping things like launching MOVs and MP3s from home areas but allowing teaching resources in a shared reference area.

[ChrisH]

Im no expert and I may have this wrong but I remember someone mentioned this once to do with samba and using the veto directive/function/thingerydufferemy.

[ITWombat]

Is that anything to do with foomatic filters

[MouseAT]

We set up software restriction policies that stop pupil/staff from running executables from their my documents area's and local/removable drives. It doesnt stop them copying files into these areas but we're found that as soon as users realise they cant run files they copy into these areas it stops them from doing it.

 

I'm just implementing this on our test system at the moment, and it's working brilliantly. Hopefully I'll be enabling this on the live system over the summer holiday.

[Geoff]

Can the *nixers describe how they would do something similar. I know you can have non-excutable mounts or filesystems.

 

I more interested in stopping things like launching MOVs and MP3s from home areas but allowing teaching resources in a shared reference area.

 

Sorry, missed this thread the first time round for some reason. Anyway there's two ways depending on the situation:

 

1) if your in a native linux enviroment, then you set the /home to be a seperate mount point. This is likely anyway for quota support. You must use the noexec, nodev and nosuid to prevent user naughtyness. (If you interested in furtuer mount options look at this thread on the Linux Elitists mailing list[/url]). Linux has no concept of 'file extensions' of course.

 

2) If your using Samba on a linux box as a fileserver you can use a file extension filter on a per share basis. You can do this with the 'veto files' option. For example, to ban mp3s:

 

[homes] 
  comment = Home Directories 
  browseable = no 
  writable = yes 

  veto files = /*.mp3/*.MP3/

[MkII]

I've used TrustNoExe to stop executables that works pretty well.

 

Kids are now running .SWFs tho' which is a royal pain. Looks like upgrading to 2003 R2 is the only answer - unless anyone knows different?

[ITWombat]

Kids are now running .SWFs tho' which is a royal pain. Looks like upgrading to 2003 R2 is the only answer - unless anyone knows different?

 

If you use software restriction policies in GPOs you can decide what counts as an executable.

[MkII]

Thanks Wombat - didn't spot that - testing now.

[Face-Man]

If you think .swf are an issue I found these in excel spreedsheets the other day...

 

Tetris.xls,pacman.xls,sonic.xls and golf.xls

 

Smart kids whould have renamed them thought..

[ChrisH]

What we need is some kind of filter with the same technology as webfiltering like dansguardian that can scan mime type etc? Anyone any ideas on this?

[NetworkGeezer]

@face-man

LOL Don't you just love script kiddies. They have the brains to embed the SWF but not the nouce to use a less obvious file name

[Geoff]

What we need is some kind of filter with the same technology as webfiltering like dansguardian that can scan mime type etc? Anyone any ideas on this?

 

Linux has the 'file' command which can do this. For example:

 

root@anubis:/var/www/vle.carrhill.lancs.sch.uk/htdocs/moodledata/1# ls -l
total 224
-rwxrwxrwx 1 www-data www-data  5156 2006-09-06 07:04 800px-Canon_Digital_Ixus_40.jpg
drwxr-xr-x 2 www-data root      4096 2006-09-12 19:23 backupdata
-rwxr-xr-x 1 www-data root      7080 2006-05-19 16:10 cpt3.JPG
-rwxr-xr-x 1 www-data root     10872 2006-05-19 16:10 diodes2.JPG
-rwxr-xr-x 1 www-data root      5697 2006-05-19 16:10 diodes3.JPG
-rwxr-xr-x 1 www-data root     20308 2006-05-19 16:10 diodes.JPG
drwxr-xr-x 2 www-data root      4096 2006-05-16 12:50 flash
-rwxr-xr-x 1 www-data root      4375 2006-05-19 16:10 game.JPG
-rwxrwxrwx 1 www-data www-data 19746 2006-09-06 07:01 Image_Canon_Digital_Ixus_40.jpg
-rwxr-xr-x 1 www-data root      1634 2006-05-19 16:10 images.jpg
-rw-r--r-- 1 root     root      6624 2006-06-27 14:26 ipod2.JPG
drwxr-xr-x 4 www-data root      4096 2006-05-16 12:50 moddata
-rwxrwxrwx 1 www-data www-data  8516 2006-06-24 14:53 onepointsix.JPG
-rwxrwxrwx 1 www-data www-data   434 2006-09-15 19:06 pdficon_large.gif
-rw-r--r-- 1 www-data root     42700 2006-05-19 16:10 rev1.jpg
-rw-r--r-- 1 www-data root      6057 2006-05-19 16:10 rev2.jpg
-rw-r--r-- 1 www-data root      8636 2006-05-19 16:10 rightlogo1.jpg
-rw-r--r-- 1 www-data root      6625 2006-05-19 16:10 rightlogo1.OLD

 

Scanned with 'file' gives:

 

root@anubis:/var/www/vle.carrhill.lancs.sch.uk/htdocs/moodledata/1# file *
800px-Canon_Digital_Ixus_40.jpg: JPEG image data, JFIF standard 1.01
backupdata:                      directory
cpt3.JPG:                        JPEG image data, JFIF standard 1.01
diodes2.JPG:                     JPEG image data, JFIF standard 1.01
diodes3.JPG:                     JPEG image data, JFIF standard 1.01
diodes.JPG:                      JPEG image data, JFIF standard 1.01
flash:                           directory
game.JPG:                        JPEG image data, JFIF standard 1.01
Image_Canon_Digital_Ixus_40.jpg: HTML document text
images.jpg:                      JPEG image data, JFIF standard 1.01
ipod2.JPG:                       JPEG image data, JFIF standard 1.01
moddata:                         directory
onepointsix.JPG:                 JPEG image data, JFIF standard 1.01
pdficon_large.gif:               GIF image data, version 89a, 32 x 32
rev1.jpg:                        JPEG image data, JFIF standard 1.02
rev2.jpg:                        JPEG image data, JFIF standard 1.01, comment: "Created with The GIMP\377\333"
rightlogo1.jpg:                  JPEG image data, JFIF standard 1.01, comment: "Created with The GIMP\377\333"
rightlogo1.OLD:                  JPEG image data, JFIF standard 1.01, comment: "Created with The GIMP\377\333"

 

I believe 'file' is part of cygwin too, so it should be usable on windows.

[ChrisH]

Thanks Geoff that should be worth looking into with maybe a little front end as well .

[MkII]

Kids are now running .SWFs tho' which is a royal pain. Looks like upgrading to 2003 R2 is the only answer - unless anyone knows different?

 

If you use software restriction policies in GPOs you can decide what counts as an executable.

 

hmm - not working

 

[set in user config > windows settings > security settings > software restrictions > enforcement]