restrict internet access for one user

[IA76]

Hi

 

We want to restrict internet access for one user to all websites except a list of about 10 websites that he is allowed to access.

 

Ideall we would like to do this for any desktop he logs on to but it will be suffucient to do it on the desktop he uses 99% of the time.

 

What's th easiest way to do this?

 

TIA

[rh91uk]

I guess you are running (or should be running!) a proxy filtering system. If so, do you have AD integration? If so, surely create a new OU, move that user to it, then set up the proxy to deny all websites except a specific list/whitelist you set up?

 

This is the only way I see it being possible?

 

Cheers.

[CyberNerd]

We have done this using a mixture of Smoothwall, Active Directory and SIMS.

The Head of year is responsible for ticking a box in SIMS. Overnight a script runs and puts the user into a separate AD group depending upon the SIMS selection. Smoothwall then does whitelist filtering depending upon the group mapping.

[deKay]

Would love to know about your script that does that!

[rh91uk]

Would love to know about your script that does that!

 

As would I! :-)

[CyberNerd]

The principal is this:

 

Create an Active Directory Group called 'banned' (for example).

Create an Active Directory Group called 'student_internet' (for example).

Populate AD with students UPN's from SIMS (you already done this when you did SIMS-Moodle integration, right?)

Configure smoothwall so that anyone in the 'student_internet' has a certain level of filtering and so that anyone in 'banned' can only access whitelisted site.

 

Manually you can easily change users between groups - but this is extra administrator hassle that you don't need, plus it is a teachers job.

 

The next bit was done by our SIMS man, I'll get him to double check the accuracy of this but basically:

Create a SIMS user defined field and tick box. write a VBScript that connects to the SIMS database and reads the user defined field. If the box is ticked for that user (idenfified by UPN) remove them from the 'student_internet' group and add them to teh 'banned' group. place script in windows cron (or whatever cron is called in windows)

[deKay]

The principal is this:

write a VBScript that connects to the SIMS database and reads the user defined field.

 

This is the bit I'd like to know about - the rest I can manage myself (and, in fact, we'd do something different with the results) - do you have an example snippit of code I could look at please?

[CyberNerd]

This is the bit I'd like to know about - the rest I can manage myself (and, in fact, we'd do something different with the results) - do you have an example snippit of code I could look at please?

 

I'll put you in touch with the author - he's going into business to provide support for exactly this sort of thing.

[IA76]

We have SBS 2003 but we don't use a proxy

[CyberNerd]

This is a very good proxy for filtering:

SmoothWall | Products » School Guardian 2008

[Gatt]

Another way - Create a new group (Banned for example)

 

Create a group policy object and set the Proxy server to "localhost" or "127.0.0.1" and change the security filtering from "Authenticated Users" to your Banned group

Enforce the Group Policy to ensure it is always set.. Assign the new GPO to the OU containing the users

 

What should now happen is that anyone that is a member of the "Banned" group will not be allowed outside as the proxy settings is pointing to their own PC!

[jcollings]

Another way - Create a new group (Banned for example)

 

Create a group policy object and set the Proxy server to "localhost" or "127.0.0.1" and change the security filtering from "Authenticated Users" to your Banned group

Enforce the Group Policy to ensure it is always set.. Assign the new GPO to the OU containing the users

 

What should now happen is that anyone that is a member of the "Banned" group will not be allowed outside as the proxy settings is pointing to their own PC!

 

But then the user can't even get to the 10 or so sites the OP talked about wanting to allow.

[Gatt]

Damn! - Serious case of not reading the OP fully before typing the reply :-S

[kestrel1]

We have a proxy server that runs Netmanager Precedence Technologies - NetManager: Introduction. I can add a user to a blacklisted group & this can take effect immediately. Rooms can be blocked or just have a whitelist of websites as required. There is loads more that can be done with Netmanager & it is being developed to hopefully integrate print quota management. Been using it for years & not had a problem. Runs on netbsd.