Web Filter

[apeo]

Ok I have a question for all you nix gurus out there as Im a nix Newb. What Im looking into for the near future is a means to filter websites/content and I believe a nix server would do this best. Only thing is in kinda need an idiots guide on the following:

Distro - Which one should i go for?

- Whats the hardware requirement?

 

Smoothwall - Given the above, how do I install it?

- How do i configure it?

- How do i intergrate it into the network?

 

Dansguard - how do I install it?

- How do i configure it?

- How do i intergrate it into the network?

 

Ipcop - should i use this and if so then the above questions need answering...

 

I know its alot to ask but any help is appreciated. Oh and one more thing, if i wanted to add additional elements would it be a good idea to add them to the above nix server or create a new one?

[Geoff]

Ok. As I've mentioned before I need to get round to writing up one (or more!) wiki articles about this however basically what I have setup (in steps):

 

Ubtuntu LTS 6.06 (Dapper Drake) Minimal Server Install on a P4 Celeron 2.4Ghz with 1Gb of ram (a recycled desktop machine basically).

 

I've installed Squid and Samba (with winbind).

I've then added the machine as a member server to the domain (samba).

Enabled Username/Group lookups (winbind)

Got the machine working as a proxy via our LEA's proxy server (Squid)

Enabled NTLM authentication (Squid + Winbind)

Downloaded Dansguardian Alpha Version and compiled it (much installing of compile tools).

Done some configured Dansguardian so it goes through squid (for the NTLM auth).

Updated the blacklists + phraselists and told Dansguardian to use them.

 

Things I have outstanding:

 

Pay for blacklist updates (not really up to me) and get them autoupdating.

Sort out some reporting functionality.

Customise the block page.

 

Which of the above steps do you require more details on?

[djm968]

My first nix box was a proxy filter running squid and dansguardian on Fedora Core 2. The GUI means you don't have to get too bogged down in scipts and config files and Squid and Dans are both available as easy to install packages.

 

The thing was rock solid for two years, never fell over once. I think the school are still using it now.

[Teth]

I too am about to embark on this so will watch this thread and any wiki articles on it with intrest. At the moment I have soem breathing space because I've refused to have any live internet access in suites that I supervise at lunch and after school until the school has kids signing an AUP which I'm currently negotiating with SMT about.

 

The part I least understand and can find least information about is useage restriction in terms of an internet on/off switch. The head of IT here has resisted the arrival of the internet in the teaching suites because of the distraction it would cause for lessons, but the internet provission in the library/learning centre is just not adequate to meet demands. Its overly filtered by C2K the managed network provider here. So the solution I impliment needs to offer interent use before school, lunch, break and afterschool easy enough. The harder part is to allow it to be on and off on a per room basis for lessons. Idealy ina very simple way that teachers can do it themselves. A simple "click here to activate/ deavtiviate internet in this Suite" button.

 

I'm sure its something I can at the very least write scripts for and a basic application which runs those scripts from an idiot proof interface. Its just finding the time to do it.

[djm968]

Its really easy to do this..... tell them to go to the wall and hit the power switch on the router. Bingo.... no internet access.

[tom_newton]

Who'd have guessed i'd pop up in this thread, eh?

 

I'd suggest that for a system analagous to Geoff's there, but for people who don't have his time (or obvious considerable expertise!) SmoothWall's SchoolGuardian system is the way to go. You can build something similar from OpenSource components, but it isn't that easy, and you don't get a web gui!

 

It's based on Dansguardian, but it's not the same one as you download, as Dan himself is one of the SmoothWall directors, and we've spent a couple of years improving the thing!

 

I will disclaim this by adding that I work for SmoothWall, but even if I didn't i'd encourage you to look at the system.

 

Also, there's an EduGeek discount for members of this board, because we think it's great

 

Tom ([email protected])

[tom_newton]

@ Teth - time based rules are already in our product set - would be interested in how you'd like room-based rules implementing, by IP? MAC?

 

Drop me an email if you've any bright ideas on this one, always like to hear from those on the "front line"!

[plexer]

Censornet always had the ability to group machines and then disable web browser as you saw fit.

 

Schoolguardian integrates with active directory so you could presumably pull ou's containing computers out of there for your groups and then obtain the macs or ip from the machines to block?

 

Ben

[Teth]

In my thoughts on scripting this I was thinking MAC as I already have MAC lists or ideally by OU its gonna depend really on how much time I have to learn new things before this gets implimented

 

I'd love to buy a product for it too but I'm in a school that has no IT budget. I mean there is no allocation of money at all for the network. Equipment is bought in haphazard fashion by either departmental budgets or by capital spending at the end of a financial year. The capital spending is very irregular, money was spent this year on 60 new machines and 2 new servers but thats the first spend in 3 years (I've worked here 8 months). The IT departments budget is less than 10k a year and from it must come paper, Toner, incidentals like mice leads etc, textbooks and materials for ICT and computing classes. The budget has been dwindling year y year because we are due a new school under a PPP(public private partnership) system and as such our funding is being cut by the board and capital expenditure is fround upon.

 

Simply put an internet connection is needed to do the Clait+ exams this year which I can provide simply enough for that task. I'm trying to go that extra mile and provide it year round for classes but there is no money available only my time. So it will be open source or bust. Another time based project I have is getting the small 6thform computer room operational again on scrounged and spare hardware with no money. Thats most likely going to be an opensource project as well.

 

 

If changing a users filter group takes effect instantly maybe a "no access" group which they are removed from if they are in an internet class would be an answer. Again with copious scripting to idiot proof it.

[tom_newton]

Thanks guys - AD method sounds like a plan - will discuss with the devs. Unlike some folk, who copy the AD periodically (think censornet do this) we have a caching auth daemon which means changes are instant.

[webman]

You can build something similar from OpenSource components, but it isn't that easy, and you don't get a web gui!

 

Unless you make one yourself or mix dansguardian with ipcop?

[Geoff]

There's a webmin module for dansguardian too.

 

However personally, I'm more at home with the flat text files. It makes it more obvious as to what's going on.

[CyberNerd]

Unless you make one yourself or mix dansguardian with ipcop? Smile

 

Would take a lot of beating, smoothwall corp web interface is v.good

[NetworkGeezer]

However personally, I'm more at home with the flat text files. It makes it more obvious as to what's going on.

 

Spoken like a true geek

[Geoff]

Shh, or I'll grep you!

[Ric_]

Shh, or I'll grep you!

 

Promises Promises!

[apeo]

Thanks for all the replies ppl, its been v.useful and i will naturally have a look at all the elements discussed. Going back to the first post Geoff, err answer would be.. er all of the above would be nice (told you Im a nix Newb ).

[SpuffMonkey]

Have you thought of going over to the VMWare Site - d/l a (free) copy of VMWare Player, then have a browse through their free appliances list (VMWare Appliances) - there is a Squid/Dansguard one - d/l it, load it up in Player and Bob's yer uncle - jobs a goodun - well nearly....

 

So Geoff - how do you point Squid via the RBC proxy? Haven'y quite worked that out yet.

 

Oh - and there are some fab Network Monitoring appliances - even an Online Learning Suite and a setup for secure diskless Internet Cafe PCs amongst hundreds - its a great resource.

[NetworkGeezer]

Look in the squid.conf file for the cache_peer tag you need to set it to something like

cache_peer proxy.yourisp.com parent 3128 3130
prefer_direct off

[Geoff]

prefer_direct isn't sufficent, plus your cache_peer syntax is wrong. Consider the following:

 

#Define upstream proxy

cache_peer proxy.lancsngfl.ac.uk parent 8080 7 no-query default

#Local LEA
acl local_external dstdomain lancsngfl.ac.uk

#Local domain
acl local_servers dstdomain st-michaels-ce23.lancsngfl.ac.uk

#LAN IP Range
acl local_ip_range dst 10.81.104.0/255.255.255.0

# Don't go via another proxy for these addresses
always_direct allow local_external
always_direct allow local_servers
always_direct allow local_ip_range
never_direct allow all

[apeo]

Sorry to dig this up again after such a long time but i finally got some time to read up on/learn Ubuntu. Didnt really get far but making slow progress.. Anyway heres my problem, I've added my Ubuntu box to the domain but the annoying thing is that when I do a find computer in AD Users and Computers it finds it but it shows its machine role as Domain Controller. I then checked it by looking at its properties and its role there is Workstation or Server.

 

Any ideas why there is a conflict? Here is whats in my smb.conf file (note most of the config are default settings):

 

[global]

workgroup = MY

realm = MY.DOMAIN

server string = %h server (Samba, Ubuntu)

security = ADS

obey pam restrictions = Yes

passdb backend = tdbsam

passwd program = /usr/bin/passwd %u

passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .

syslog = 0

log file = /var/log/samba/log.%m

max log size = 1000

dns proxy = No

panic action = /usr/share/samba/panic-action %d

invalid users = root

 

[printers]

comment = All Printers

path = /tmp

create mask = 0700

printable = Yes

browseable = No

 

[print$]

comment = Printer Drivers

path = /var/lib/samba/printers

[ChrisH]

Its normal that it shows up like that in AD users and computers. I wouldnt worry about ti.

[apeo]

Oh right.. just wanted to make sure. Thanks for the input, gonna plod along and do some more configuring now.

[mitcheln]

just for information about hardware really: i run a shorewall/dansguardian/squid setup on debian stable on a 733 P3 with 256MB of RAM and a 20GB hdd. Its a small site - 60 PCs - but it runs very happily.

[apeo]

Ok I think ive set it all up now and appears to be working properly. I just need to sort out the blacklist and praselist, exactly how do i do this? Can someone tell me what the command to find out what the versions of the different packages/software eg if i wanted to find out what version of dansguardian, how would i do it? Also I installed dansguardian from the universe/multiverse list, does this mean that if i do an apt-get upgrade it will upgrade dansguardian?