.pac files and horrible web proxy sites.

[itwasntme]

Hi Guys,

I am having some trouble with a few students who receive daily updates on new proxies to use.

There is one in particular, a scripted randomly generated page on a new ip/host every day that is causing the most difficulty for us at the moment. Although our LA's provider have been relatively good at blocking these sites, they don't for whatever reason block the https equivalents.

My thoughts are to drop all https traffic unless the addresses are in a list..

I haven't yet figured out the best way of doing this, we use smoothwall and I haven't yet figured out the best way with this, however I am messing about with the idea of altering our pac file.

 

Our pac file is already relatively complicated (I have removed the school specific hostnames/ips);

function FindProxyForURL(url, host) 
{ 
if (
	shExpMatch(url, "*.ebay.com*") ||
	shExpMatch(url, "*.ebay.co.uk*") ||
	shExpMatch(url, "*.facebook.com*") ||
	shExpMatch(url, "*.bebo.com*") ||
	shExpMatch(url, "*.myspace.com*") ||
	shExpMatch(url, "*.logmein.com*") ||
	shExpMatch(url, "*remote.blah.police.uk*") ||
	shExpMatch(url, "*crl.adobe.com*") ||
	shExpMatch(url, "*www.myschool.com*") ||
	shExpMatch(url, "*pbwiki.com*") ||
	shExpMatch(url, "*blahgov.pbworks.com*")
) 
return "PROXY E2BNPROXY:8080; PROXY LA1:8080; PROXY LA2:8080";
if (
	!isInNet(myIpAddress(), "10.112.0.0", "255.255.0.0") || 
	isInNet(host, "10.112.0.0", "255.255.0.0") || 		
	dnsDomainIs(host, ".blah.local") ||			
	isPlainHostName(host) ||				
	shExpMatch(url, "*portal.myschool.com*") ||
	shExpMatch(url, "*mail.myschool.com*") ||
	shExpMatch(url, "*autodiscover.myschool.com*") ||
	shExpMatch(url, "*dev.myschool.com*") ||
	shExpMatch(url, "*helix.myschool.com*") ||
	shExpMatch(url, "*www2.myschool.com*") ||
	shExpMatch(url, "*cover.myschool.com*")
)
return "DIRECT";

if (shExpMatch(url, "http:*")) return "PROXY 10.112.225.19:8080; PROXY E2BNPROXY:8080; PROXY LA1:8080;"
if (
	shExpMatch(url, "*.firstdirect.com*") || 
	shExpMatch(url, "*.hotmail.co*") ||
	shExpMatch(url, "*.lloydstsb.co*") ||  /* etc etc add another line for every url not handled by 'http' or in first section of pac file */
	shExpMatch(url, "*.barclays.co*") ||
	shExpMatch(url, "*.msn.co*")
)
return "PROXY LOCAL:8080; PROXY E2BNPROXY:8080; PROXY LA1:8080;"
} 

This pac file is one that myself and my techs use, along with the PCSOs here.

The social networking sites are blocked by authority proxy, some of the other sites just work better avoiding our local proxy. This pac file shares a layout (although some of the sites differ (social networking/ebay/police etc)) with the pac file used by teachers and is used by desktops and laptops, the laptops do go home with the teachers and are able to use their home internet connection while still using this pac file. There are some other sites in there too that just go direct because obviously they are local.

Any advice would be greatly appreciated!

Edited March 10, 2010 by itwasntme

[nile_c]

Which SmoothWall are we talking about here?

 

There are a couple of ways to skin this particular cat.

[itwasntme]

Which SmoothWall are we talking about here?

 

There are a couple of ways to skin this particular cat.

 

Thanks nile_C;

 

NetworkGuardian 2008 it would seem?

[nile_c]

Ok, I probably wouldn't use your pac for this. It call all be done at the Smoothie.

 

If you want to block all HTTPS:

On the guardian > policy page you can create a new filter. When you click on the 'Filter:' dropdown there is a special category called All HTTPS Content. The Block action can then be used to block HTTPS.

You can use either your existing allowed content rules, or create an additional filter to allow those HTTPS sites which you need.

 

The second option is to use your SmoothWalls built-in functionality for filtering HTTPS content.

Under 'guardian > filtering > per-group settings' you have the following options available:

 

* Block invalid SSL certificates: This blocks the invalid certificates that many HTTPS based proxies will use.

* Intercept HTTPS: This decrypts the connection to HTTPS sites, allowing the guardian engine to "see" the content, just as it would with plain HTTP.

This is useful against the newest proxies that use valid certificates and cycle through domains rapidly.

 

There is a little bit of extra configuration involved with HTTPS interception; your clients each need to recognize the Smoothwall as a valid CA, by importing its CA cert.

[itwasntme]

Thanks Nile, will take a look at this in the slow hours!