LGFL synetrix web filtering

[lionsl2005]

Hi guys,

we use lgfl synetrix url filtering. my head asked me to unblock the youtube for teachers only. how do i do this in synetrix url filtering? any one familiar with LGFL please help.

[Tyiell]

Pretty sure you can't I'm afraid. AFIK the Synetrix proxy doesn't provide multiple levels of filtering - it's either on or off. This is what prompted us to implement a DansGuardian/Squid proxy that filters internally then forwards on to Synetrix. That way we allow youtube on Synetrix, but block it for students only on our internal proxy.

 

EDIT: We implemented this 2 years ago or so, they may have implemented multiple groups since. However even if they have we find we get a greater level of control from our internal set up...

Edited April 21, 2010 by Tyiell

[ricki]

HI

 

We dual filter with a squid and dansguardian box as well.

 

Richard

[rush_tech]

HI

 

We dual filter with a squid and dansguardian box as well.

 

Richard

Same here gives you that little bit more control

[36Degrees]

If your teachers always use computers in a specific IP range and pupils in a different one then you can create separate policies accordingly within Netsweeper. However, if like us you don't and it's determined purely by DHCP then YouTube is either on or off. You'll have to put your own content filter between Synetrix and your computers to allow user group access.

 

I'm just about to start looking at options myself as we only currently have Synetrix filtering through EMBC and had to switch YouTube off due to some of the content pupils have access to. This wasn't popular at all with some members of staff!

[Tyiell]

This wasn't popular at all with some members of staff!

 

I can imagine!!! If I tried that I would be shot, stabbed, hung, drawn, quartered, castrated and burned...

[36Degrees]

I can imagine!!! If I tried that I would be shot, stabbed, hung, drawn, quartered, castrated and burned...

 

Despite explaining very clearly during staff briefing why it had been done as well as explaining very clearly to all staff via email why it had been done and why the only option was to completely switch off YouTube one member of staff still rang to complain and then went to the Head Teacher. Fortunately I had already got his backing!

[lionsl2005]

Pretty sure you can't I'm afraid. AFIK the Synetrix proxy doesn't provide multiple levels of filtering - it's either on or off. This is what prompted us to implement a DansGuardian/Squid proxy that filters internally then forwards on to Synetrix. That way we allow youtube on Synetrix, but block it for students only on our internal proxy.

 

EDIT: We implemented this 2 years ago or so, they may have implemented multiple groups since. However even if they have we find we get a greater level of control from our internal set up...

 

I would love to do that? how do i do?

[timzim]

We use ISA Server and upstream proxy to synetrix. We then shove anything we don't want filtered by synetrix into various bypass groups (one for admins, one for staff, one for all users) which route round the upstream proxy.

[Tyiell]

I would love to do that? how do i do?

 

You will need a server running a form of linux (my preference is Ubuntu or Debian - I find Ubuntu easier and reliable enough, but debian is more stable). Then you set it up with squid and dansguardian (how-to links to follow) and set a GPO on your domain to force all browsers to use the new server as a proxy.

[Tyiell]

www.howtoforge.com is the best resource I have found for Linux help and how-tos. Here are the guides I have used in the past:

 

How To Install And Configure Dansguardian With Multi-Group Filtering And Squid With NTLM Auth On Debian Etch | HowtoForge - Linux Howtos and Tutorials

 

Dansguardian Content Filtering With Transparent Proxy On Ubuntu 9.10 Karmic | HowtoForge - Linux Howtos and Tutorials

 

That first one will work for Ubuntu as well - they are similar to use. The first one authenticates users with ntlm meaning you don't have to run anything on the client to identify the users - the best method I think. I have recently set this up on the latest Ubuntu release (9.10 Karmic), so feel free to give me a shout if you have a go and get stuck!!

[powdarrmonkey]

How To Install And Configure Dansguardian With Multi-Group Filtering And Squid With NTLM Auth On Debian Etch | HowtoForge - Linux Howtos and Tutorials

 

Note - this is for Etch, the previous stable version. In Lenny the samba and winbind things changed a little, you may find there are differences in the configurations.

[lionsl2005]

You will need a server running a form of linux (my preference is Ubuntu or Debian - I find Ubuntu easier and reliable enough, but debian is more stable). Then you set it up with squid and dansguardian (how-to links to follow) and set a GPO on your domain to force all browsers to use the new server as a proxy.

 

im not confident with linux ( never tried the linux as a server) we have 2008 server. is it easy to have a linux server? what are the hardware specs?

[Tyiell]

Hardware specs are much less than windows - we have a filter server running on a decent quality desktop pc (Dual-Core 1.6Ghz with 1GB ram) - it flies. Although if the whole school is running through it a gigabit network card is probably best!

 

Although not strictly recommended, we don't use the server edition - Ubuntu Desktop Edition is fairly intuitive to use and is stable enough for the job (debian more so, but I prefer Ubuntu for ease of use) - IMO although ideal, the server edition makes it more awkward to set up...

[tom_newton]

For those not really wanting to get their feet wet in linux, there is another solution.. it is more costly, but you might like it! (See link in sig..)

[ajbritton]

Those of you running local content filters - I'm interested to know how this works for SSL/TLS traffic. I assume you are configuring browsers to connect to local proxy servers and the traffic is then sent on to the upstream proxy at Synetrix. If this is the case, are you still able to take advantage of the content filters at Synetrix to block the really nasty sites that operate over SSL/TLS? My understanding is that this is problematic since in this configuration, the Synetrix content filters are effectively 'transparent proxies' and it's not possible to transparent proxy SSL/TLS due to chain of trust issues (unless running as man-in-the-middle).

 

Thanks..

[Tyiell]

We have made the decision to block all SSL traffic with squid. We have an exceptions list on the Squid ACL that lets us allow exam pages like Edexcel and the few others that need to ba accesses. When you think about it there are very few pages that people actually need that are SSL...

 

I cant say for sure, having never tested it, but having set up the synetrix proxy as a cache that squid forwards all traffic to I am under the impression that it works exactly the same way as if the traffic went directly there.

[tom_newton]

@aj - a local content filter is not going to let synetrix "see" inside an ssl transaction - as it will re-encrypt (or just look at host headers). You'll either need quality local filters OR go whitelist as tyiell has.

[ajbritton]

Thanks Tom, that's exactly what I thought. I was hoping to get confirmation from someone who has been there and done it. The only doubt I had was that I was unsure if a local proxy was able to link to an upstream proxy. I'm still not 100% clear on how SSL traffic is proxied unless the proxy just acts as some kind of router, passing packets between the client and server. Do you know of any good explanations on the net?

 

Just found this (Tunneling SSL Through a WWW Proxy) which seems to explain it. I cannot see any reason in principle why there could not be a chain of proxies, each one sends the CONNECT message on to the next in order to prepare for the connection. Once all proxies are 'alerted', then the client can set up the TLS connection and all the proxies would presumably just pass it through. Indeed, the line

 

This specification applies also to proxy servers talking to other proxy servers. As an example, double firewalls make this necessary. In this case, the inner proxy is simply considered a client with respect to the outer proxy.

 

suggests that this would work. This would mean that the filtering could be applied at each proxy. Any reason why this would not work?

Edited April 30, 2010 by ajbritton

[tom_newton]

Andy,

 

You're correct about how simple proxies can "see" HTTPS domains using the parameter to CONNECT.

If you were using an upstream p[roxy it would also be able to see this, but only if that upstrem proxy was also a "traditional" proxy. If your existing proxy (which you intend to make your upstream proxy) is transparent, then the new proxy will not have an upstream proxy set, but will be requesting pages through the transparent upstream proxy, which *still* won't see the HTTPS domain.

 

To rephrase: If you have a proxy which isn't presently seeing the domain, then no amount of downstream proxying will help (in the general case).

 

Edge case: You may be able to use a transparent intercepting HTTPS proxy to achieve this. The only proxy of this type I am aware of is in our development lab

 

Edit: Feel free to call me if you want to discuss this further - maybe I am misunderstanding what you need and are trying to achieve. Happy to talk "non SmoothWall" proxy stuff, as I am sure others will testify

[ajbritton]

Many thanks Tom. To be honest, there is no particular problem I'm trying to solve other than just trying to understand what is and isn't possible. I'll PM you with more details rather than hijack this thread any more.

[pap]

as said previously on this thread you can filter by IP address where PCs are identified for staff use only.

You can also alter filtering by time slot, if you want to allow access during a training day for example.

If you move to full use of LGfL USO (which does not have a cost) an additional service (which does have a cost) is per user level filtering, but i know, because i have one school working on this, that it is not fully developed yet. I use this solution for the filtering on the laptops for looked after children, and i am able to have 6 different profiles.