Too many proxies

[Ric_]

I use ISA server as a firewall/proxy. This works very well and allows me to do all my wonderful publishing stuff and basic web filtering (using squidguard lists imported via a script I acquired).

 

My current problem though, is the number of children that would rather play games than do work. It is really getting out of hand and staff are not clamping down on it, despite SLT telling them to.

 

My excellent idea was to insert Dansguardian into the mix so that some proper filtering could be performed. A nice quick and dirty solution was Endian Firewall.

 

After some tinkering, I found that the best way to do this was to set it up so that any requests went:

Client -> ISA -> Endian (sitting behind ISA) -> RBC Proxy (All Endian traffic passes straight through ISA)

 

This worked very well but has slowed the Internet traffic to a crawl and causes any SSL traffic to timeout. I have had to take the Endian box down and need a better way of doing this ASAP.

 

If only MS would open up their APIs for ISA filters then some kind soul could integrate Dansguardian into ISA and I would have the perfect product.

[GrumbleDook]

I am seriously looking at doing whitelist only for some classes ... I am also going to cough up for AB Tutor control now ... and instruct staff on how to manage a class in an ICT suite ... and if they fail to do so they do not get to book the room again.

 

I am off today but for the rest of this week I will be in the assemblies having a little one-way conversation with each year group. "Play games or go on chat sites or try to bypass out filtering and you will be restricted to email for a max of 2 hours a day and a specific list of educational websites!"

 

After deleting nearly 3 Gig of flash files I am now finding that students are bringing .swf files in on memory stick and building their own websites internally ... and hiding them inside of their ICT or Media work ...

[Geoff]

If your going to put a Squid/Dansguardian machine into the mix doesn't that make ISA rather redundant?

[localzuk]

Indeed, I would go for a Squid/Dansguardian machine instead of the ISA (and intend to do this at my school asap).

[Ric_]

If your going to put a Squid/Dansguardian machine into the mix doesn't that make ISA rather redundant?

 

ISA is VERY flexible as a firewall.... allowing quite complicated publishing rules.

 

All I want Dansguardian for is to look at content and go "No... I'm not letting you look at that."

[Geoff]

ISA is VERY flexible as a firewall.

 

Linux is more flexible. Have a look at Shorewall if you want an 'easy' way to configure it.

 

http://www.shorewall.net/

 

All I want Dansguardian for is to look at content and go "No... I'm not letting you look at that."

 

Perfectly possible. On the presumption that ISA is doing the right thing:

 

1) Speed, I suspect you don't have decent enough hardware. What are you running Dansguardian on? Are you using the AV scanning?

 

2) SSL timeouts. Probably down to a misconfiguration in the Squid rules. Please post the relevant sections of your Squid.conf

[tom_newton]

If anyone has any interesting proxy sites that are causing them trouble, I am researching the software used in these so SmoothWall can have a better chance of blocking them. We already know about phproxy & cgiproxy as common ones... but what about the rest?

 

Tom

[plexer]

I would take your endian cd and throw it as far away as yo ucan or failing that set fire to it.

 

Then get something like School Guardian or Corporate Guardian instead.

 

Ben

[Ric_]

I would take your endian cd and throw it as far away as yo ucan or failing that set fire to it.

 

Then get something like School Guardian or Corporate Guardian instead.

 

Like I said... I wanted a quick and dirty proof of concept which meant spending as little as possible (i.e. nothing).

 

I suspected that it might be hardware related (being a PIII with a mere 256MB RAM) but the utilisation statistics don't back this up.

 

BTW - I am looking into building my own box just for Dansguardian stuff. This should gety rid of all the gumpf from a distro. In the meantime I need to just get (Not so)SmartFilter up and running.

[Geoff]

I suspected that it might be hardware related (being a PIII with a mere 256MB RAM) but the utilisation statistics don't back this up.

 

Yes that's exactly why. You need better hardware. I'm using a P4 2.5Ghz Celeron with 1.5Gb of ram here.

[apeo]

BTW - I am looking into building my own box just for Dansguardian stuff. This should gety rid of all the gumpf from a distro. In the meantime I need to just get (Not so)SmartFilter up and running.

 

If and when you get round to could you tell us/me how you did it as im in the middle of it right now and its going slow.

[Ric_]

@apeo: There is a Debian package and a special GUI script knocking about for Ubuntu. There is also a webmin module.

 

In the meantime, I have b0rked the firewall service on my ISA box! God only knows how I have done this! Will have to wait until tomorrow since the b0rkage means I cannot remote in

[PiqueABoo]

If only MS would open up their APIs for ISA filters

 

They did.

[Ric_]

If only MS would open up their APIs for ISA filters

 

They did.

 

That's me told! Now we just need Dan to do the other bit

[ChrisH]

Yeah but Dan works with Tom :/

[Ric_]

Yeah but Dan works with Tom :/

 

I'm sure he'll happy go home and re-write everything for a bit of fun

[GrumbleDook]

The scary thing is ... Dan is that sort of person from what i have heard ...

[tom_newton]

Actually it's more "Tom works with Dan"

Daniel is our Technical director, and he used to hack a hell of a lot of Guardian code - 99.9% of which has been contributed back as GPL. Today, however, poor ol' Dan is too busy with being a director/manager, and most of the Guardian stuff is handled by his team, headed up by Philip, whom some of you will have met at the edugeek conference. There's still a lot of work going on, and our commercial ops still pay for GPL development, although there are many helpful "community" members.

 

I know we have no plans to support ISA - this is like turkeys inventing new basting methods - no-one here would touch ISA with a crooked stick However if you join the DG mailing list, you never know who might help you out.

 

Habving said that, I think that Schoolguardian is superior to ISA + anything else ;-P