Restricting access to intranet page

[JPS]

Hi guys

 

Pretty simple one I think, I have created a staff intranet page which I intend on making their homepage. I am fine with all that part. What I want to do is ensure that students cannot access that site.

 

I figure that I could just add it as a blacklisted URL in the filter for students, but wondered if there was another way, somewhere in windows, perhaps Group Policy or some security setting in IIS.

 

Apologies for sounding pretty clueless. Any suggestions would be appreciated.

 

Thanks

[glennda]

I have it setup that they can't bypass proxy for local addresses. and then for students don't have an exception for http://staffintraneturl which then the proxy tries to forward to our lea which gives an error.

 

simple but effective

[limbo]

This is possible in IIS, you can assign permissions to a particular folder in IIS as you would a shared folder on the server. You can then either ask for the user to enter a username and password or use the windows login information (neatest).

 

How you do it depends on the version of IIS you are using.

 

EDIT: This is a guide for IIS5.0 and IIS6.0 - step 8 is where you can choose the different authentication types, Integrated Windows Authenticated is the most seemless and secure on an intranet. http://www.hosting.com/support/dedicated/IIS/passwordprotect

Edited January 18, 2011 by limbo
add more info

[JPS]

Thats great @limbo. Bit annoyed with myself for not working that out, as it wasn't beyond my abilities. Anyway, I now have a lovely (in my opinion) staff intranet page accessible by staff but not students. Now I just have to explain to my prehistoric head that its a good idea!

 

One happy edugeeker!

[qcomer]

JPS - did you end up setting permissions in IIS?

 

I love IIS to be honest. I have our ITS support page to allow all traffic but then I have a knowledge base /kb that uses digest authentication. Works great! I then set the permissions to only allow our ITS Staff to access the KB.

[limbo]

Our whole website / learning platform / MLE works like this - lets us have single sign on for everything synch'ed in with the domain so a password change / new user is no drama at all.

[JPS]

JPS - did you end up setting permissions in IIS?

 

Yeh I just disabled annonymous access and used windows authentication. Then set student users as deny access on the permissions of the folder on my server where the intranet files reside.

[chrisbrown]

I have it setup that they can't bypass proxy for local addresses. and then for students don't have an exception for http://staffintraneturl which then the proxy tries to forward to our lea which gives an error.

 

simple but effective

 

I agree that it's simple, but I don't think it's effective. What happens when a student removes their proxy configuration? What happens when a student connects a foreign device that doesn't get your GPOs applied? They can then access this website.

 

The only "effective" method is to apply permissions on the site in a deny all, allow few approach.