Internet Access Control - anyone created a bespoke solution?

[dgsmith]

For quite a while, I ran a smoothwall express box with dansguardian and advproxy. The classroom control in advproxy was particularly useful, allowing teachers to logon and control internet access in their room without having to pester us.

 

We have some issues with SWE and decided to take it down over the summer until further notice although this meant losing the ability of classroom control.

 

I am wondering if anyone has created their own solution to this, maybe web-based that can somehow tie-in to AD or via their proxy server to control internet access per room/computer?

If not, what suggestions are there which could achieve this?

 

I have purposely not mentioned commercial products as it certainly isn't something we'd be looking to pay for!

[tom_newton]

What issues with smoothie? Much as i'd obviously suggest certain commercial solutions that do just as you want, i'd still rather you use smoothie express than any other thing

[dgsmith]

Well, I say issues with SWE3 as a general term but as we only used it solely for the DGAV/CRE functionality, I wouldn't suggest it was as direct result of SWE3. DG on SWE was hampered by ongoing performance issues which didn't improve when changing servers, and as the DGAV mod is well outdated now it didn't help matters.

 

I'm looking down the road of ubuntu/webmin with squid/dg though have no idea if I can make maybe say a php or asp page which can link in to the dg list of banned mac addresses (or even better, someone who knows how CRE works)!

[Gatt]

Internet Access Control - anyone created a bespoke solution?

 

Unplug the router?

[MicrodigitUK]

Try a PM to IMullings . He made a squid proxy web-based ASP front end for Internet controls for room/computer/user for Devizes school. I think he still uses it, and only issue is the GUI looks a bit dated, but it works. See if he has time to help you out.... Edited October 4, 2011 by MicrodigitUK

[dgsmith]

@Gatt, i'd also be plugging my own P45

@MDUK: Sounds pretty much what I'd be aiming for - a straightforward web front-end based around squid that does control for that. I know of Ian from his booking forms so I'd have thought he'd develop something pretty good for this!

[dhicks]

I am wondering if anyone has created their own solution to this, maybe web-based that can somehow tie-in to AD or via their proxy server to control internet access per room/computer?

 

Yes, I've written a solution based on Squid / Dansguardian that authenticates against AD to control access on a per-machine basis - just a filter script run from Dansguardian, really, although I did aim to make sure it was written properly and could have multiple users accessing it at once. The original intention was to make a handy allow-this-YouTube-clip function for teachers, so teaching staff could allow particular YouTube videos through without us having to allow pupils access to the whole of YouTube. It's not quite in a finished state, but I'm sure I could take another look at it, if you like.

[dgsmith]

Yes, I've written a solution based on Squid / Dansguardian that authenticates against AD to control access on a per-machine basis - just a filter script run from Dansguardian, really, although I did aim to make sure it was written properly and could have multiple users accessing it at once. The original intention was to make a handy allow-this-YouTube-clip function for teachers, so teaching staff could allow particular YouTube videos through without us having to allow pupils access to the whole of YouTube. It's not quite in a finished state, but I'm sure I could take another look at it, if you like.

 

Also sounds interesting - did this tie in directly with the DG filter list files? I must admit I haven't looked into how complex (or otherwise) it'd be to write script to provide a GUI to tie in with these files. I did it for the SWE3 DGAV mod after some hairpulling but not to the extent of replicating the CRE mod.

[dhicks]

did this tie in directly with the DG filter list files?

 

No, it goes through text-based lists from here:

 

URLBlacklist.com

 

...and compiles a BerkleyDB database from them using Python's built-in database hndling features to make them fast and efficiently indexable. Squid uses multiple helper script threads to handle URL filtering, so the Python code has to make sure it's thread-safe. Changes to the text files result in the BerkleyDB databases being recompiled - at the moment you simply log in to the server to edit those text files, but a simple user interface should be easy enought o add.

 

I did it for the SWE3 DGAV mod after some hairpulling but not to the extent of replicating the CRE mod.

 

Sorry, I don't know any of those acronyms.

 

Just realised: my script above didn't have anything to do with DansGuardian, it was simply a Squid redirect script:

 

Features/Redirectors - Squid Web Proxy Wiki

 

So if the URL is allowed then the redirect script simply returns the same URL that it was passed in, otherwise it returns a URL to a separate message / login page - there was also a small Python-based web server that handles dishing out the you-are-not-allowed-to-view-this-page message and handles user logins. I seem to remember user authentication was handled by simply adding the server to Active Directory with Samba and using Samba's command-line utilities to check login details.