Something I've been working on

[TheMan100]

Hi Guys,

I've been working on this project for approximately 2 months now; NetBlocker. It's basically a network/classroom management tool which allows administrators/staff to block internet access to groups of computers (such as rooms) and to individual accounts, it also makes use of Active Directory to easily allow you to import the computer groups based on your already existing OUs. You also have the option to modify groups, create your own groups, create exempt lists etc. When blocking users/groups, you can either permanently block them, or set a time at which they'll automatically be unblocked. The software will be free of charge, and is aimed as schools/organisations who can't afford to buy the well-known network/classroom management tools, it's not aimed at replacing what already exists. I've also tried to make sure that it's as easy as possible to setup, deploy and remove from computers.

 

This is only a brief post describing the software, I will provide more information nearer to the release (hopefully within a month).

Screenshot of the administration tool (there's also a separate tool which can be deployed to staff, which is a basic version of the administration tool):

http://i56.tinypic.com/2556zwm.png

 

If you have any suggestions/queries post them here, or send me a pm

Thanks,

TheMan100

[witch]

Sounds VERY interesting!

[Blue_Cookeh]

How's it blocking the internet access?

[TheMan100]

How's it blocking the internet access?

 

Good question .

To put it simply, there'll be a 'client' service running on the computer in question, that will find what group the computer is in, and will then check the status of that group at a set interval. If the group (or user) is flagged as being blocked, the client service will block ports 80 and 443, and will force the user to use a non-existent proxy.

[featured_spectre]

blocking port 80 and 443 wont do much...port 8080, 8081 do the same job as those 2 and if 80 and 443 are blocked, most (if not all since W7) machines default to the next available ports for surfing

 

You would need to blanket block all ports except TCP and UDP

 

However the proxy is a different issue, how is it doing this to a live user?

[TheMan100]

blocking port 80 and 443 wont do much...port 8080, 8081 do the same job as those 2 and if 80 and 443 are blocked, most (if not all since W7) machines default to the next available ports for surfing

 

You would need to blanket block all ports except TCP and UDP

 

However the proxy is a different issue, how is it doing this to a live user?

 

Thanks for bringing that to my attention I'm still not sure as to if it's even worth blocking the ports, as I would've thought that redirecting the user to a non-existent proxy would be enough. But when I've been testing it, when port 80 and 443 were blocked, it didn't try to access the site on another port, and consequently didn't load.

 

I'm not quite sure what you mean by a live user, I'm guessing you're on about when a user is actually using the computer? Well, when the service detects that the user/group has been flagged as 'blocked', a copy of that user's proxy settings will be stored locally (this is so if the user/group is unblocked during the same session, the settings will be restored without having to have the user log back in and out). The user's proxy settings (stored in the registry), will then be overwritten with a non existent proxy server. The user's browsing session will then be killed.

[featured_spectre]

By a live user I mean if someone is browsing and then it is decided to block access, how will it do it then? By the way you have it, they could leave their browser open and have no issues, so you would need some way of remote killing iexplore.exe or firefox.exe or whatever at the same time the button is clicked for the access to the internet to be blocked.

[TheMan100]

By a live user I mean if someone is browsing and then it is decided to block access, how will it do it then? By the way you have it, they could leave their browser open and have no issues, so you would need some way of remote killing iexplore.exe or firefox.exe or whatever at the same time the button is clicked for the access to the internet to be blocked.

 

Yes, iexplore.exe along with various other well-known browser processor names will be killed at the time the block is 'processed' by the service.

[CyberNerd]

Sounds like a fantastic idea - but why not do all the processing on the proxy server itself? this way you don't need to worry about; the browser type, operating system, whether you have admin rights on the device or even writing a client side application at all.

[TheMan100]

Sounds like a fantastic idea - but why not do all the processing on the proxy server itself? this way you don't need to worry about; the browser type, operating system, whether you have admin rights on the device or even writing a client side application at all.

 

Yeah, that would be a better way of doing it, but I wouldn't have a clue where to start. I'm guessing I'd need some sort of API to the application running the proxy, in order to process it on the proxy.

 

Thanks for the suggestion though

[CyberNerd]

Yeah, that would be a better way of doing it, but I wouldn't have a clue where to start. I'm guessing I'd need some sort of API to the application running the proxy, in order to process it on the proxy.

 

Thanks for the suggestion though

 

yeah - it should be quite doable and you could use the existing console panel, many proxy servers use squid (free), which has Active Directory authentication and hte config files are text files. I think you'dneed to change the ident_lookup in squid to block people from your banned user groups.

I guess the api would just be an ssh access

[TheMan100]

yeah - it should be quite doable and you could use the existing console panel, many proxy servers use squid (free), which has Active Directory authentication and hte config files are text files. I think you'dneed to change the ident_lookup in squid to block people from your banned user groups.

I guess the api would just be an ssh access

 

Okay, thanks for the information, I'll look in to it further when I have some extra free time.

[dhicks]

I wouldn't have a clue where to start. I'm guessing I'd need some sort of API to the application running the proxy, in order to process it on the proxy.

 

If you use Squid as an HTTP proxy it will pass each URL to a "helper" script for re-writing. The "API" involved is simply a bunch of URLs being written to the stdin of a script, with new the URL being written on stdout. If the script wants to allow the URL it simply returns the original URL, otherwise it returns the URL of a this-page-is-blocked page somewhere. You just need to write the rewrite script part of things. I have something part finished, if it's any help, it just needs a nice interface adding for people to add URLs to block.

[TheMan100]

If you use Squid as an HTTP proxy it will pass each URL to a "helper" script for re-writing. The "API" involved is simply a bunch of URLs being written to the stdin of a script, with new the URL being written on stdout. If the script wants to allow the URL it simply returns the original URL, otherwise it returns the URL of a this-page-is-blocked page somewhere. You just need to write the rewrite script part of things. I have something part finished, if it's any help, it just needs a nice interface adding for people to add URLs to block.

 

Sounds interesting, although I think I'm going to focus on proxy specific projects in my extra free time.

[TheMan100]

P.S I haven't forgotten about this I've just got other commitments at the moment (Battlefield 3 *cough*).

[lordasb]

how would that effect access to local sites internal to the school, e.g. vle, eportal, oliver, as to access these at our site you have to hit one of the 2 proxys to get access across the vlans.

[featured_spectre]

If it goes to a proxy that doesn't exist it will affect everything

 

If it goes to a proxy that routes internally then it should be fine.

[TheMan100]

If it goes to a proxy that doesn't exist it will affect everything

 

This is what will happen in your case Lordasb I'm afraid^.

[TheMan100]

I've started working on this again. So, a quick update:

I've been testing for bugs between different operating systems.

..Most bugs have been flattened out now.

..Just working on a few more bugs in the user blocking.

..GUI isn't appearing as expected in XP - Minor alterations required.

User friendliness is also being improved.

Instructions are currently being drafted and modified as changes are made.

[TheMan100]

UPDATE

 

This would have been finished quite a while ago if:

A.) I'd been working on it more than I have.

B.) If XP wasn't so crap.

 

I'm starting to really lose my patience with having to recode blocks of code, and troubleshoot endless amounts of problems with XP which don't occur in Windows 7. In fact, if I'm honest it runs perfectly in Windows 7... it's Windows XP that's causing me problems.

 

I will try and fix the issues with XP, but I can't promise anything. The reason I haven't decided to stop working on the project all together is because I've already spent quite a bit of time on it, so it'd be silly to stop working on it now; although, if I am unable to hunt down the issues that XP is causing or if I lose my patience completely I will still release it for Windows 7 and Vista only. But again, I am going to try and fix the issues I'm having with XP as I really wouldn't want to release it without XP support, seeing as that's what's been taking up most of my time on this project.

 

Just an update anyway.

[Ryan233]

That looks great.. I would love to try your application in one of my primary schools.

[TheMan100]

That looks great.. I would love to try your application in one of my primary schools.

 

Thank you. It's almost complete, full XP functionality has almost been achieved. I'm still testing for bugs as I go along, but apart from that it should be finished and released within a week or two.

[ZeroHour]

how would that effect access to local sites internal to the school, e.g. vle, eportal, oliver, as to access these at our site you have to hit one of the 2 proxys to get access across the vlans.

 

Internal servers would/could be fine as long as bypass for local addresses is checked.

[gerardsweeney]

This project looks VERY interesting indeed.

 

Did anything ever come of it?

 

Gerard

[MrFrostmaul]

This amazing idea dead?