How to block GChat....Just for the students!

[acrobson]

Hi all,

 

Does anyone know how to block Google chat for students, however leave it active for staff? I am aware of how to block GChat as a whole and leave the standard Gmail active, however my college needs to block it for the kids but not the staff (ironic, I know!)

 

I have checked out the following link, from GChat, however this just blocks it for everyone:

 

http://mail.google.com/support/bin/answer.py?answer=34330&query=disable&topic=&type=f&ctx=search

 

The problem I face is that everyone goes through the same proxy server with the same IP Address Route.

 

I have considered setting up a new scope etc that will differ between staff and students, but I just wondered if anyone had any further ideas for this.

[Geoff]

Conceptually, your proxy needs to understand the difference between 'staff' and 'students'. The obvious way to do this is with Authentication, ideally NTLM authentication because it's transparent. Then once your proxy can tell the difference, you simply tell it to block the site just for students.

 

Here, we use Squid + Dansguardian. This understands how to do the above just fine. So it's simply a case of listing the domain in the correct blacklist.

 

There is one gotcha when you start down this path though. Staff will find some cool site and want the students to look at it in a lesson. Only to find it's blocked for them.

[acrobson]

Conceptually, your proxy needs to understand the difference between 'staff' and 'students'. The obvious way to do this is with Authentication, ideally NTLM authentication because it's transparent. Then once your proxy can tell the difference, you simply tell it to block the site just for students.

 

Here, we use Squid + Dansguardian. This understands how to do the above just fine. So it's simply a case of listing the domain in the correct blacklist.

 

There is one gotcha when you start down this path though. Staff will find some cool site and want the students to look at it in a lesson. Only to find it's blocked for them.

All website filtering is controlled through the LEA, however we do use the on site ISA for major URLS that cannot wait a week for the LEA to get around to it.

 

The thing is, we don’t use any third party software, I used to use ranger, but then came BSF, we are using MS Group polices from Server 2003 AD with a separate proxy which for some reason the last NM set up on a workgroup, this will change in time, however we have more pressing matters at present.

[Geoff]

The only other way I can think of doing it is to block it on the ISA proxy, then set your staff to use the LEA proxy directly. Thus bypassing the blocking.

[acrobson]

The only other way I can think of doing it is to block it on the ISA proxy, then set your staff to use the LEA proxy directly. Thus bypassing the blocking.

The thing is, the LEA already block, the way I could think of was to send the kids down route A for the LEA where it is already blocked, however the LEA have defined that not to be used by students as it is the corporate route for employees of the LEA and therefore don't filter as harshly as they do on the standard student route.

 

It would appear either way, the staff are gonna lose it and not just there minds.

[TechMonkey]

If you know the vital url for GChat could you not send out a host file to all student machines directing this to a non-exsitent location. That way staff can get it as nothing has changed and students can't get it as they are directed into the void!

[acrobson]

If you know the vital url for GChat could you not send out a host file to all student machines directing this to a non-exsitent location. That way staff can get it as nothing has changed and students can't get it as they are directed into the void!

It's an idea. We were planning on doing that with MSN etc foer everyone. As in the near future all email accounts will be blocked except '[email protected]' as it looks more professional then 'hotmail'.

 

Thanks for that.