TOR

[oxide54]

Anyone got any good info on blocking TOR?

 

given its potential uses for photographic and video content as well substance supply i would think it would probably be prudent to block.

[grant_girdwood]

Anyone got any good info on blocking TOR?

 

given its potential uses for photographic and video content as well substance supply i would think it would probably be prudent to block.

 

Blocking IP address based URLs will sort this for you.

[synaesthesia]

Your only real option is to use DNS blocking from a decent TOR blacklist. Much of the idea of TOR is to make it difficult to block in the first place so it's not particularly an easy thing to do. Those blacklists are certainly not a 100% solution for that very reason, they hosts will obviously change constantly.

[FN-GM]

You could block .exe using group policy.

[oxide54]

You could block .exe using group policy.

 

doesn't really help with BYOD

[FN-GM]

doesn't really help with BYOD

 

No it wouldn't

 

This is one reason i wouldnt allow internet on BYOD. If you want it go via a RDS / Terminal Server session

[DrCheese]

No it wouldn't

 

This is one reason i wouldnt allow internet on BYOD. If you want it go via a RDS / Terminal Server session

 

Which would be totally useless on smartphones/tablets

[ihaveaproblem]

Not to sure what this is, but could you block the ports on your firewall?

Or is it using standard ports?

 

I guess it's one of those things which would be covered under your AUP for BYOD, and if anyone got caught using it then appropriate actions taken against them.

[synaesthesia]

(Sorry, I was assuming you wanted to block people from accessing resources on TOR clients - if you want to stop people using TOR clients from in school then yes, proper .exe policies...)

[FN-GM]

Which would be totally useless on smartphones/tablets

 

No it wouldn't...... Worked find in the last place

[ihaveaproblem]

No it wouldn't...... Worked find in the last place

 

How did it work?

I'd expect it to be quite clunky on a phone and not a very appealing experience.

[FN-GM]

How did it work?

I'd expect it to be quite clunky on a phone and not a very appealing experience.

 

Using Citirix Xen App, they use it allot on tablets. Not on phones though, due to the contracted phones they had.

[oxide54]

No it wouldn't

 

This is one reason i wouldnt allow internet on BYOD. If you want it go via a RDS / Terminal Server session

 

thats a good option as it, does afford you a lot of control.

 

down sides are cost, interms of licensing / server hardware. Depends on your current setup/use of TS

[FN-GM]

thats a good option as it, does afford you a lot of control.

 

down sides are cost, interms of licensing / server hardware. Depends on your current setup/use of TS

 

As you say it depends on cost. At our place we already have allot of it in place so wont cost a massive amount to setup.

[Arthur]

doesn't really help with BYOD

Palo Alto firewalls are meant to be able to block Tor.

 

http://i.imgur.com/uryAF.png

[oxide54]

any idea how much they cost?

 

saw a demo of one, (not in much detail tho) they did look nice.

[Arthur]

Based on what @gshaw said in this thread, I think they start from around £2,100.

 

I believe @Net-Ctrl are a Palo Alto reseller too?

[mavhc]

Transparent proxy everything for BYOD/unmanaged devices, and log it all

[gshaw]

Based on what @gshaw said in this thread, I think they start from around £2,100.

 

I believe @Net-Ctrl are a Palo Alto reseller too?

 

Yup was around that figure for the smaller box (PA500), Net Ctrl signed up for Palo just after we bought ours but if I was getting one now I'd speak to them

[dwhyte85]

Tor is easy to stop, ensure you can't change proxy settings... it requires on the bundles that you redirect to localhost 9050, it can be changed but a simple way to stop it is to just ensure no proxy changes on local machines or deny 9050 locally (netsh to a scary logged proxy!).

 

All the scary pages have the TLD .onion - it's pretty easy to stop this.