ReBoot

I've got a couple of these in my school - nice to hear from someone else still using them ! Most recent failures I've experienced are bad RAM - the RAM must get hot in these systems as above 4GB you need a special memory cooler. Also had one motherboard fail. Have you checked the status LEDs on the front bezel - these give quite allot of info on where things have gone wrong. Manuals still available on the web. As the RAID array was howing as optimal this suggests your controller is OK. I run Unbuntu on mine and a Samba4 DC. I keep 2 spare motherboards, 2 PSUs and a complete spare chassis to make sure I can keep running. Luckily most parts are still available with a visit to ebay and are not expensive.

I've got a few of these with older processors. Run Win7 satisfactorily and performance can be improved with a cheap SSD and more RAM. Only thing I don't like with allot of RMs is that they are not easy to take apart and work on - would have thought this a key requirement when designing for schools.

I think I have read that when a number of schools use the same public IP addresses - as is the case when using a typical LEA service - there are issues with some Apple services/products. Can't remember the details but have a search around the forums. Ideally you need your own static public IP.

Our county service apparently is intercepting Google secure searches but I can go to bing and do a secure search with no intercept. Google probably is the most widely used search engine for Schools but I can't see how this really makes much sense if we are really trying to lock things down.

Sounds like you have your old site hosted internally using your schools FQDN and this site includes some additional features such as the room booking system. Your new main site is now hosted externally using the same FQDN as the old internal server. I would think the simplest solution is going to be to use a different FQDN for the internal site to avoid confusion with the new external site. As you haven't given much info on your DNS setup its difficult to give you precise instructions. In my school I would do something like http://www.oldserver.schoolname.local for the internal site and http://www.school.county.sch.uk for the public one. Another option would be to use a subdomain of the existing FQDN for your internal site but this will be more complex. I assume your internal site is private to the school and not accessible from the public internet. I think in this scenario a change to the internal sites domain name is your best option.

Check your logging level in Squid is set to the appropriate level of detail (details in squid.conf). Squid logs won't break out search terms but they will obviously be embedded in the URL fetched. I'm not familiar with Sarg but as a first step you could look at the raw Squid logs just to make sure they are recording the information you are looking for. /var/log/squid3/access.log

If you look on the support forums you will see that the sign up process has been broken for months and Youtube don't appear to be doing anything about it. I signed up my school a year or more ago and have a working edufilter code. However, it still doesn't work properly as you are supposed to be able to add videos to private school playlists for use on your network but I can't get this to work. What does work is: Education homepage Non-educational videos blocked Students cannot sign in using their personal accounts Teachers can have a special account which has unrestricted access Personally I'd forget it until Youtube get their act together and fix the service and signup process. Judging by progress so far this may be some time or never.

It seems most of the SSL intercepts currently focus on Google. Given that Google already has its own SafeSearch option which can be locked onto a network this seems to be allot of effort for a relatively low risk content provider. Google is a reputable company and the SafeSearch option, while not perfect, does cut out the majority of inappropriate and explicit content. The risk from unfiltered SSL from the rest of the Internet would worry me far more than unfiltered Google SafeSearch. Do commercial filters restrict the sites where SSL can be used ?

At the end of the day it will be the SMT and Governors who make the call on this - I can only provide them with the available options and advise on relative strengths weaknesses. At the moment I have the LEA and home grown solutions both available for comparison on our network. Performance on the Spitfire connection is very good - having the caching proxy local rather than remote is a definite advantage. We have had one incident so far and this was common to both filters (LEA and home grown) Since we have taken responsibility for our own filtering there is better staff awareness and more vigilance monitoring internet useage. The tendency is to forget it when someone esle looks after it for you. No perfect solution but the 2.5K annual saving we could make has the potential to make a big difference to our ICT provision. Broadband is one of the the biggest single components of the ICT budget.

On SLAs and contention. Spitfire are a business class ISP who offer exceptional value for money. There is no such thing as uncontended FTTC as everyone is using the same BT product in the access network. Contention, SLAs and fix times are all down to the BT Wholesale product specification. Obviously there may be differences in the core network but the access network is often the critcal component. There are uncontended EFM (Ethernet in the First Mile) products but this is not FTTC and would cost significantly more than 2-3K for a filtered service. I take the points about on-site support and technician availability. For reference here are the BT Wholesale products I refer to. BT Wholesale Broadband Connect (WBC) This is the standard FTTC service costing tens of pounds a month – typically £50/month for business. BT Wholesale Etherway Superfast (GEA) This uses FTTC to the premises and a dedicated Ethernet backhaul circuit and costs hundreds of pounds a month – typically around £200/month.

Someone should talk to Google. They were concerned about the privacy of searches using the noSSL option. Now most insitutions are employing SSL intercept so searches are still not private, they are encouraging wider use of SSL intercept technology which can't be a good thing for the internet and wasting a great deal of time and money for all concerned. Seems like a lose/lose outcome for Google and the educational community.

I've been looking into reducing the cost of our broadband. We are trialling an unlimited 80/20 Business FTTC service from Spitfire which costs £31 + £10 line rental (this is all on their website). For filtering I have two in house solutions working. Squid with Dansguardian, using the Shalla Backlists, and the Quinto Labs proxy from diladele.com (this does SSL bump and AD integration nicely). Both of these run on HP Microservers, Dansguardian on an N34L with 8GB RAM and Diladele on a Gen 8 with 16GB. Incidentally the base Gen 8 Microserver is available from Ebuyer with cashback for under £150. You can easily build the whole appliance for less than £400. If I get filtered FTTC from my LEA this costs in excess of £3K. As I understand it this uses exactly the same BT Wholesale Broadband Connect (WBC) that I get from Spitfire. So we are paying over 2K annually for web filtering - this seems a bit expensive to me but appears to be the industry norm. To a small primary this will be a significant proportion of the ICT budget. Any views on whether we get value for money.

Thanks for all the helpful answers. I have already contacted them to clarify exactly what they are doing. Would have been helpful if they had volunteered the information before rolling the changes out. Seems a major amount of effort to accommodate one search provider.

My local LEA are upgrading there web filters to provide SSL intercept in response to Googles decision for force all searches over a secure connection. The only information schools have been given are instructions on installing the additional client certificates required. I don't think most schools will even realise what's happening. Wondered how other schools handle this. I think staff should at least be informed of the intercept and acceptable use policies should also cover its use. Does the use of SSL intercept break the T&Cs for some online services ? Say your bursar uses online banking and doesn't realise they don't have an secure end to end connection to the bank are they breaking the T&Cs for online banking ?

If you use Suffolk County for your broadband (E2BN) you will be using the E2Guardian web filter and proxy. The proxy is Squid and the web filter is a variant of Dansguardian. I suspect the proxy will be a caching system. These systems will be off-site and managed centrally for Suffolk schools. As of mid January they are introducing a system capable of filtering SSL connections - I don't know what technical changes this will involve.

I guess this might work. You will need to ensure your transparent proxy is set up with a cache_peer for the upstream proxy or squid is going to assume its connected directly to the internet and not behind a proxy. Squid can accept traffic from different subnets using the ACLs in squid.conf. How you get the traffic forwarded to the squid box is another matter. Setting the DGW on a L3 switch is one approach. You could have multiple NICs on the squid box connected to your VLANs or maybe a single trunked port with multiple logical interfaces. I might investigate how the proxy settings could be configured on your non-compliant devices before going to all this trouble !

Sorry didn't read carefully enough. I don't think squid will do what you require. You need something to intercept packets from the tablets and redirect them to your LEA proxy. You will need packet forwarding enabled on your unbuntu box and then something to configure IP Tables such as Shorewall to setup the rules for interception and redirection of http traffic.

You will need something to intercept packets and redirect them to Squid to make a Transparent Proxy - I use Shorewall rules to do this. I don't believe Squid on its own will do the packet interception. General consensus is to make a non-transparent proxy intitially - get it working - then make it transparent. Good luck.

I guess I would check your squid acls against ports required by Apple TV. Also is there a firewall running on the squid box - again make sure its open for any protocol/ports required. Is this a transparent proxy and what OS is it running on. May also be worth looking at the Squid access log /var/log/squid3/access.log From Apple support. These network ports are used by Apple TV for communications on your network. •TCP port 123 is used to communicate with a network time server. •TCP port 3689 is used to communicate with iTunes while using the iTunes Library Sharing feature. •UDP port 5353 is used by Apple TV for automatically finding computers with iTunes on your network using Bonjour. •TCP port 80 is used for communicating with podcast servers. •TCP port 80 and 443 are used for basic and secure communications with the iTunes Store via the Internet. •TCP port 53 is used for regular DNS. These are well-known ports used by Apple products, like iTunes. If you can use all the features of iTunes, these ports are likely already open on your firewall or NAT router. Note: These ports may also used by other services such as YouTube and Flickr.

I don't think it can be any worse than our current configuration. We use AVG without the management console so I think every workstation is downloading updates independently. As I understand it Panda Cloud uses peer to peer networking between end points to distribute updates. I wouldn't have thought the control traffic would be that bandwidth hungry. We have FTTC running at close to 80/20 and 60 workstations.

I must admit I have been impressed with the value and function of Panda Cloud and its definitely on my short list. I'm not sure a cuddly bear is best logo for Anti Virus software but I guess I'll get used to it !

I'm taking a look at Cloud AV for my school. Sophos is unusual in that its user based rather than device based. You build policies that apply to users not computers and this means the cloud platform needs information on your users and groups. This is fundamentally different to say Panda Cloud and GFI Cloud which are device based and you build policies which apply to end points. As end point discovery is automatic during the agent install this is much quicker to setup. Panda Cloud is very good value the only thing it won't do is a scan on insertion for USB devices. GFI is more expensive and does include this functionality. I have also tried a trial of VIPRE business but as I don't have a Windows server available for the console and VSS service I decided not to go down this route. Also ended up with a support ticket for problems with the agent install which didn't inspire me with confidence.

I would get an HP Microserver available at £100 with current cashback offer. Add your disks and install OpenFiler - I prefer OpenFiler to FreeNAS although its a bit more tricky to setup. I wouldn't buy Netgear - currently using one of these and the perfromance is not that good.

Not an expert on iptables. You might find it easier to use shorewall to configure and manage iptables. Thats what I did on my Ubuntu/Squid server. Bit easier to see whats going on.

Here are a few things I would check. First make sure your new subnet is reachable from the Cisco router. Use "show ip route" and make sure your new subnet is in the routing table. If its not there you may need to add a static route. I don't know where and if there is NAT in your network but if the Cisco is doing it you may need to change the rules on which subnets get NATed to include your new subnet. As you have an upstream proxy server you will need to verify with RM that this will accept direct requests from your local subnets as it may be restricted to the downstream proxy server. If you are working on Linux as a routing box I would use shorewall as it makes rule generation and management much easier.