pete

An attempted bing search triggered the safeguarding alert in Smoothwall. The results were (predictably) blocked. I suspect (given the search engine) they were using MS Edge.

SW Monitor would benefit from a better "advanced sex ed" word list. We had a Y7 kid searching for rather advanced bedroom techniques that would require a trip to B&Q before you can get started. The SW proxy reported it as a problem in safeguarding logs, but it wasn't mentioned in SW monitor, even as a low-level event. Given how common the terms* are, I'm surprised it wasn't flagged up. (yes, the client is installed, functional and talking to the dashboard on the PC in question - I checked) *building dangerously sustainable molehills

We're running a test currently (about ~19 days in) and comparing it to eSafe. We (DSL/IT/Finance) prefer it for a couple of reasons: Alerts have context (you can see what was happening before and after the event) so it's easier to discount false positives or examine accompanying behaviour there and then (DSL and IT) Alerts are less idiotic (current incumbent reports Google auto-complete searching as "the person definitely typed this") (DSL and IT) The client is stable and uses less resources. (IT) Pricing is significantly better (IT and Finance) (note that we use Smoothwall too - YPricingMV) we do need to go through and compare alerts from eSafe and alerts from SW monitor at the end of the trial to check that things aren't being missed (by either product). We trialed Securus a few years ago and found that there was too much faffing to get it from the default config into a usable state for a paid product (signal-to-noise ratio). That and the (at that time) reliance on a version of Java that wasn't receiving security patches were deal-breakers

Headteacher uses [email protected] as their mailbox, same as everyone else. There's also a shared mailbox that they and their PA have access to for generic stuff (by which I mean mostly spam). We encourage the head to let their PA filter out anything legitimate that merits a response and pass it on. Anyone who's a significant budget holder shouldn't be the main recipient for a catchall mailbox - there's too much chance of successful spear-phishing.

Testing 1904 and it's nice, but does anyone else think the feedback (initiate task/instruction, receive aknowledgement of instruction and progress) is a bit lacking in areas? For example: Connect to server via WAC Tell it to install pending updates from WSUS and reboot afterwards Get swirly thing for ages Go into process list - see ngen.exe is thrashing CPU, so realise .Net patches are installing. A "that worked" confirmation would be nice. I do get a "RemoteException: Exception from HRESULT: 0x8024500C" whenever I load the Windows Update menu item on WAC, but that may just be a "I can't talk to the Internet for Windows Updates" whining.

cheers all, The supplied router is a Vodafone-branded Huawei 963168-something and it's hateful - either because the ISP has deployed a stupid config or (more likely, given the typos and spelling mistakes littered through the UI/event logs) it's a cheap PoS.

Does the board then support the old pens *and* the new ones, or just the new ones? (also have bomb-proof ancient boards kicking around)

I'm getting fibre this week and poking around with the router I've been sent, I want something else after I've confirmed the line works using their kit. I'm looking at Draytek Vigor, TP-Link and Billion. Is there anyone else I should consider? Need: Reliable VLAN support Regular software updates

Have you given them a shout? The info here: https://www.manageengine.com/products/service-desk/customized-domain.html suggests they don't turn on SSL for custom domains out of the box because it'll cause cert errors: Assuming ManageEngine simply add your subdomain to a cert with lots of customer subdomains on (helpdesk.school01.whatever, helpdesk.school02.whatever etc), you'd just need to point the DNS record helpdesk.yourschool.whatever to the appropriate ManageEngine domain / load balancer. If you're using DNS CAA, make sure the CA they're using can issue certificates against your domain.

Post a redacted ldap.conf for each? Does the Ubuntu 16.04 already have your inhouse CA as a trusted provider of certificates?

Can you approach it a different way? Make parents aware funding is available for the trip if they meet $criteria and that said criteria will be treated in strictest confidence and only for the purposes of securing funding? The finance dept at your school may have a good idea who's likely to be eligible. If it was a subset of students (in social housing) who'd already signed up to the trip it could be fulfilment of a contract (funding for going on the trip), provided they're OK with you passing on the details. But I can't think of a valid reason for you to send address data on several hundred students when (or even a subset, absent consent) the vast majority are unnecessary for the task and it's not really a core school function.

How old's the current system? A quick Google reveals this: Allen-Martin Conservation Ltd. » Eco System which states: (my emphasis).

We're using Sage 200 (from Civica pre-MAT). It has some annoyances (authentication backend aren't always in sync, so updated/new credentials may not work) but from a Finance and IT perspective it's better than Civica. With my "budget holder who places/authorises POs" hat on, it's a bit lacking in terms of reporting / visibility of order status. You also can't (or it's not configured to) attach supplier quotes to Purchase Requisitions as attachments. Don't underestimate how much impact the changeover will have on lead times for orders.

Yeah, this was me forgetting the default for new scan-to-email actions is "spoof the user" when it needs to be "send as the account you're supposed to use".

^ Are you using authentication on the connector PaperCut talks to on Exchange or is it a "if it comes from $papercut_server, allow the email"?

I've got local OCR working with scanning to disk, but scanning-to-email I'm seeing SendAsDeniedException in server.log. I think PaperCut's attempting to send OCR'd documents as the user (whoever@whatever), rather than the account it's supposed to use and Office 365 is saying GTFO (as it should). Documents that aren't OCR'd transmit fine (and our attachment limits in 365 are generous enough). Is anyone: Using Office 365 and having PaperCut talk to it directly via a dedicated papercut@whatever account for authentication with Office 365 Successfully sending non-OCR'd scan-to-email documents Succeeding in getting OCR'd documents delivered?

^ Yeah, we assign licenses based on membership of DomainName\Pupils and DomainName\Staff local groups so they're properly provisioned as soon as local AD syncs to Office 365 / Azure. There's some corner cases where we still need to assign manually because we only want a subset of features, but the above covers 99% of the license allocation.

Sorry, had the week off. I read through that and I'll try clearing the cert cache (already not caching or intercepting the domain). Does SW/Squid still do funky thinks with certs if HTTPS Interception/checking is turned off for a domain?

^ I'll probably give you guys a shout if I can't get SW to spit out a decent reason why. I'm leaning towards "Squid's doing something daft" at the moment (given unfiltered + https interception off also can't access the site). According to the users, it was working a couple of weeks ago and I haven't altered the configuration beyond blocking a couple of unrelated sites since then.

So, yeah....

Yeah, I had this planned for Easter hols, but it's suspended now until it's clearer a) what's broken and b) the data implications

OK, via another Smoothwall on the same RBC it's accessible, so it's something on our end (as opposed to RBC/SW) and a direct (no proxy whatsoever) connection works.

Would people using Smoothwall mind testing https://my.dynamic-learning.co.uk and posting results, because this is odd. On a phone using 4G, https://my.dynamic-learning.co.uk works correctly Via Smoothwall (filtered or unfiltered, HTTPS interception or no HTTPS interception) it doesn't. The policy tester in SW falls over with a generic "internal error during SSL handshake" error. Downforeveryoneorjustme.com says the site's down. Google's page speed test can talk to it without any issues. Their server config looks correct (via SSLLabs) and they're not using HSTS. The error message we get internally appears to relate to HTTPS (secure connection failed), but testing clients here (https://www.ssllabs.com/ssltest/viewMyClient.html) we're clean. Internal DNS returns the same IP address for the server as external DNS does, so we're hitting the same load-balancer/server. Results are similar across all browsers

Given the increased efficiency, boosted morale and reduced eyestrain, the extra monitors quickly pay for themselves.

Dual 24" in Finance, mounted on adjustable arms or laptop + 24" monitor on an arm.