Porn and Messenger blocking

We have a client that has hired us to consult and be their IT management. They have a Windows NT server, 10 workstations, Brickserver, SonicWall and ADSL. The owner of the business is wanting to monitor internet activities and block things such as porn sites, MSN Messenger, YahooPager, ICQ, etc. I was looking at the St. Bernard iPrism and it sounds like what they need and was wondering if anyone had experience with this unit and if it worked as well and the manufacturer claims it does or if there is something else that works well to monitor and block activities. The owner is also not overly concerned with cost only with what works for their needs.

I haven't worked with the software you are looking at but I can tell you that you can block most of the stuff without a big problem. Block all ports that you don't need open to keep them off of most things you don't want them on. Most of the items you mention utilize ports that you can block without a major impact on business related activity. For instance leave 21, 25, 80 and 110 open for ftp, mail and internet. The rest block incomming and outging.

For monitoring you are dad on and must use a 3rd party tool. Sorry I can't tell you much about that.

Port blocking is effective, but it may be too effective, you may find a mix of port and server blocking to be most pronounced..
for example, block AIM use by unpermitting access to the entire AOL domain, or just login.oscar.aol.com
if you just go and block every port but the standard guys, 21, 80, etc you'll end up in a situation where customer wishes to use a program like netmeeting, or VPN, and then ports have to be changed, and altered, etc...
also consider custom hosts files on each workstation, this is usually enough to thwart most endusers
example line would be,
login.oscar.aol.com 127.0.0.1
as far as monitoring goes? your best bet is a third party solution, it can be done with firewall logging and audits, but that can get out of hand really quickly
my suggestion? Implement hosts files to route common undesirables to localhost, filter out the high ports, and put blocking or redirect for entire domains...

While much of this can be done very effectively with a linux firewall, getting someone to look after such a box is not a simple task, all the time.

Something I would recommend, is a Packeteer packet shaper. The units themselves are not too cheap, but are icredibly easy to maintain, administer, and monitor whats going through it. Check them out <a href="http://www.packeteer.com" target="_blank">Here.</a>

my ISP uses Iprizm. I don't know the full details or such. I'm sure you could get info from their <a href="http://www.stargate23.com/index2.htm" target="_blank">site</a> to either read their FAQs or email or call them.

I know the guys that run the ISP and I'm sure they'd be happy to answer any questions you might have, as they are good people.

Which model sonicwall do you have, MY XPRS2 does everything you're asking for and more!......

IMHO If they have problems with employees at work using messenger/looking at porn/goofing off/etc. there are the following options:

- unplug internet access entirely
- Have HR deal with the problem in-duh-viduals
- FIRE THEM (my preference)

These kind of problems are HR PROBLEMS, not IT PROBLEMS, and HR should deal with it instead of asking the IT guys to make a feeble attempt to prevent the problem from occurring in the first place. It is very hard to block everything without turning off internet access entirely, and what is going to end up happening is that it will BE YOUR FAULT that somebody is able to do something they shouldn't, instead of the employee taking responsibility for their actions.

I guess I should clarify that, Some of the functions are included with the sonicwall, others (such as site filtering and virus protection) must be purchased seperately. I can't say i argree with ya Mac, First off a 10 workstation company probably doesnt have a dedicated HR dept. Also in small companies there are often personal relationships between employees that can have a HUGE effect on the bottom line. Rather than creating an internal scandal, IT solutions allow us to correct certain aspects of the problem at an impersonal level. Just the knowledge that they're being actively monitored is enough to keep most employees in line..... The ones that don't have a problem and need to be dealt with...... Technology now allows us to identify the offenders and offer hard evidence of their transgressions, rather than relyng on heresay as before.

The SonicWall they have is a XPRS2 model and I agree with Ahcoraj about the small office thing. If it were a large office or business, I agree with MacGyver totally. The thing about this office (it's a personel office) is it's remarkably complex for such a small outfit. They are hosting their own e-mail and web site are using a VPN for an outside office to connect from another city through dialup to the server hench the brickserver and I'm afraid if I simply start blocking ports it's going to open a new Can-O-Worms. :confused:

Thanks craigmodius, I'll check them out tonight after work. :cool:

[quote]Originally posted by Vette:
<strong>I'm afraid if I simply start blocking ports it's going to open a new Can-O-Worms</strong><hr></blockquote>This is exactly why I said what I said above, it gets to the point where you spend all your time trying to figure out how to outsmart the users and try to stay one step ahead of them, meanwhile an innocent party can't access a resource they need to do their job because you blocked one too many ports. A complete waste of your time and company money.

What really puzzles me is why this craziness seems to happen with computer related employee problems only. If somebody was calling 900 numbers from work or showed up for work late every day, they would be out the door.

A simple way to do what your talking about is to set up a proxy server. You limit your sites and ports with the proxy and use system policies to ensure people use the proxy server and not the firewall. You leave the server the way it is.

BWT, a proxy server is easy to implement. And if it goes down or doesn't work you just move people back to the firewall until you sort out the problem.

As a side note, you should do the work, map your network and applications. Find out what each application/user/machine requires and write it down. It may sound like a lot of work now but having a properly documented infrastruture will save you time and money down the road. It also makes you look good when you instantly know why something doesn't work.

Also, if your VPN connectivitiy is on the inside of the firewall, you can close all ports on the firewall except VPN and not effect your remote users. I'm not saying that this is what you should do but it's something to be aware of.

You guys don't work for Computer Tech do you?

[quote]use system policies to ensure people use the proxy server and not the firewall.<hr></blockquote>

Got any good links on how to do this on an NT 4.0 servers/ Win98 clients network?

I've been passively looking at this and haven't found a good how-to.

~thanks

You guys have given me some great ideas to try before spending the clients $$$. I have set up proxy servers before and it might just work...it's worth a shot anyway. I don't work for Computer Techs ( don't laugh now! ) I work for a one-of-a-kind Radio Shack franchise store NOT a company store.

MacGyver, my experience tells me that it's too expensive to train computer users (IE: LOOSERS)
then train them to use specific programs, then terminate them because they use dial a porn or send messages to their buddies and risk the companies liabilities. But your right if they are late 3 days in a row.......That's a different story, they are terminated..... :confused: I blame it on the ones in charge lack of knowledge on the matter.

I just updated the firmware in my XPRS2 today and there's a new feature called viewpoint, it looks like an expanded usage tracking /reporting package (haven't had a chance to test it out yet though....). As for the chat programs, I just block access to their login server in the filters and that seems to have taken care of it. Please send me a PM if you want more details, Most of what you asked in the original post can be done at no extra expense (besides time) with your exsisting hardware. I'd be glad to talk you through it.............

Like many people said I would block all the ports other than ones you need for work. Don't worry too much about people's reaction cause I doubt anyone will come comlaining their porn sites are not working or that they can't get into ICQ.

I would also use server and domain blocks cause those instant messengers are getting smarter by the day and thye use port 21 sometimes so blocking aol.com icq.com and a few others can be helpful as well.

as far as blocking porn this is by far the most difficult task of all since there are so many sites and domains out there and it's impossible to block 100% - my advise get a list of sites from a company that designed to keep kids safe online and block all these sites on your firewall. use the logs on regular basis to spot any sites often accessed that might trigger your attention and block them as well.

from experience I can tell you that it's almost futile to play police with employees - the best strategy is to use some basic security like I mentioned and monitor - employees caught using the network resources for porn or other unacceptable usage should be handled by their boss.

just my 2 cents.

[quote]Originally posted by craigmodius:
<strong>

Got any good links on how to do this on an NT 4.0 servers/ Win98 clients network?

I've been passively looking at this and haven't found a good how-to.

~thanks</strong><hr></blockquote>

I don't remember specifically but if you check the NT 4 Server Resource Kit and do a search for all of these terms "applying group policy windows 98 clients" and "internet explorer proxy" you'll find the answer.

You can also use one of my program. It's in french but it blocks quite well :)

If you want me to traduce it, I can do so.

Thanks :)

<a href="http://www.vif.com/users/yvesbeliveau/parefeu.zip" target="_blank">http://www.vif.com/users/yvesbeliveau/parefeu.zip</a>