Hi guys

i have been charged with the task of implementing a proxy server on a company
network to allow management to monitor staff internet usage (i have already explained to them that by law they have to divulge this information to their staff)

The network isnt too big, a windows server 2008r2 and about 15 client pc's running win 7 / xp (phasing out the xp machines at the moment)

i need to have the following functionality:

1) indicate which sites are being accessed on a user by user basis
2) What times the sites were accessed (activity counter would be nice)
3) maybe some kind of white list/blacklist where i can block traffic to a particular site if the need arises.

I have read in a book im reading about squid...but have never installed it or used it...

i know about untangle and have wondered if any of you have used it, think its good, or have another suggestion.

im thinking about using an older pc with two network cards, one to the internet, and one to my internal network as to capture / monitor all connections going out to the net.

any thoughts or ideas appreciated

I've used squid for many years along with SARG to analyse the log files. SARG produces reports by user, site and access times along with traffic volumes. You'll need to setup the clients to access the internet via the proxy server. If your clients are connected to a windows domain then group policy can do that or you could setup a transparent proxy server to force the traffic through the proxy. I've used Shorewall to configure iptables to do this.

If you have only 20 PCs you could probably get away with just scripting up iptables with a shell, and klogd to do the actual logging

hi darren,

yes i would like to learn and use iptables more...so do i just have my traffic running through a linux box and configure iptables to report back etc...is there a preferred distro i should use for this purpose, or doesnt it matter (Slackware???)

thanks

perhaps BSD-based pfsense?

pfsense looks interesting...reading

Some points to keep in mind. if you use a device inline you will need to make sure it can fail open so in the event of an issue traffic can still make it out to the internet. The downfall of course people will now access sites they shouldn't.

As for untangle I think it is really good. especially for a small office. Dansguardian is another that I have heard of but I really have not used it for web filtering.

Also when reading it sounds like you are wanting a web filter more than a proxy servers.

On a side note most Security Policies cover the monitoring aspect which is in I believe the Accptable use policy.