[SOLVED] Dansguardian not blocking https pages.

strakalas · 11-02-2010, 08:25 AM

so do you have any suggestions (or any useful input) for implementing this network policy?

what about filtering at DNS server level - user requests come to local DNS server, which forwards valid requests to external DNS servers, and blocks all others or points them somewhere else?

acid_kewpie · 11-02-2010, 08:46 AM

that's possible, but a proper security architecture is always preferable, as that removes the need for hacks like DNS filtering.

linuxlover.chaitanya · 11-03-2010, 12:37 AM

DNS filtering is an option but if users have the access to change the DNS settings for their respective systems, it would not work. They can use any other global DNS and by pass your settings.
Our network is very small. This gives me an option to manually set everything I want. Also have a windows domain as well. So I can restrict users from changing the proxy settings for the browsers.
If you have got nothing like this and your network is big, you really need a proper security model.

strakalas · 11-04-2010, 02:49 AM

all users (5 deps x 30-50 users) are restricted winXP users so they can't change network settings. so DNS filtering would work, but if it's considered as dirty hack, it's no feasible then

there is no Windows server, so no Windows domain, but I'm about to setup Samba Domain Controler and I'll see the options to control users settings regarding proxies. would that lead to better architecture, this time?

linuxlover.chaitanya · 11-04-2010, 04:37 AM

I do not know how much control will SAMBA as PDC will give you. It surely can be used to authenticate and authorise users for network resources but windows domain controller can have better granular control over windows clients. SAMBA 4 is coming I guess. And it may have better options for it as PDC. You may want to look into it though.
It definitely will be a better network architecture than what your presently is.

acid_kewpie · 11-06-2010, 02:23 PM

Samba doesn't do group policy stuff if that's what you mean. AD does a bizarrely vast range of things, few of which are any interest of samba's. There are projects like freeipa which are pulling together this wider functionality under one name using samba and other things under the hood, but they are no where near production equivalents.

linuxlover.chaitanya · 11-07-2010, 11:09 PM

Exactly. But it still depends on the control OP wants on his resources. With windows clients windows server makes sense. GPOs can come in handy in a lot of ways. And because it is closed source, no one can expect it to come with open source with as many options as in windows. We use windows server for PDC. For us it makes sense. if OP has got no such intentions, he can happily settle down with samba.