Slashdot Mirror
Whitelisting Websites with Windows?
Nimey asks: "I support two computers which need Internet access to one website; they also are used to drive scientific instruments and so have proprietary scientific data. They run Windows XP SP2 because the instrument software requires IE, an ActiveX control, and .NET 1.1. Both machines are in a Windows 2003 active directory. Because of policy, it's not possible to redirect their network traffic to another box for filtering, but they are NATed. I want to restrict their network access to that one website (HTTP/HTTPS, possibly FTP) and to the file servers on the network (SMB). Can I enforce this in a way that's not changeable by a user?"
Editing system32/drivers/etc/hosts should do what you want. Direct everything (except windows update, maybe nist) to that one site.
In the TCP/IP properties of the netowkr adapter they use, select Advanced -> Options -> TCP/IP filter. "Allow only" the IP addresses you want. Maybe it's not a flexible solution (OK... without "maybe") but it's a simplistic IP filter that will get your particular job done. HTH
Global warming is a cube.
I'd look at doing at the network infrastructure level. They're connected to network hardware of some kind. If you have some kind of router on their subnet manages the traffic, start setting up filtering rules. You said something about "not being allowed to intercept their traffic with another box," but the network itself has to have some infrastructure in it, so you should have an option there.
Use it.
I just wish I could get a job supporting two computers.
IE has a built in content filter that accepts wildcards. Turn it on, Click on tools, go to options. click on the restricted sites tab. and add a wildcard * and click never. Then add the one site you want to have people go to click Allways. Under general youll probably also want to disable Supervisors can enter a password to see site (it makes users less cranky thinking someone else is allowed, but not them.
when you close the dialouge box - it will ask for a password, and your done.
Microsoft has released a shared computer toolkit for places like labs and librarys that has some neat tools - including a good one to restrict access to only certain applictaion. you may wish to look into that as well
The same kind of person that wants to 'reverse engineer' it. The .NET Reflector by Lutz Roeder will most likely tear it apart. Especially for case #2.
Now now, most people don't know that Windows actually does have a HOSTS file and that you can use it to restrict access. Most of them probably think that way because *NIX users train them to ignore their roots. Shame on you!
While there's a great deal of truth to what you're saying, reality often slaps theory in the face. My guess would be that there is no qualified support, there's no money (or no management desire) to hire qualified support, and someone who has an inkling of a clue about computers gets the responsibility dropped in their lap with no real option to say "No". It's not their fault and there's often not much they can do except struggle through and do the best they can. (And, of course, I know some pretty savy people who started out just that way a decade or so ago.)
"The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.
Comment removed based on user account deletion
I've tried using the 'c:/Windows/System32/drivers/etc/hosts' file, but that doesn't work like it does in *NIX. Actually, it doesn't work at ALL in XP.
Comment removed based on user account deletion
So the selling point is that although this scientific software does not ship with source code, purchasers can spend months reverse engineering and modifying it to fit their needs? The world of beauty therepy will never be the same again.
It sounds like your concern is that people using the equipment will surf the web inappropriately, potentially compromising the machine and losing valuable data.
How about making a 3x5 sign and tape it on the machine that lets them know that their web surfing is being monitored and if they fiddle with the machine to go anywhere else, they'll be fired. Periodically audit the weblogs at your firewall and see if anyone at that device is doing anything.
I run into this problem all the time. People ask for some security measure when it's easier to simply make and enforce a policy. I work with medical records and the question is always "how do you keep people from looking at records inappropriately?" The thing is, if there's any false positive and the information isn't easily available, someone could die. So we audit. Lots and lots of auditing. And fire people when they're idiots.
Actually, it doesn't take months, just moments. You have to give credit to impulse management decisions. ;)
If you be come their DNS resolver then you have control over any site they want to visit. Just turn everything except what they need to null.
Use the firewall built-in Windows, it does pretty much everything you need.t m
Instructions here: http://homepages.wmich.edu/~mchugha/w2kfirewall.h
There are no atheists when recovering from tape backup.
Comment removed based on user account deletion
What about if the code has been obfuscated prior to assembly? I'm not well up on MSIL but do all the companies being told to move to .NET know their assemblies can be reversed engineered so trivially?
Microsoft Windows products come with an excelent website for support. Their technical team is always there for you and will help you solve all your problems with their product. However, if you still have unsolved problems, please try Windows Live OneCare.
Considering the submitter says the computers "also are used to drive scientific instruments", it would be a reasonable assumption that what s/he really supports is the instruments, and the computers are just peripheral.
Privoxy. Install, set whitelist and restart. Done. All for free.
Skeptic and Reason
Read the summary again - he's using the computers for scientific *instruments*, not software. When you buy highly specialized (and expensive) equipment there's often no choice in what software you use to drive it.
Sure. Set the homepage to your site and then prevent users from changing that setting. As long as you don't have any external links and lock IE down with policies, you're ok. You'll also need to prevent users from accessing the command line and explorer. Everything would have to be driven by what icons you place on the desktop and start menu. You should google around for terms such as "kiosk mode".
Set the Proxy server to a junk value.
Then add proxy exclusions for the sites that they are permitted to access.
Then lock down these settings via GPO.
Step 1, make sure that these PC's always use the same IP address. Set it statically if you can, and while you're at it, set up a DHCP reservation for their MAC addreses to give them that same address. That way if they switch it to DHCP they get the same thing. Step 2, set up a rule on your firewall for those two addresses that basically says 'allow http and https traffic from these IP addresses only if they are going to this specified address (the web site that they need)'. Put a rule immediately after that one that says 'deny all traffic from these IP addresses to any other IP addresses'. Now they should have free roam of the internal network, but only be allowed web access to that one external site. If you want to get even more paranoid, you can configure the ports on their network switch to only allow traffic from their IP addresses, in case the users get the idea of statically setting a different IP address on the same subnet than the one that you gave them. Of course, these users shouldn't have the ability to change the IP address configuration for their PCs if they aren't running as admin. You don't let them run as admin, do you? I don't believe that Windows XP has the same settings for IP security that you can put on Windows 2000 and later, otherwise that would be an option. If you really wanted to get detailed and make it secure, you could change all of the Windows Firewall settings to block everything except necessary traffic to necessary hosts, but then it gets really tedious, but I know that Windows firewall settings can be set with Group Policy.
We wanted a whitelist for IE in a 2003 domain. Note that this won't affect Firefox or other apps.
1) Go to 'Group Policy >> user config >> windows settings >> ie maintenance >> connection >> proxy settings'
2) Proxy everything to localhost
3) In the exceptions, list allowed hosts separated by semicolons. Wildcards work.
doesn't stop entering URLs with IP address instead of hostname
You might be surprised, but I found that nothing to do with Windows qualifies as "basic", despite my extensive experience with Linux/Unix..
The problem is that Windows functions and interface are just thrown together and then modified to mollify average user. Unlike Unix which is built to implement an abstraction, there is no operation in Windows that has a well-defined effect and can be automated to produce that effect again and again.
For example, if you see a file on a "Desktop" chances are you won't see it in c:/windows/desktop and even if you do a locate it sometimes still cannot be found.
If you name a file "a.txt" then it can get saved as "A.TXT".
And forget about optimization - the system call performance is hard to understand, the filesystem behaves unpredictably, heck, there are no programming languages at all on the installation disk !
At work we use a Watchguard java applet, which I don't particularly like, but it does the job as you describe. We use it to restrict users/workstations to our own websites and limited tech support sites.
To enable this access on the client PC, the user opens IE, goes to a local page that contains the applet, and enters their password in the applet. As long as that window is open in the background, they have access to the allowed sites.
I don't deal with the server end myself but I think it comes in hardware or software flavours.
If you want real security, get the NAT box to null-route anything from those machines unless it's going to one of the approved IP addresses.
You may need to get a better router to get adequate functionality, or get a WRT54GS and install OpenWRT.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
You'll need to wait for Firefox's own DNS cache to expire (takes 60 minutes by default, quicker if you change the option in about:config).
In addition ipconfig has a /flushdns option which you might need to use to force Windows in general to look up the address in HOSTS instead of the cache.
This is what happens when you hire programmers who don't know the best tool for the job. It's everywhere in the tech field today unfortunately. People design applications, not after a search of what technology is best suited, but based on what narrow area of expertise they have.
A scientific instrument or computer that controls them with proprietary data should not be connected to the internet. Period. Place a second machine with internet access in the same room, and users can transfer the data they need, if necessary, using some form of media/external drive.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Use the site firewall to restrict traffic from those machines to only go to the required sites. As for SMB, use a host based firewall, such as Symatec Client Security. SCS can be locked down through the management console.
I have a feeling you didn't look very hard. Microsoft Windows out of the box can execute scripts written in the languages corresponding to the .bat, .js, and .vbs suffixes.
As silly as this sounds, I would suggest using an IPSEC applied via Group Policy to enforce access/non-access based on port numbers and IP's. An lesser known function of the IPSEC rules is filtering. You'll want to keep in mind the policies are NOT stateful, so make sure to test your rules. Applying the IPSEC policy via Group Policy will ensure consistent re-application (in the event someone figure out how to un-apply the settings... and in that case, pull in HR/management).
Well, if they aren't administrators on the machines, then just change the routing tables. "route delete 0.0.0.0" does amazing things to limit internet access from a host. Just do a "route add" for the webserver they need to access, and they'll already have a route in their routing table that lets them talk to servers on the same local network. If the machines are pulling DHCP, this isn't going to survive reboots, of course, but if you can statically assign their IP info, just do that, but don't enter a default gateway (many people seem to errorneously believe you *have* to put something for the default gateway, which isn't true at all). Your machines will come up with the ability to talk to the local network, and nothing else. To add additional routes for 'outside' hosts, i.e. the webserver you want them to hit, you'd just set up a persistent static route so it will live across reboots: route -p add mask 255.255.255.255 Now you have a machine that can talk to local net, one outside webserver, and nothing else at all. Add additional routes for other local networks if needed.
IPCOP + AdvProxy AddOn + URLFilterAddOn
This will solve your problem only if you feel like changing your current firewall for IPCOP (OpenSource, Top choice IMHO ). You get a stateful fireall plus content filtering. If you want micromanagement capabilities you would need MS ISA (overkill for your setup)
If you decide for IPCOP then you are set for the future. You can then implement DMZ for your servers, VPN, QoS, and much more either using the builtin services or trhough addons.
The best test environment is production. - Me
chrome://browser/content/browser.xul
Most of Wikipedia is fine, but it links to lots of places that aren't fine, at least for a five year old. I'd like to restrict him to a know whitelist, but I don't want my and my wife's accounts to have the same restrictions. (We're both tired of Thomas.) In a few years, #2 son will want to look at stuff, and we'll need to loosen the whitelist for #1.
Anyone have a solution where we can have multiple filter sets for different accounts, and where the filter set can be protected from the users?
"Seven Deadly Sins? I thought it was a to-do list!"
The real questions are how much you trust your users not to mess around with the box and why you've got a policy against putting in extra firewall boxes if you need them. The answer may be to get better management
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The moron facing a monopoly market. It's not like you can just go to SourceForge and download a driver for some highly specialized scientific equipment that costs thousands of dollars that no OSS developer knows how to use....
The answer is yes, trivially. We are not telling you how because you are evil.
-I like my women like I like my tea: green-
On Windows XP, files, shortcuts, and directories appearing on your desktop will almost always be located in %userprofile%\Desktop and those appearing on all users' desktops will almost always be located in %allusersprofile%\Desktop. For most, %userprofile% expands to C:\Documents and Settings\username and %allusersprofile% expands to C:\Documents and Settings\All Users
The exceptions are the My Computer, Recycle Bin, My Documents, Internet Explorer, and My Network Places shortcuts. (maybe more?) Except for the Recycle Bin, those can be enabled/disabled on a per-user basis from the Display Properties control panel. Right-click the desktop and select properties, select the Desktop tab, and click the Customize Desktop... button. The Internet Explorer icon can also be enabled/disabled from the Internet Options control panel. There may be a hack to remove the Recycle Bin, but I don't know of one - try Google if you're interested.
On Windows 98, C:\Windows\Desktop is the desktop for the default user. If you're using an actual user account, you shouldn't expect to see your shortcuts, files, and folders there. Look in C:\Windows\Profiles\username
That's actually not a Windows problem; that's a problem with the particular program you're using. Because it's a problem with the program, you'll never see any change by upgrading to XP, or to Vista. There are plenty of programs that don't adjust your capitalization when you save a file (but maybe none that do what your program does).
Unfortunately, because Windows is not case-sensitive, if you want to change it manually, you need to change it to a completely different name first. I believe CKRename is one program that can change the capitalization for you.
Would you care to elaborate on that? I can't recall a situation I've had with FAT or NTFS volumes that I couldn't attribute to someone (myself, on occasion) just not understanding how things work.
If you can't do it from a filtering box then you can't do it in a way that the users cannot change. Anything you set up on the actual client machine could be subverted by users who had physical access to the machine since it's trivial to gain Administrator access to a machine you're actually sitting at.
Not that I'm a Windows fanboy (or, um, a scientific instrument fanboy), but considering that from the question itself we have no idea what the scientific instruments ARE, we have no way whatsoever to determine whether Windows is the right tool for the job?
HI, MY NAME IS ISAAC.
While there's a great deal of truth to what you're saying, reality often slaps theory in the face. My guess would be that there is no qualified support, there's no money (or no management desire) to hire qualified support, and someone who has an inkling of a clue about computers gets the responsibility dropped in their lap with no real option to say "No". It's not their fault and there's often not much they can do except struggle through and do the best they can. (And, of course, I know some pretty savy people who started out just that way a decade or so ago.)
Ding-ding-ding! We have a winner! There is no shame in ignorance, as long as one recognizes it and tries to do something to rectify it -- which is exactly what the poster of the article is doing.
-Mike
I'm sorry; I don't know what I was thinking!
This is usually obscure enough that nobody is even going to realize that thay can do it..
type in: ROUTE PRINT
It will show you a bunch of routes.
You want to delete the 0.0.0.0 entry.. ie ROUTE DELETE 0.0.0.0
Then add entries for all of the destinations you want to talk to..... ie ROUTE ADD 10.0.69.69 MASK 255.255.255.255 192.168.0.1 METRIC 10
Where the 10.0.69.69 is your DNS server and the 192.168.0.1 would be the inner NAT gateway.. and repeat for the rest of the boxes
If you have a nice group of machines in an IP range you can just loosen the MASK to 255.255.255.0, assuming that you trust the rest of the machines in that subnet.
Pop the commands into a startup script, or add the -p flag to make the changes persistent, and your good to go. Good Luck
Storm
Well, it is hard to figure out a good way to use it. For example, in Linux, I know that if I have plenty of free space (at least 10%) and one program writes or reads a single file you are going to access the disk in sequential mode - and get the maximum transfer rate the drive is capable of.
With NTFS the files get fragmented unless one preallocates a chunk of space before writing the file (how the hell am I supposed the size of the gzip file I am unpacking ?) and even after defragmentation some files read pretty slow as if they were doing seeks all the time.
Also, I would expect that if I create a small file, run some other program on it (quickly) and then delete the file it should never hit the disk. Yet this is not very fast.
Also when creating lots of files the directories that hold them get fragmented.. This is just bizarre.
I know a lot of scientific instruments that need minesweeper running concurrently.
AC wrote:
VBScript