Slashdot Mirror
Whitelisting Websites with Windows?
Nimey asks: "I support two computers which need Internet access to one website; they also are used to drive scientific instruments and so have proprietary scientific data. They run Windows XP SP2 because the instrument software requires IE, an ActiveX control, and .NET 1.1. Both machines are in a Windows 2003 active directory. Because of policy, it's not possible to redirect their network traffic to another box for filtering, but they are NATed. I want to restrict their network access to that one website (HTTP/HTTPS, possibly FTP) and to the file servers on the network (SMB). Can I enforce this in a way that's not changeable by a user?"
Editing system32/drivers/etc/hosts should do what you want. Direct everything (except windows update, maybe nist) to that one site.
In the TCP/IP properties of the netowkr adapter they use, select Advanced -> Options -> TCP/IP filter. "Allow only" the IP addresses you want. Maybe it's not a flexible solution (OK... without "maybe") but it's a simplistic IP filter that will get your particular job done. HTH
Global warming is a cube.
What are you doing supporting these computers? If you need to Ask Slashdot to get the answer to this fairly basic problem, then you are not qualified to do the job.
Harsh, but true.
I'd look at doing at the network infrastructure level. They're connected to network hardware of some kind. If you have some kind of router on their subnet manages the traffic, start setting up filtering rules. You said something about "not being allowed to intercept their traffic with another box," but the network itself has to have some infrastructure in it, so you should have an option there.
What kind of science is this, beauty therepy?
The most basic thing under any UNIX operating system comes up as a Windows question on Ask Slashdot. This must be a new low.
Use it.
IE has a built in content filter that accepts wildcards. Turn it on, Click on tools, go to options. click on the restricted sites tab. and add a wildcard * and click never. Then add the one site you want to have people go to click Allways. Under general youll probably also want to disable Supervisors can enter a password to see site (it makes users less cranky thinking someone else is allowed, but not them.
when you close the dialouge box - it will ask for a password, and your done.
Microsoft has released a shared computer toolkit for places like labs and librarys that has some neat tools - including a good one to restrict access to only certain applictaion. you may wish to look into that as well
Comment removed based on user account deletion
I've tried using the 'c:/Windows/System32/drivers/etc/hosts' file, but that doesn't work like it does in *NIX. Actually, it doesn't work at ALL in XP.
Comment removed based on user account deletion
It sounds like your concern is that people using the equipment will surf the web inappropriately, potentially compromising the machine and losing valuable data.
How about making a 3x5 sign and tape it on the machine that lets them know that their web surfing is being monitored and if they fiddle with the machine to go anywhere else, they'll be fired. Periodically audit the weblogs at your firewall and see if anyone at that device is doing anything.
I run into this problem all the time. People ask for some security measure when it's easier to simply make and enforce a policy. I work with medical records and the question is always "how do you keep people from looking at records inappropriately?" The thing is, if there's any false positive and the information isn't easily available, someone could die. So we audit. Lots and lots of auditing. And fire people when they're idiots.
If you be come their DNS resolver then you have control over any site they want to visit. Just turn everything except what they need to null.
Use the firewall built-in Windows, it does pretty much everything you need.t m
Instructions here: http://homepages.wmich.edu/~mchugha/w2kfirewall.h
There are no atheists when recovering from tape backup.
Comment removed based on user account deletion
Microsoft Windows products come with an excelent website for support. Their technical team is always there for you and will help you solve all your problems with their product. However, if you still have unsolved problems, please try Windows Live OneCare.
Privoxy. Install, set whitelist and restart. Done. All for free.
Skeptic and Reason
Sure. Set the homepage to your site and then prevent users from changing that setting. As long as you don't have any external links and lock IE down with policies, you're ok. You'll also need to prevent users from accessing the command line and explorer. Everything would have to be driven by what icons you place on the desktop and start menu. You should google around for terms such as "kiosk mode".
Set the Proxy server to a junk value.
Then add proxy exclusions for the sites that they are permitted to access.
Then lock down these settings via GPO.
Step 1, make sure that these PC's always use the same IP address. Set it statically if you can, and while you're at it, set up a DHCP reservation for their MAC addreses to give them that same address. That way if they switch it to DHCP they get the same thing. Step 2, set up a rule on your firewall for those two addresses that basically says 'allow http and https traffic from these IP addresses only if they are going to this specified address (the web site that they need)'. Put a rule immediately after that one that says 'deny all traffic from these IP addresses to any other IP addresses'. Now they should have free roam of the internal network, but only be allowed web access to that one external site. If you want to get even more paranoid, you can configure the ports on their network switch to only allow traffic from their IP addresses, in case the users get the idea of statically setting a different IP address on the same subnet than the one that you gave them. Of course, these users shouldn't have the ability to change the IP address configuration for their PCs if they aren't running as admin. You don't let them run as admin, do you? I don't believe that Windows XP has the same settings for IP security that you can put on Windows 2000 and later, otherwise that would be an option. If you really wanted to get detailed and make it secure, you could change all of the Windows Firewall settings to block everything except necessary traffic to necessary hosts, but then it gets really tedious, but I know that Windows firewall settings can be set with Group Policy.
We wanted a whitelist for IE in a 2003 domain. Note that this won't affect Firefox or other apps.
1) Go to 'Group Policy >> user config >> windows settings >> ie maintenance >> connection >> proxy settings'
2) Proxy everything to localhost
3) In the exceptions, list allowed hosts separated by semicolons. Wildcards work.
At work we use a Watchguard java applet, which I don't particularly like, but it does the job as you describe. We use it to restrict users/workstations to our own websites and limited tech support sites.
To enable this access on the client PC, the user opens IE, goes to a local page that contains the applet, and enters their password in the applet. As long as that window is open in the background, they have access to the allowed sites.
I don't deal with the server end myself but I think it comes in hardware or software flavours.
If you want real security, get the NAT box to null-route anything from those machines unless it's going to one of the approved IP addresses.
You may need to get a better router to get adequate functionality, or get a WRT54GS and install OpenWRT.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
You'll need to wait for Firefox's own DNS cache to expire (takes 60 minutes by default, quicker if you change the option in about:config).
In addition ipconfig has a /flushdns option which you might need to use to force Windows in general to look up the address in HOSTS instead of the cache.
A scientific instrument or computer that controls them with proprietary data should not be connected to the internet. Period. Place a second machine with internet access in the same room, and users can transfer the data they need, if necessary, using some form of media/external drive.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Use the site firewall to restrict traffic from those machines to only go to the required sites. As for SMB, use a host based firewall, such as Symatec Client Security. SCS can be locked down through the management console.
I have a feeling you didn't look very hard. Microsoft Windows out of the box can execute scripts written in the languages corresponding to the .bat, .js, and .vbs suffixes.
As silly as this sounds, I would suggest using an IPSEC applied via Group Policy to enforce access/non-access based on port numbers and IP's. An lesser known function of the IPSEC rules is filtering. You'll want to keep in mind the policies are NOT stateful, so make sure to test your rules. Applying the IPSEC policy via Group Policy will ensure consistent re-application (in the event someone figure out how to un-apply the settings... and in that case, pull in HR/management).
Well, if they aren't administrators on the machines, then just change the routing tables. "route delete 0.0.0.0" does amazing things to limit internet access from a host. Just do a "route add" for the webserver they need to access, and they'll already have a route in their routing table that lets them talk to servers on the same local network. If the machines are pulling DHCP, this isn't going to survive reboots, of course, but if you can statically assign their IP info, just do that, but don't enter a default gateway (many people seem to errorneously believe you *have* to put something for the default gateway, which isn't true at all). Your machines will come up with the ability to talk to the local network, and nothing else. To add additional routes for 'outside' hosts, i.e. the webserver you want them to hit, you'd just set up a persistent static route so it will live across reboots: route -p add mask 255.255.255.255 Now you have a machine that can talk to local net, one outside webserver, and nothing else at all. Add additional routes for other local networks if needed.
IPCOP + AdvProxy AddOn + URLFilterAddOn
This will solve your problem only if you feel like changing your current firewall for IPCOP (OpenSource, Top choice IMHO ). You get a stateful fireall plus content filtering. If you want micromanagement capabilities you would need MS ISA (overkill for your setup)
If you decide for IPCOP then you are set for the future. You can then implement DMZ for your servers, VPN, QoS, and much more either using the builtin services or trhough addons.
The best test environment is production. - Me
chrome://browser/content/browser.xul
Most of Wikipedia is fine, but it links to lots of places that aren't fine, at least for a five year old. I'd like to restrict him to a know whitelist, but I don't want my and my wife's accounts to have the same restrictions. (We're both tired of Thomas.) In a few years, #2 son will want to look at stuff, and we'll need to loosen the whitelist for #1.
Anyone have a solution where we can have multiple filter sets for different accounts, and where the filter set can be protected from the users?
"Seven Deadly Sins? I thought it was a to-do list!"
The real questions are how much you trust your users not to mess around with the box and why you've got a policy against putting in extra firewall boxes if you need them. The answer may be to get better management
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The answer is yes, trivially. We are not telling you how because you are evil.
-I like my women like I like my tea: green-
If you can't do it from a filtering box then you can't do it in a way that the users cannot change. Anything you set up on the actual client machine could be subverted by users who had physical access to the machine since it's trivial to gain Administrator access to a machine you're actually sitting at.
This is usually obscure enough that nobody is even going to realize that thay can do it..
type in: ROUTE PRINT
It will show you a bunch of routes.
You want to delete the 0.0.0.0 entry.. ie ROUTE DELETE 0.0.0.0
Then add entries for all of the destinations you want to talk to..... ie ROUTE ADD 10.0.69.69 MASK 255.255.255.255 192.168.0.1 METRIC 10
Where the 10.0.69.69 is your DNS server and the 192.168.0.1 would be the inner NAT gateway.. and repeat for the rest of the boxes
If you have a nice group of machines in an IP range you can just loosen the MASK to 255.255.255.0, assuming that you trust the rest of the machines in that subnet.
Pop the commands into a startup script, or add the -p flag to make the changes persistent, and your good to go. Good Luck
Storm
AC wrote:
VBScript