Re: [Leaf-user] Junk Busting???
At 10:11 PM 4/9/02 -0400, John Mullan wrote: >I am now in need of blocking certain web content from my 8-year-old >grandson. > >Since my only gateway to the internet is through the Dachstein box, I am >wondering what (if anything) can be run on the box to block various web >content. > >So is there anything?? I'm kinda hoping NOT to add in another >computer... This is tough. What you can do depends on what "certain web content" means. Basically, you have 3 options. First, if you can specify the IP addresses of the sites you want to block, you can do it with the standard ipchains rulesets. This is not likely to be what you want, though. Second, you can run a proxy server locally and require (via ipchains rules) the kid's ability to access the Web directly. I don't know of any Linux-based "nanny filter" packages, but I may be out of date here. The standard proxies for Linux are junkbuster and squid. Either of them can be used to block some sites, though that is not their main purpose. I don't know offhand if Dachstein has either of them, but you can look on the CD. Third, you can use an off-site proxy server that does filtering (again using ipchains rules to force use of it). Finding one really isn't a Linux or a Dachstein issue; I'd suggest looking on some of the education lists for possibilities. -- "Never tell me the odds!"--- Ray Olszewski-- Han Solo Palo Alto, CA[EMAIL PROTECTED] ___ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
RE: [Leaf-user] Junk Busting???
I use squid and squidguard on a separate machine. Squidguard is nice because it updates nightly with a new "bad" list. I'm pretty sure you can run squid on your Dachstein box, but you'll need a HD to store the cached pages and logs and probably more memory (32MB-64MB?). With squid in place you can probably add squidguard. There are also rules you can add so the web proxy is transparent, meaning the users PC just uses the Dachstein box as the gateway and the rules pump anything destined for port 80 thru squid. I put this in the category of "can be done" if your pretty familiar with Dachstein, Linux and firewalls, but I doubt you'll find a drop in package. If you can scrape up another PC then this should be a piece of cake since squid is a standard package in RedHat and all you'd need to do it is to add squidguard (pretty easy). If you get it to work on Dachstein please write it up. I would like to have squid and squidguard running on the firewall, but I love having no HD in the firewall, so I'm sticking with my current solution. I run e-smith as a server and Dachstein as firewall. If you used e-smith as both you just add squidguard and be done. Personally I like the firewall as skinny as possible and separate from the server. Enough rambling, good luck. - Todd > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > John Mullan > Sent: Tuesday, April 09, 2002 10:11 PM > To: [EMAIL PROTECTED] > Subject: [Leaf-user] Junk Busting??? > > > I am now in need of blocking certain web content from my 8-year-old > grandson. > > Since my only gateway to the internet is through the > Dachstein box, I am > wondering what (if anything) can be run on the box to block > various web > content. > > So is there anything?? I'm kinda hoping NOT to add in another > computer... > > *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* > John Mullan http://mullan.dns2go.com/ > > Personal: mailto:[EMAIL PROTECTED] > Business: mailto:[EMAIL PROTECTED] > > > > ___ > Leaf-user mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/leaf-user > ___ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
RE: [Leaf-user] Junk Busting???
Thanks all for input received so far. I'm not so picky on the "thin-ness" of my LEAF router box. I still have some space left on my 80meg flash disk. At home it is becoming my catch-all router/firewall so adding a certain amount of extra abilities flies for me on this one. However, I have looked around the net and noticed that SNORT may be up to the task (although not necessarily it's conventional use). Is there anyone that has put SNORT to use on LEAF as a "nanny filter"??? John -Original Message- From: Todd Pearsall [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 10, 2002 9:33 AM To: 'John Mullan'; [EMAIL PROTECTED] Subject: RE: [Leaf-user] Junk Busting??? I use squid and squidguard on a separate machine. Squidguard is nice because it updates nightly with a new "bad" list. I'm pretty sure you can run squid on your Dachstein box, but you'll need a HD to store the cached pages and logs and probably more memory (32MB-64MB?). With squid in place you can probably add squidguard. There are also rules you can add so the web proxy is transparent, meaning the users PC just uses the Dachstein box as the gateway and the rules pump anything destined for port 80 thru squid. I put this in the category of "can be done" if your pretty familiar with Dachstein, Linux and firewalls, but I doubt you'll find a drop in package. If you can scrape up another PC then this should be a piece of cake since squid is a standard package in RedHat and all you'd need to do it is to add squidguard (pretty easy). If you get it to work on Dachstein please write it up. I would like to have squid and squidguard running on the firewall, but I love having no HD in the firewall, so I'm sticking with my current solution. I run e-smith as a server and Dachstein as firewall. If you used e-smith as both you just add squidguard and be done. Personally I like the firewall as skinny as possible and separate from the server. Enough rambling, good luck. - Todd > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > John Mullan > Sent: Tuesday, April 09, 2002 10:11 PM > To: [EMAIL PROTECTED] > Subject: [Leaf-user] Junk Busting??? > > > I am now in need of blocking certain web content from my 8-year-old > grandson. > > Since my only gateway to the internet is through the > Dachstein box, I am > wondering what (if anything) can be run on the box to block > various web > content. > > So is there anything?? I'm kinda hoping NOT to add in another > computer... > > *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* > John Mullan http://mullan.dns2go.com/ > > Personal: mailto:[EMAIL PROTECTED] > Business: mailto:[EMAIL PROTECTED] > > > > ___ > Leaf-user mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/leaf-user > ___ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
RE: [Leaf-user] Junk Busting???
In my past use of Snort it was for intrusion detection. It "watches" all the incoming traffic for patterns that may be hack attempts. I'm not aware of it being useful for controlling where internal users go. In fact I think it only logs suspicious activity and doesn't actually stop traffic from coming in (like portsentry does for port scanning) - Todd > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > John Mullan > Sent: Wednesday, April 10, 2002 6:38 PM > To: [EMAIL PROTECTED] > Subject: RE: [Leaf-user] Junk Busting??? > > > Thanks all for input received so far. > > I'm not so picky on the "thin-ness" of my LEAF router box. I > still have > some space left on my 80meg flash disk. At home it is becoming my > catch-all router/firewall so adding a certain amount of extra > abilities > flies for me on this one. > > However, I have looked around the net and noticed that SNORT may be up > to the task (although not necessarily it's conventional use). > > Is there anyone that has put SNORT to use on LEAF as a "nanny > filter"??? > > John > > -Original Message- > From: Todd Pearsall [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, April 10, 2002 9:33 AM > To: 'John Mullan'; [EMAIL PROTECTED] > Subject: RE: [Leaf-user] Junk Busting??? > > > I use squid and squidguard on a separate machine. Squidguard is nice > because it updates nightly with a new "bad" list. I'm pretty sure you > can run squid on your Dachstein box, but you'll need a HD to store the > cached pages and logs and probably more memory (32MB-64MB?). > With squid > in place you can probably add squidguard. There are also > rules you can > add so the web proxy is transparent, meaning the users PC > just uses the > Dachstein box as the gateway and the rules pump anything destined for > port 80 thru squid. > > I put this in the category of "can be done" if your pretty > familiar with > Dachstein, Linux and firewalls, but I doubt you'll find a drop in > package. > > If you can scrape up another PC then this should be a piece of cake > since squid is a standard package in RedHat and all you'd > need to do it > is to add squidguard (pretty easy). If you get it to work on > Dachstein > please write it up. I would like to have squid and squidguard running > on the firewall, but I love having no HD in the firewall, so I'm > sticking with my current solution. > > I run e-smith as a server and Dachstein as firewall. If you used > e-smith as both you just add squidguard and be done. > Personally I like > the firewall as skinny as possible and separate from the server. > > Enough rambling, good luck. > > - Todd > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]] On Behalf Of > > John Mullan > > Sent: Tuesday, April 09, 2002 10:11 PM > > To: [EMAIL PROTECTED] > > Subject: [Leaf-user] Junk Busting??? > > > > > > I am now in need of blocking certain web content from my 8-year-old > > grandson. > > > > Since my only gateway to the internet is through the > > Dachstein box, I am > > wondering what (if anything) can be run on the box to block > > various web > > content. > > > > So is there anything?? I'm kinda hoping NOT to add in another > > computer... > > > > *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* > > John Mullan http://mullan.dns2go.com/ > > > > Personal: mailto:[EMAIL PROTECTED] > > Business: mailto:[EMAIL PROTECTED] > > > > > > > > ___ > > Leaf-user mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/leaf-user > > > > > > ___ > Leaf-user mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/leaf-user > ___ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
RE: [Leaf-user] Junk Busting???
Todd: I realize that Snort is more for monitoring (NIDS in particular). However the current documentation indicates that it can scan for content and, if desired, drop the packets. It also says it can do this in either direction. So, if one were to "think outside the box", instead of blocking outbound requests (like a nanny filter), I could watch for undesirable content coming in and drop it. I could also replace the packet with content issuing a warning. While unconventional, it may meet my desired criteria of fitting into my LEAF router and eliminate the need for an extra box. Keep in mind, this is just from reading the user manual. I have yet to actually try this... John -Original Message- From: Todd Pearsall [mailto:[EMAIL PROTECTED]] Sent: Thursday, April 11, 2002 9:25 AM To: 'John Mullan'; [EMAIL PROTECTED] Subject: RE: [Leaf-user] Junk Busting??? In my past use of Snort it was for intrusion detection. It "watches" all the incoming traffic for patterns that may be hack attempts. I'm not aware of it being useful for controlling where internal users go. In fact I think it only logs suspicious activity and doesn't actually stop traffic from coming in (like portsentry does for port scanning) - Todd > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > John Mullan > Sent: Wednesday, April 10, 2002 6:38 PM > To: [EMAIL PROTECTED] > Subject: RE: [Leaf-user] Junk Busting??? > > > Thanks all for input received so far. > > I'm not so picky on the "thin-ness" of my LEAF router box. I > still have > some space left on my 80meg flash disk. At home it is becoming my > catch-all router/firewall so adding a certain amount of extra > abilities > flies for me on this one. > > However, I have looked around the net and noticed that SNORT may be up > to the task (although not necessarily it's conventional use). > > Is there anyone that has put SNORT to use on LEAF as a "nanny > filter"??? > > John > > -Original Message----- > From: Todd Pearsall [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, April 10, 2002 9:33 AM > To: 'John Mullan'; [EMAIL PROTECTED] > Subject: RE: [Leaf-user] Junk Busting??? > > > I use squid and squidguard on a separate machine. Squidguard is nice > because it updates nightly with a new "bad" list. I'm pretty sure you > can run squid on your Dachstein box, but you'll need a HD to store the > cached pages and logs and probably more memory (32MB-64MB?). > With squid > in place you can probably add squidguard. There are also > rules you can > add so the web proxy is transparent, meaning the users PC > just uses the > Dachstein box as the gateway and the rules pump anything destined for > port 80 thru squid. > > I put this in the category of "can be done" if your pretty > familiar with > Dachstein, Linux and firewalls, but I doubt you'll find a drop in > package. > > If you can scrape up another PC then this should be a piece of cake > since squid is a standard package in RedHat and all you'd > need to do it > is to add squidguard (pretty easy). If you get it to work on > Dachstein > please write it up. I would like to have squid and squidguard running > on the firewall, but I love having no HD in the firewall, so I'm > sticking with my current solution. > > I run e-smith as a server and Dachstein as firewall. If you used > e-smith as both you just add squidguard and be done. > Personally I like > the firewall as skinny as possible and separate from the server. > > Enough rambling, good luck. > > - Todd > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]] On Behalf Of > > John Mullan > > Sent: Tuesday, April 09, 2002 10:11 PM > > To: [EMAIL PROTECTED] > > Subject: [Leaf-user] Junk Busting??? > > > > > > I am now in need of blocking certain web content from my 8-year-old > > grandson. > > > > Since my only gateway to the internet is through the > > Dachstein box, I am > > wondering what (if anything) can be run on the box to block > > various web > > content. > > > > So is there anything?? I'm kinda hoping NOT to add in another > > computer... > > > > *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* > > John Mullan http://mullan.dns2go.com/ > > > > Personal: mailto:[EMAIL PROTECTED] > > Business: mailto:[EMAIL PROTECTED] > > > > > > > > ___ > > Leaf-user mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/leaf-user > > > > > > ___ > Leaf-user mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/leaf-user > ___ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
RE: [Leaf-user] Junk Busting???
Hadn't considered "turning Snort around". There used to be a snort.lrp around, so if you can get the filtering to work it would be cool. Since the each packet is only part of the http request, dropping the packets with "bad words" may create corrupted web pages. It may look funny on the browser, but would effectly stop the user from see the pages with bad content or at least skewing the pages pretty badly. You're just braver than I, venturing out on your own this way ;) - Todd > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > John Mullan > Sent: Thursday, April 11, 2002 7:44 PM > To: [EMAIL PROTECTED] > Subject: RE: [Leaf-user] Junk Busting??? > > > Todd: > > I realize that Snort is more for monitoring (NIDS in particular). > However the current documentation indicates that it can scan > for content > and, if desired, drop the packets. > > It also says it can do this in either direction. > > So, if one were to "think outside the box", instead of > blocking outbound > requests (like a nanny filter), I could watch for undesirable content > coming in and drop it. I could also replace the packet with content > issuing a warning. > > While unconventional, it may meet my desired criteria of > fitting into my > LEAF router and eliminate the need for an extra box. > > Keep in mind, this is just from reading the user manual. I > have yet to > actually try this... > > John > > -Original Message----- > From: Todd Pearsall [mailto:[EMAIL PROTECTED]] > Sent: Thursday, April 11, 2002 9:25 AM > To: 'John Mullan'; [EMAIL PROTECTED] > Subject: RE: [Leaf-user] Junk Busting??? > > > In my past use of Snort it was for intrusion detection. It "watches" > all the incoming traffic for patterns that may be hack attempts. I'm > not aware of it being useful for controlling where internal users go. > In fact I think it only logs suspicious activity and doesn't actually > stop traffic from coming in (like portsentry does for port scanning) > > - Todd > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]] On Behalf Of > > John Mullan > > Sent: Wednesday, April 10, 2002 6:38 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Leaf-user] Junk Busting??? > > > > > > Thanks all for input received so far. > > > > I'm not so picky on the "thin-ness" of my LEAF router box. I > > still have > > some space left on my 80meg flash disk. At home it is becoming my > > catch-all router/firewall so adding a certain amount of extra > > abilities > > flies for me on this one. > > > > However, I have looked around the net and noticed that > SNORT may be up > > to the task (although not necessarily it's conventional use). > > > > Is there anyone that has put SNORT to use on LEAF as a "nanny > > filter"??? > > > > John > > > > -Original Message- > > From: Todd Pearsall [mailto:[EMAIL PROTECTED]] > > Sent: Wednesday, April 10, 2002 9:33 AM > > To: 'John Mullan'; [EMAIL PROTECTED] > > Subject: RE: [Leaf-user] Junk Busting??? > > > > > > I use squid and squidguard on a separate machine. > Squidguard is nice > > because it updates nightly with a new "bad" list. I'm > pretty sure you > > can run squid on your Dachstein box, but you'll need a HD > to store the > > cached pages and logs and probably more memory (32MB-64MB?). > > With squid > > in place you can probably add squidguard. There are also > > rules you can > > add so the web proxy is transparent, meaning the users PC > > just uses the > > Dachstein box as the gateway and the rules pump anything > destined for > > port 80 thru squid. > > > > I put this in the category of "can be done" if your pretty > > familiar with > > Dachstein, Linux and firewalls, but I doubt you'll find a drop in > > package. > > > > If you can scrape up another PC then this should be a piece of cake > > since squid is a standard package in RedHat and all you'd > > need to do it > > is to add squidguard (pretty easy). If you get it to work on > > Dachstein > > please write it up. I would like to have squid and > squidguard running > > on the firewall, but I love having no HD in the firewall, so I'm > > sticking with my current solution. > > > > I run e-smith as a server and Dachstei
RE: [Leaf-user] Junk Busting???
On Fri, 2002-04-12 at 08:01, Todd Pearsall wrote: > Hadn't considered "turning Snort around". There used to be a snort.lrp > around, so if you can get the filtering to work it would be cool. Todd, There are a couple of snort packages available. There are junkbuster and squid-2 packages also. see http://leaf.sourceforge.net/pub/packages-list.txt -- Mike Noyes <[EMAIL PROTECTED]> http://sourceforge.net/users/mhnoyes/ http://leaf-project.org/ ___ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user