A great Web Filtering Solution

I work in the IT industry. I know the topic of Web Filtering at home is a big topic. I have been equally concerned about this topic with my kids. For Buisness's who have the money buying a large scale solution for the company is a great option. One of the popular solutions out there is Blue Coat. This is a solution that is used around the world for buisness's. I have experience with the this product and have been very impressed with its abilities.

The great news is that this same company has a FREE home solution using the same dynamic database that is used in there product sold to companies.

http://www.k9webprotection.com/

I am really suprised that this option has not been talked about. It is great for parents and Free. It is a piece of software that is loaded on a PC and has a very small memory footprint. I have noticed no speed difference with the software loaded and it gives me the ability to block by time as well as log what is going on.

This is well worth looking at and trying.

** Disclamer: I am not affiliated with Blue Coat and do not sell products **

I moved your post here and started a new thread. It will be easier for others to find and comment on if they desire. That other thread was getting a little wild and really needed to be locked.

Although I have not used K9, I have read a couple of good reviews on it.

Mike

I have been looking for something like this for several months now. I downloaded and installed this program today.

I had read the manual earlier (it is available online) and had an idea how it would work. I have been pleased that it works as advertised, and that it is flexible enough that I can set it the way I truly want it.

With the administrative password, adjustments can me made in real time, and they can be made to be either permanent or temporary. The logs are thorough, detailed, and helpful. I think I am going to like it.

happy-one wrote: http://www.k9webprotection.com/

I am really suprised that this option has not been talked about. It is great for parents and Free. It is a piece of software that is loaded on a PC and has a very small memory footprint. I have noticed no speed difference with the software loaded and it gives me the ability to block by time as well as log what is going on.

This is well worth looking at and trying.

** Disclamer: I am not affiliated with Blue Coat and do not sell products **

Thank you very much for that. Its just the sort of things many would want. If its not talked about then its likely most dont know about it, even if it seems natural to some of us.

Only for Windows, Mac in beta test.
I tried to install with Linux (Wine) but it check OS before start and quit!

marianomarini_vi wrote:Only for Windows, Mac in beta test.
I tried to install with Linux (Wine) but it check OS before start and quit!

If you are looking for a linux based solution then try Dan's Guardian. It is a really popular free Web Filtering solution for linux.

http://dansguardian.org/

Happy-One

Thanks a lot. I'll try it surely.

happy-one wrote:If you are looking for a linux based solution then try Dan's Guardian. It is a really popular free Web Filtering solution for linux.

http://dansguardian.org/

Happy-One

clark connect is a MUCH easier setup than Dan's Guardian. (It actually uses Dan's Guardian under the hood) http://www.clarkconnect.com/downloads/

I echo the others comments though that K9 is the best for Windows use.

I'm also a big fan of K9, my IT shop uses bluecoat and that's how I found the solution.

Here is a tip from my 15 year old son:

"Dont forget to also install the K9 software on any virtual images (VirtualPC or VmWare) you might use"

He is right, it took him 5 min to work that one out.

I have now loaded it on our PC's in the home and I must admit I am very impressed. Its not 100% but a lot better than nothing. I particularly like the time grid where you can set the internet to be off at certain time slots. There is no arguing over stopping at certain times because it simply goes OFF.

dkjorgi wrote:Here is a tip from my 15 year old son:

"Dont forget to also install the K9 software on any virtual images (VirtualPC or VmWare) you might use"

He is right, it took him 5 min to work that one out.

LOL, they are truly amazing, aren't they!

We are using http://www.opendns.com/ at work. Its free for home users and does not require any installation. You simply change some settings on your Internet Connection and they do the rest.

They have over 50 categories and you can block any you want. Great system.

Stephan wrote:We are using http://www.opendns.com/ at work. Its free for home users and does not require any installation. You simply change some settings on your Internet Connection and they do the rest.

They have over 50 categories and you can block any you want. Great system.

I have used OpenDNS too and it is great. The reason I liked K9 is because I found it to be a great alternative to OpenDNS for those situations where OpenDNS is not bulletproof.

For those situations where you can (and user feel confident enough) access your router or where all users have limited user accounts then OpenDNS is great.

For those situations where the user is not confident accessing the router or where they only have a modem then using OpenDNS would require them to change their internet settings and that means people with user admin accounts can easily undo those changes.

Not long ago I had a family who asked me which they should use. Everything looked like it could be OpenDNS until I found out the kids had admin accounts (some games require it) and then we went for K9. It just shows both are great products but depending on the individual situation one might be better suited than the other.

Sure it's not 100 percent, but that is because the Internet changes all the time, new sites come up and old ones even die on occasion. Or change their focus, etc.

But I've never hit a bum one, even by mistake, using K9. There are some white papers on the company site that show how good it is at blocking pornography. Even spyware sites, once found, are taken care of just as solidly.

I've had great success with a product called "FreeProxy".

http://www.handcraftedsoftware.org/

It's primary use is to set up a proxy that the browsers would then be configured to work through.
In our case we use it in our family history centers and it functions well. You can configure it to accept or deny just about anything you want.

Techgy wrote:In our case we use it in our family history centers and it functions well.

How does that work in conjunction with the church's proxy to get access to the FHC on-line portal? I believe LANDesk tries to write the Church proxy into the browser automatically.

Russell,

We're not using this on the Admin machines. It's only used on the Family History computers. We have one machine in the FH center that acts as a "server" of sorts. It's not running server software but instead all the machines are connected in a peer-to-peer network. The workstations are configured so the browsers point to the proxy address on the one machine. I can then control what I want the workstations to be able to access. It's actually more effective than the Church Controlled firewall, which is still in place.

The ward machines will ultimately connect directly to the ASA which will bypass the FH proxy machine.
It's actually quite simple but it works very well. At the moment the ward admin machines are not hooked in but that will change next week as we bring the first building on-line with a wireless internet.

Techgy wrote:Russell,

We're not using this on the Admin machines. It's only used on the Family History computers. We have one machine in the FH center that acts as a "server" of sorts. It's not running server software but instead all the machines are connected in a peer-to-peer network. The workstations are configured so the browsers point to the proxy address on the one machine. I can then control what I want the workstations to be able to access. It's actually more effective than the Church Controlled firewall, which is still in place.

The ward machines will ultimately connect directly to the ASA which will bypass the FH proxy machine.
It's actually quite simple but it works very well. At the moment the ward admin machines are not hooked in but that will change next week as we bring the first building on-line with a wireless internet.

Are the family history computers still behind a Church provided firewall? If not, they should be.

Techgy wrote:We're not using this on the Admin machines. It's only used on the Family History computers.

Yes, that's what I'm talking about - the FHC machines used by the patrons.

Techgy wrote: We have one machine in the FH center that acts as a "server" of sorts. It's not running server software but instead all the machines are connected in a peer-to-peer network. The workstations are configured so the browsers point to the proxy address on the one machine.

OK, I understand that. Two questions: Does your "server" then have the church proxy setup to allow access to the FHC on-line portal (https://www.fhc.familysearch.org Note: this link will only work in a FHC - even then you must have the right stuff installed on the computers.)

Second, do you have a problem with LANDesk trying to overwrite your proxy settings with the FHD's?

First of all in response to the ASA question - yes, everything goes through the firewall, including the FH workstations.

Second, the family history machines do not require the 5.5 desktop since they're not administrative machines. Some of them are too old to support that anyway. So the Landisk isn't an issue on the FH machines.

Since the ASA doesn't block the use of Email, I use the proxy to specify enhance the restrictions on these machines. I have all Email blocked and only allow sites that are related to family history. This hasn't been an issue since most everyone is currently using NFS in our stake anyway. Although we do permit, Ancestry, Rootsweb and a few other popular ones.

My biggest concern was with someone downloading software, or opening an Email that was infected. With the proxy in place I have full control over what's available. And yes, everything goes through the ASA.

Techgy wrote:Second, the family history machines do not require the 5.5 desktop since they're not administrative machines.

Correct. In fact FHC machines should NOT be running Desktop 5.5

So the Landisk isn't an issue on the FH machines.

This tells me you aren't running the FHC as intended. FHC computers haven't been discussed much in this forum and if I didn't belong to some email lists I might not know about it myself.

You'll find LANDesk for FHCs at http://remote.familysearch.org/. Once the FHC version of LANDesk has been downloaded, you can obtain Symantec Antivirus as well as some other software such as DeepFreeze. It's also the method for obtaining the security certificates that is needed to access the FHC Portal that gives FHCs access to certain on-line sites.

Techgy wrote:Since the ASA doesn't block the use of Email, I use the proxy to specify enhance the restrictions on these machines. I have all Email blocked and only allow sites that are related to family history. This hasn't been an issue since most everyone is currently using NFS in our stake anyway. Although we do permit, Ancestry, Rootsweb and a few other popular ones.

While I certainly understand the concern and the advantages in security that come with restricting such access, I personally would hate to not be able to email another individual for communication purposes while doing Family History work.

Do every one of those sites allow for some type of messaging system from within the domain of their site (since you allow only certain domains)? I doubt it, but perhaps I'm wrong.

RussellHltn wrote:Correct. In fact FHC machines should NOT be running Desktop 5.5




This tells me you aren't running the FHC as intended. FHC computers haven't been discussed much in this forum and if I didn't belong to some email lists I might not know about it myself.

You'll find LANDesk for FHCs at http://remote.familysearch.org/. Once the FHC version of LANDesk has been downloaded, you can obtain Symantec Antivirus as well as some other software such as DeepFreeze. It's also the method for obtaining the security certificates that is needed to access the FHC Portal that gives FHCs access to certain on-line sites.

These are not official FHC's. They're class rooms in each facility with a couple of computers in each room.

mkmurray wrote:While I certainly understand the concern and the advantages in security that come with restricting such access, I personally would hate to not be able to email another individual for communication purposes while doing Family History work.

Do every one of those sites allow for some type of messaging system from within the domain of their site (since you allow only certain domains)? I doubt it, but perhaps I'm wrong.

Not being able to use Email hasn't been an issue. I've not had any complaints and activity is good.
Our efforts at the time are centered around teaching the membership how to use NFS, which was only recently activitated in our stake. When we started our efforts years ago we didn't have the proxy. We had problems with downloading software, music and other uses that were not centered around FH. So I added the proxy to tighten things a bit. At first we had the proxy setup so that we only prohibited certain activities. Most of the Internet was still open. However, a log was maintained. When I checked the logs periodically I'd still find downloading of software and other uses that were not conducive to FH research. Think of it this way. Why do they have locks on the lockers of the temple dressing room?

Techgy wrote:These are not official FHC's. They're class rooms in each facility with a couple of computers in each room.

Ah, what I call Family History Workrooms

Techgy wrote:We had problems with downloading software, music and other uses that were not centered around FH.

I find setting users to "Users" (not power users) puts a stop to many things. Installs become difficult.

Another of my tricks for severely locked down machines to so set the "Internet Zone" to "High Security". So the Internet as a whole is treated the same as the "Restricted Zone". Then elevate the "Trusted Zone" to "Medium-High" (this is the default for "Internet"). Now add the sites that you allow to the trusted zone. You can use wildcards such as "*.familysearch.org", "*.lds.org", etc.

Of course given the limited usage, a password, either in Windows or in th BIOS is not out of the question.

Is there a way to install the proxy software on the machine itself, so there's no need for a "server"?

Russell,

When we first started this process we tried several ideas among them some of what you suggested including using the content advisor in IE. They worked but each of these "fixes" required individually configuring each workstation. With about 16 computers spread around the stake, I needed a solution that didn't involved this level of contact.

The proxy gives me a way of modifying only 1 computer in each building and the others feed off of it. Works like a charm. The logon accounts are also limited. The only thing that's necessary at the workstation level is to direct the browser to the proxy. It's not bullet-proof as anyone with a little smarts can go around this with a click of the mouse, but it works well enough that we haven't had any problems.

Lest anyone get confused, these computers are in "Family History Workarea" and include the ASA 5505 Firewall. They are not official FH center computers and in fact a few of them are older model P3's and wouldn't support the landesk, etc.

Understood. Always good to have more tools in the toolbox.

Can this software work for a single PC install? In other words the client is it's own server?

I have taught many classes and always recommend K9...it is the BEST app on the market (and yet it's free).

RussellHltn wrote:Understood. Always good to have more tools in the toolbox.

Can this software work for a single PC install? In other words the client is it's own server?

Yes, but it would require you to configure each pc individually and although it would work, it's a lot of extra work. It's much easier to just set all the pc's up in a peer-to-peer configuration and choose of them as the "server" or primary machine. Put the proxy on this machine and configure it as you wish. The point the browsers of the other pc's to this proxy.

I wouldn't recommend trying this on the ward admin machines. But, it works great on the older pc's that are often found in an "unofficial" family history (FH) classroom.

As I said, it's not bullet-proof, but it is easy to set up and gives you a lot of freedom.

Techgy wrote:I wouldn't recommend trying this on the ward admin machines.

Unfortunately, that's exactly what I was thinking about. A way to limit the Admin machines over and above what might be available on the network.

Suggestions?

I'm not saying that it won't work, just that I haven't attempted it.
The program is easy enough to install and remove if it doesn't work as expected.
As far as changing the browser, it's a couple of mouse clicks to go back to what you had w/o the proxy.

I'd say go ahead and try. I don't believe it will hurt anything.
MLS doesn't depend upon the browser so no problem there.
The only thing you're really filtering is the browser.

K9 has helped me when my antivirus software hasn't-it has blocked objectionable material on many occasions! I consider it a must have

K9 has been a great blessing in my house already! Even my wife, who is a self-proclaimed "IT Blond," has found it easy to navigate and configure. This suggestion came at a perfect time as well: the kids are just getting to that age where almost 70% of their homework requires some sort of Internet access. Again, thanks for the suggestion!