Re: Proxies

["Charles E. Hill" <chill () herber-hill com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You can never get around it, as you're aware -- proxies on ports 80, 20, 21, 
22 or something else really common will always be available.

However, since you need to show due diligence, you can do the following.

1. Have the administration set a policy with some teeth.  "If you avoid the 
proxy, your account gets suspended" or some such.

2. And I'm not sure how easy this will be... restrict protocols to their known 
ports.  Configure your firewall to only allow HTTP traffic through Port 80, 
and not other ports.  FTP only through 20 & 21.  SSH only through22, etc.

Don't allow HTTP headers through any other port.


On Friday 31 October 2003 09:20, Earl Keyser wrote:

- -- 
Charles E. Hill
Technical Director
Herber-Hill LLC
http://www.herber-hill.com/

> Help needed, please.
>
> We use all cisco networking gear. Currently using a cisco cache engine
> with SmartFilter to "manage" the surfing for our staff/students.  As
> usual, the little devils figured a way to get around it.
>
> They went to Google, entered "open proxy list" and bingo-bango.  From
> this list they found open proxies to use in IE.
>
> Besides suspending them, we made one technological change. Outgoing
> ports 8000, 8080, 8888 and 3128 are now blocked at the firewall.
>
> Can anyone suggest further refinements to reduce this kind of abuse? I
> know some proxies run on port 80, but I'll have to live with that.
>
> TIA
>
> Earl
>
> Earl Keyser, Network Specialist
> Wayzata Public Schools
> 763-745-5105
>
> "Unix IS user-friendly. It's just picky about who its friends are."
>
>
> This outbound message has been scanned for viruses by ISD#284.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE/oquDeljutq/VnacRAhvXAJ0ZHREfG345O+vx/3at6m4g+zjh3wCfYra2
J34T2QGPXZ9Nn4DWKBiu9/g=
=hOps
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html