anonymous proxy

[espoire20]

Hi

I have my Server proxy under Squid work very well but in the last time the users start to use anonymous proxy that allow users to connect to the Internet via an external site and bypass restrictions , so if you know some blocking tools under squid or linux to stop this big problem

i will be thankfull if you can help me

many thanks

[Henrik Nordstrom-5]

tis 2009-11-03 klockan 07:43 -0800 skrev espoire20:

> I have my Server proxy under Squid work very well but in the last time the
> users start to use anonymous proxy that allow users to connect to the
> Internet via an external site and bypass restrictions , so if you know some
> blocking tools under squid or linux to stop this big problem

The first and primary tool you need is an agreed and enforceable terms
of use which clearly states that the users are not allowed to try to
bypass the access restrictions.

Then set up a blacklist of known proxy sites, responding with a clear
message in the line of "Terms of use / Policy violation. Your
unauthorized access have been reported to management".

Then if users continue to intentionally ignore the rules then suitable
action needs to be taken administratively. When this has been done once
or twice the rest usually learns not to do the same..

Trying to fight this purely technical is a doomed failure. If the users
want to bypass the rules and know it's entirely safe to do so then they
will continue and all you end up with is a technical war between you as
technical maintainer of the restrictions and your users trying to find
ways to bypass whatever technical means you set up to implement the
restrictions.

Regards
Henrik

[Babu Chaliyath]

On Tue, Nov 3, 2009 at 9:13 PM, espoire20 <zakariase2002@...> wrote:

>
> Hi
>
> I have my Server proxy under Squid work very well but in the last time the
> users start to use anonymous proxy that allow users to connect to the
> Internet via an external site and bypass restrictions , so if you know some
> blocking tools under squid or linux to stop this big problem
>
> i will be thankfull if you can help me
>
> many thanks

3 things might help you
1. A good Accepted User Policy enforcement
2. A simple regex deny for proxy and a block list
3. Sarg/Calamaris report to find out suspicious sites

Regards
Babs

[espoire20]

OK but what do you mean  2. A simple regex deny for proxy
i have already blocked all outbound HTTP traffic in my routeur Cisco and i allowed just the proxy server and also i installed and configured the squiGaurd with Blacklist but they can use the anonymous proxy and go to see web site blocked

for example for windows we can found bloking tools http://www.programmez.com/actualites.php?id_actu=2446 but me i need somthing in linux

anonymous proxy like : www.Vtunnel.com , http://www.unblockya.com/

I think in squid or linux we have blocking tools that we can use to block anonymous proxy

many thanks

Babu Chaliyath wrote:

On Tue, Nov 3, 2009 at 9:13 PM, espoire20 <[e-mail]> wrote:
>
> Hi
>
> I have my Server proxy under Squid work very well but in the last time the
> users start to use anonymous proxy that allow users to connect to the
> Internet via an external site and bypass restrictions , so if you know some
> blocking tools under squid or linux to stop this big problem
>
> i will be thankfull if you can help me
>
> many thanks

3 things might help you
1. A good Accepted User Policy enforcement
2. A simple regex deny for proxy and a block list
3. Sarg/Calamaris report to find out suspicious sites

Regards
Babs

[Marcus Kool]

Everybody is entitled to have its own opinion and I respect them.

I agree that a company should have a internet usage policy and
communicate this clearly with all staff.

Nevertheless, there are many persons who simply do not obey such
policy and tracking those persons consumes too much time from
a network department. Therefore many companies have implemented
URL filters to block unauthorized access to proxies, adult, sport,
entertainment or whatever is unauthorized.
Most URL filters also block SSH tunnels, VPNs to a home computer
and so forth.  These types of tunnels are a security nightmare.

A URL filter is definitely a good option and a doomed success.

Regards
Marcus


Henrik Nordstrom wrote:

> tis 2009-11-03 klockan 07:43 -0800 skrev espoire20:
>
>> I have my Server proxy under Squid work very well but in the last time the
>> users start to use anonymous proxy that allow users to connect to the
>> Internet via an external site and bypass restrictions , so if you know some
>> blocking tools under squid or linux to stop this big problem
>
> The first and primary tool you need is an agreed and enforceable terms
> of use which clearly states that the users are not allowed to try to
> bypass the access restrictions.
>
> Then set up a blacklist of known proxy sites, responding with a clear
> message in the line of "Terms of use / Policy violation. Your
> unauthorized access have been reported to management".
>
> Then if users continue to intentionally ignore the rules then suitable
> action needs to be taken administratively. When this has been done once
> or twice the rest usually learns not to do the same..
>
> Trying to fight this purely technical is a doomed failure. If the users
> want to bypass the rules and know it's entirely safe to do so then they
> will continue and all you end up with is a technical war between you as
> technical maintainer of the restrictions and your users trying to find
> ways to bypass whatever technical means you set up to implement the
> restrictions.
>
> Regards
> Henrik
>
>
>
>

[Marcus Kool]

There are over 75000 proxy sites and every day new ones appear.
There are numerous Yahoo groups, Google groups and mailing lists
who distribute new proxy sites every day.

Sure, a network admin can make it a full daytime job to
run the race against the clock; block used proxy sites and block
tomorrow the proxy sites that his users used today, or...
evaluate several URL filters.

-Marcus


espoire20 wrote:

> OK but what do you mean  2. A simple regex deny for proxy
> i have already blocked all outbound HTTP traffic in my routeur Cisco and i
> allowed just the proxy server and also i installed and configured the
> squiGaurd with Blacklist but they can use the anonymous proxy and go to see
> web site blocked
>
> for example for windows we can found bloking tools
> http://www.programmez.com/actualites.php?id_actu=2446 but me i need somthing
> in linux
>
> anonymous proxy like : www.Vtunnel.com , http://www.unblockya.com/
>
> I think in squid or linux we have blocking tools that we can use to block
> anonymous proxy
>
> many thanks
>
> Babu Chaliyath wrote:
>> On Tue, Nov 3, 2009 at 9:13 PM, espoire20 <zakariase2002@...> wrote:
>>> Hi
>>>
>>> I have my Server proxy under Squid work very well but in the last time
>>> the
>>> users start to use anonymous proxy that allow users to connect to the
>>> Internet via an external site and bypass restrictions , so if you know
>>> some
>>> blocking tools under squid or linux to stop this big problem
>>>
>>> i will be thankfull if you can help me
>>>
>>> many thanks
>> 3 things might help you
>> 1. A good Accepted User Policy enforcement
>> 2. A simple regex deny for proxy and a block list
>> 3. Sarg/Calamaris report to find out suspicious sites
>>
>> Regards
>> Babs
>>
>>
>

[Henrik Nordstrom-5]

ons 2009-11-04 klockan 09:59 -0200 skrev Marcus Kool:

> A URL filter is definitely a good option and a doomed success.

Sorry if you got the impression that I think URL filters are a bad idea.
I do not. Just that implementing URL filters alone without also having a
policy of use is troublesome and may end up in very bad ways.

Regards
Henrik

[Marcus Kool]

Henrik Nordstrom wrote:

> ons 2009-11-04 klockan 09:59 -0200 skrev Marcus Kool:
>
>> A URL filter is definitely a good option and a doomed success.
>
> Sorry if you got the impression that I think URL filters are a bad idea.
> I do not. Just that implementing URL filters alone without also having a
> policy of use is troublesome and may end up in very bad ways.
>
> Regards
> Henrik
>

Yeah, I had the wrong impression.
Thanks for clarifying.

-Marcus

[Amos Jeffries-2]

On Wed, 04 Nov 2009 09:59:43 -0200, Marcus Kool
<marcus.kool@...> wrote:

> Everybody is entitled to have its own opinion and I respect them.
>
> I agree that a company should have a internet usage policy and
> communicate this clearly with all staff.
>
> Nevertheless, there are many persons who simply do not obey such
> policy and tracking those persons consumes too much time from
> a network department. Therefore many companies have implemented
> URL filters to block unauthorized access to proxies, adult, sport,
> entertainment or whatever is unauthorized.
> Most URL filters also block SSH tunnels, VPNs to a home computer
> and so forth.  These types of tunnels are a security nightmare.
>
> A URL filter is definitely a good option and a doomed success.
>
> Regards
> Marcus

Hi Marcus,

I think you are misunderstanding Henrik and the others comments a little.

They are not arguing opinions. They are simply stating the requirements.
Yours is the first posting to contain personal opinion on the subject.

An AUP policy is not a personal opinion or joke. It is a serious legal
requirement to have some form of service agreement publicly available and
in writing before going down the blocking track. Blocking and filtering
access to _anything_ otherwise public is controversial and can lead into
difficult situations technically, legally and commercially. When you reach
the point of kicking people off your network for evading the blocks and
filters you need grounds to do so. It _will_ happen.

Amos

>
> Henrik Nordstrom wrote:
>> tis 2009-11-03 klockan 07:43 -0800 skrev espoire20:
>>
>>> I have my Server proxy under Squid work very well but in the last time
>>> the
>>> users start to use anonymous proxy that allow users to connect to the
>>> Internet via an external site and bypass restrictions , so if you know
>>> some
>>> blocking tools under squid or linux to stop this big problem
>>
>> The first and primary tool you need is an agreed and enforceable terms
>> of use which clearly states that the users are not allowed to try to
>> bypass the access restrictions.
>>
>> Then set up a blacklist of known proxy sites, responding with a clear
>> message in the line of "Terms of use / Policy violation. Your
>> unauthorized access have been reported to management".
>>
>> Then if users continue to intentionally ignore the rules then suitable
>> action needs to be taken administratively. When this has been done once
>> or twice the rest usually learns not to do the same..
>>
>> Trying to fight this purely technical is a doomed failure. If the users
>> want to bypass the rules and know it's entirely safe to do so then they
>> will continue and all you end up with is a technical war between you as
>> technical maintainer of the restrictions and your users trying to find
>> ways to bypass whatever technical means you set up to implement the
>> restrictions.
>>
>> Regards
>> Henrik
>>
>>
>>
>>

[espoire20]

Dear all

please if you have a solution about the tools or somthing to add in the squiGuard can you help me after to stop ther  anonymous proxy i company will creat a internet usage policy and  communicate this clearly with all staff.

but now i need solution please

thank you

Marcus Kool wrote:

There are over 75000 proxy sites and every day new ones appear.
There are numerous Yahoo groups, Google groups and mailing lists
who distribute new proxy sites every day.

Sure, a network admin can make it a full daytime job to
run the race against the clock; block used proxy sites and block
tomorrow the proxy sites that his users used today, or...
evaluate several URL filters.

-Marcus


espoire20 wrote:
> OK but what do you mean  2. A simple regex deny for proxy
> i have already blocked all outbound HTTP traffic in my routeur Cisco and i
> allowed just the proxy server and also i installed and configured the
> squiGaurd with Blacklist but they can use the anonymous proxy and go to see
> web site blocked
>
> for example for windows we can found bloking tools
> http://www.programmez.com/actualites.php?id_actu=2446 but me i need somthing
> in linux
>
> anonymous proxy like : www.Vtunnel.com , http://www.unblockya.com/
>
> I think in squid or linux we have blocking tools that we can use to block
> anonymous proxy
>
> many thanks
>
> Babu Chaliyath wrote:
>> On Tue, Nov 3, 2009 at 9:13 PM, espoire20 <[e-mail]> wrote:
>>> Hi
>>>
>>> I have my Server proxy under Squid work very well but in the last time
>>> the
>>> users start to use anonymous proxy that allow users to connect to the
>>> Internet via an external site and bypass restrictions , so if you know
>>> some
>>> blocking tools under squid or linux to stop this big problem
>>>
>>> i will be thankfull if you can help me
>>>
>>> many thanks
>> 3 things might help you
>> 1. A good Accepted User Policy enforcement
>> 2. A simple regex deny for proxy and a block list
>> 3. Sarg/Calamaris report to find out suspicious sites
>>
>> Regards
>> Babs
>>
>>
>

[Marcus Kool]

I stated that I agree with an internet usage policy or AUP policy.

Eh, I am really confused...  What is the point of your reply ?

-Marcus


Amos Jeffries wrote:

> On Wed, 04 Nov 2009 09:59:43 -0200, Marcus Kool
> <marcus.kool@...> wrote:
>> Everybody is entitled to have its own opinion and I respect them.
>>
>> I agree that a company should have a internet usage policy and
>> communicate this clearly with all staff.
>>
>> Nevertheless, there are many persons who simply do not obey such
>> policy and tracking those persons consumes too much time from
>> a network department. Therefore many companies have implemented
>> URL filters to block unauthorized access to proxies, adult, sport,
>> entertainment or whatever is unauthorized.
>> Most URL filters also block SSH tunnels, VPNs to a home computer
>> and so forth.  These types of tunnels are a security nightmare.
>>
>> A URL filter is definitely a good option and a doomed success.
>>
>> Regards
>> Marcus
>
>
> Hi Marcus,
>
> I think you are misunderstanding Henrik and the others comments a little.
>
> They are not arguing opinions. They are simply stating the requirements.
> Yours is the first posting to contain personal opinion on the subject.
>
> An AUP policy is not a personal opinion or joke. It is a serious legal
> requirement to have some form of service agreement publicly available and
> in writing before going down the blocking track. Blocking and filtering
> access to _anything_ otherwise public is controversial and can lead into
> difficult situations technically, legally and commercially. When you reach
> the point of kicking people off your network for evading the blocks and
> filters you need grounds to do so. It _will_ happen.
>
> Amos
>
>
>> Henrik Nordstrom wrote:
>>> tis 2009-11-03 klockan 07:43 -0800 skrev espoire20:
>>>
>>>> I have my Server proxy under Squid work very well but in the last time
>>>> the
>>>> users start to use anonymous proxy that allow users to connect to the
>>>> Internet via an external site and bypass restrictions , so if you know
>>>> some
>>>> blocking tools under squid or linux to stop this big problem
>>> The first and primary tool you need is an agreed and enforceable terms
>>> of use which clearly states that the users are not allowed to try to
>>> bypass the access restrictions.
>>>
>>> Then set up a blacklist of known proxy sites, responding with a clear
>>> message in the line of "Terms of use / Policy violation. Your
>>> unauthorized access have been reported to management".
>>>
>>> Then if users continue to intentionally ignore the rules then suitable
>>> action needs to be taken administratively. When this has been done once
>>> or twice the rest usually learns not to do the same..
>>>
>>> Trying to fight this purely technical is a doomed failure. If the users
>>> want to bypass the rules and know it's entirely safe to do so then they
>>> will continue and all you end up with is a technical war between you as
>>> technical maintainer of the restrictions and your users trying to find
>>> ways to bypass whatever technical means you set up to implement the
>>> restrictions.
>>>
>>> Regards
>>> Henrik
>>>
>>>
>>>
>>>
>
>

[Marcus Kool]

Dear Espoire,

You need 2 things:
1) a robust solution, i.e. a URL filter
2) an internet usage policy: the human resource department should
    communicate to staff to what extend they can use the internet
    access in the office for non-business activities.

There are various URL filters in the market:
a) Bluecoat  (expensive / does not use Squid)
b) McAfee  (expensive / does not use Squid)
c) many others
d) URLfilterDB  (reasonable priced, uses Squid)

Note that I am biased because I represent URLfilterDB.

-Marcus


espoire20 wrote:

> Dear all
>
> please if you have a solution about the tools or somthing to add in the
> squiGuard can you help me after to stop ther  anonymous proxy i company will
> creat a internet usage policy and  communicate this clearly with all staff.
>
> but now i need solution please
>
> thank you
>
> Marcus Kool wrote:
>> There are over 75000 proxy sites and every day new ones appear.
>> There are numerous Yahoo groups, Google groups and mailing lists
>> who distribute new proxy sites every day.
>>
>> Sure, a network admin can make it a full daytime job to
>> run the race against the clock; block used proxy sites and block
>> tomorrow the proxy sites that his users used today, or...
>> evaluate several URL filters.
>>
>> -Marcus
>>
>>
>> espoire20 wrote:
>>> OK but what do you mean  2. A simple regex deny for proxy
>>> i have already blocked all outbound HTTP traffic in my routeur Cisco and
>>> i
>>> allowed just the proxy server and also i installed and configured the
>>> squiGaurd with Blacklist but they can use the anonymous proxy and go to
>>> see
>>> web site blocked
>>>
>>> for example for windows we can found bloking tools
>>> http://www.programmez.com/actualites.php?id_actu=2446 but me i need
>>> somthing
>>> in linux
>>>
>>> anonymous proxy like : www.Vtunnel.com , http://www.unblockya.com/
>>>
>>> I think in squid or linux we have blocking tools that we can use to block
>>> anonymous proxy
>>>
>>> many thanks
>>>
>>> Babu Chaliyath wrote:
>>>> On Tue, Nov 3, 2009 at 9:13 PM, espoire20 <zakariase2002@...>
>>>> wrote:
>>>>> Hi
>>>>>
>>>>> I have my Server proxy under Squid work very well but in the last time
>>>>> the
>>>>> users start to use anonymous proxy that allow users to connect to the
>>>>> Internet via an external site and bypass restrictions , so if you know
>>>>> some
>>>>> blocking tools under squid or linux to stop this big problem
>>>>>
>>>>> i will be thankfull if you can help me
>>>>>
>>>>> many thanks
>>>> 3 things might help you
>>>> 1. A good Accepted User Policy enforcement
>>>> 2. A simple regex deny for proxy and a block list
>>>> 3. Sarg/Calamaris report to find out suspicious sites
>>>>
>>>> Regards
>>>> Babs
>>>>
>>>>
>>
>

[Brett Lymn]

On Thu, Nov 05, 2009 at 12:29:56PM -0200, Marcus Kool wrote:
>
> There are various URL filters in the market:
> a) Bluecoat  (expensive / does not use Squid)
> b) McAfee  (expensive / does not use Squid)
> c) many others
> d) URLfilterDB  (reasonable priced, uses Squid)
>

One of the many others is Websense which can integrate with squid, I
don't think it is cheap though but it does work very well.

--
Brett Lymn
"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited.  If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility.  It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."