Positive Restriction of Internet Browsing

[Peahippo]

I need a way to stop all the common users on an XP Pro machine from accessing certain sites on the Internet. The problem starts that these machines are used in a common work environment that allows people to walk away and let another user walk up to the machine and use it (to control check-sorting machines). Since each person has their own login, and the screensavers are disabled on purpose, anyone else in the area can use the machine. SPECIFICALLY, they can browse to the bank website that allows a person to check their own bank account. This is keyed to their login. Hence, anyone in the work area can check the bank account of the person who logged into the machine.

To avoid this so far, I simply set a restriction on MSHTML.DLL, which effectively killed all the browsing on the machine. But we are coming up with needs to use the Internet browser (machine monitoring via web interfaces, for one).

I see a lot of filters and blockers online for use in blocking sites in Windows, but I want to be sure that anything I install is transparent to the users. It would also be helpful if the software is simple.

I note that using the "C:\Windows\hosts" file doesn't work for these machines, for some reason (perhaps related to how the company setup the Internet proxies). It would have been a wonderful solution to use the hosts file set to "administrators only" and then put the bank-site URL in there as "127.0.0.1".

I need: Simple-administration of site banning for Internet browsing, for Windows XP and MSIE 6. (The "restricted sites" security zone for MSIE doesn't actually perform site-bans, just performs restrictions on running scripts, etc.)

 

[bcastner]

http://www.pcmag.com/article2/0,1759,1386896,00.asp

 

[Peahippo]

The PC Magazine article talks about tricking MSIE's proxy feature to setup a block on all websites except a few you want to allow. The trick is to setup MSIE to use a proxy, but not to specify one.

This won't work for my application since I want the inverse situation (allow all websites except a few I want to deny), and anyway, we do use a proxy for browsing.

MSIE has never had the ability to block specific sites. This is one feature that should have been in MSIE since XP came out, but it's still not there, and we are forced to use 3rd-party software to add that feature. At home, I use Windows95 (yep, Win95) for Internet browsing, and so I use the hosts file combined with eDexter for limiting exposure to ads. The hosts file also allows for site blocking in general (which I've done for a moderate list of browser-hijacking sites). (For some reason, the hosts file in our Windows XP Pro is not used. I suspect that's due to however the security department setup the Internet proxy.)

 

[JFBouchard]

Hi, try to configure the bank site URL in the exception list for the proxy server (bypass proxy) and disable the connection tab in gpedit.msc for the users to be incapable to change these parameters.

The web browser will bypass the proxy for the bank site and since your only mean to browse the internet is to actually use the proxy server it simply won't work.


Hope this helps. Please let know if this resolve your issue

Jeff

 

[bcastner]

I am curious as to why you do not use Content Advisor.
Under "Approved sites" you can list specific sites that are always allowed or always denied.

Another thought, is use ROUTE ADD -p and point the IP of the site to localhost.

 

[Peahippo]

I tried Content Advisor (since I have no access to the company proxy). I note that is seems easy to use and seems secure from unauthorized changes. However, I note that despite adding this site (we'll use "thebank" in this example):

http://www.thebank.com

... still didn't catch all accessing of this site. Sure, if you type in the sitename "

http://www.thebank.com",

or click on a link to it, you get the Content Advisor warning and it summarily denies you. Note all these are "http".

However, a link that looks like this:

https://www.thebank.com/wps/portal/...the+News/Press+Releases/Press+Releases+021405

... DID display contents. This also happened when I typed in "

https://www.thebank.com"

directly.

Why does the "https" bypass the site bans in Content Advisor?

 

[bcastner]

Did you add as follows:

http://www.thebank.com

https://www.thebank.com

Content Advisor, like Restricted Sites, does not block downlevel streams. An entry of

http://www.thebank.com

is implicitly entering

http://www.thebank.com/index.htm

. specify https: and http: entries
. specify the downlevel page that contains the access to account information

 

[linney]

Https and Content Advisor.

http://groups-beta.google.com/group...Advisor+and+https"+windows&qt_s=Search+Groups

 

[rjs]

You probably need to include the

http://www....

as well as the

https://www.

IE assumes http:// if you don't type it. So just

http://www.thebank...

only restricts http.

It may also be that HTTPS may be considered a "trusted" site by default.

R.Sobelman

http://www.tracklogins.com