Question for the gnus. I have tied down my network so only users whos MAC address I have registered in my router can access the network. What software is there available so I can log what each user is accessing from the internet?? It is so I can check if they are accessing porn or suchlike.

Cheers

Simplest soultion would be to add a proxy server.

block outbound 80 on the router to prevent the easy trick of removing said proxy from settings; which is my personal fave trick

Let the proxy do the work and then you can add white and black lists as you see fit , even authenticate against ldap in case your users leave there pc logged on and claim the can't of been me gov clause.

I see where you are going with that Col Trouble is it sounds quite time consuming and that is something I do not have! This network is a sideline from my normal job so I cannot plunge too much time into it really (sounds crazy I know!)

There are "Nanny" programs (keyloggers and screenshot recorders) which you can apply to home computers, but presumably capable of mini networks. I'm sure business equivalents are available.

My first thought if you want them to stop, would be to tell people that you are installing monitoring software and during testing it is already recording activity (rather than blocking access). That way, it might make them think twice and will give you some breathing time till you can look at all the options.

Regards

Mo

Edit: You might have a riot on your hands because you are checking up on them, but is that worse than spying on them covertly?

What software is there available so I can log what each user is accessing from the internet?? It is so I can check if they are accessing porn or suchlike.

Check the router, might have a site access log. How much it will tell you about which users are doing what will depend on the router, but ultimately if you are in a position to be clamping down on usage policy then usually the best way is "general warnings" rather than picking on specific users.

Rob.

What router are you using?

Some routers, a lot of netgear ones, for instance, show you what domain requests have gone through it.

EDIT: Ah, Rob beat me to it

if you can be doing with putting a linux PC between the network and the outside world then there is loads of stuff you can do. iptraf can log it.

Otherwise you could just stick ethereal on a machine of yours, put your network card into promiscous mode and suck up everyones packets to see what they are doing.

Would you have time to set up MS ISA server? It's a pretty easy setup if you only need to log/prevent access to a particular site or whatever and logs all access as default. The other bonus is you can ban specific sights, words, domains etc... Plus it's a step-up on the security front too.

Also, you can send specific IPs to a local html page of your creation - it's amazing how quickly people will make tea if the internet tells them to and they can't look at anything else

SreVRs,

Again can do this with linux and don't need to buy an ISA license. We have ISA at work and it's painful at best. Easy to set up for sure, but awful at scaling under any sort of serious load.

Cheers for all responses The warnings have but the willies up most folk. Especially as I have tied the router down to MAC addresses and they have to give me all their details before they go online. Plus they have been warned if caught accessing illegal material (I am in Oman so bikini shots are iffy lol) They will be dealt with by military law!!!!

SreVRs' date='

Again can do this with linux and don't need to buy an ISA license. We have ISA at work and it's painful at best. Easy to set up for sure, but awful at scaling under any sort of serious load.[/quote']

Good point - We've somebody who deals with licensing where required so I always ignore that side of things.

IMHO to a non-Linux native the command line can be a bit daunting though - I've a Mandrake box at home that I sometimes struggle with doing more involved tasks so for someone who (I assume as it's not his normal job) isn't particularly used to that stuff I'd imagine it would turn into a problem.

Again, scalability isn't an issue for the numbers involved - if he's using MAC authenticatuion I'd imagine under 100 users before it becomes a ball-ache to manage - not a problem for ISA.

(This is where I get told there's 3500 users and they're just REALLY organised admins there :eek: )

Edit: cheezemonkhai - have a quick nosey at 2004 if you haven't already - we're running a test box with it on at the mo and it looks pretty good - a big improvement over 2000.

lol 3500 users!!!! Nope 20 at most lol!!!

I think we are going to purchase a better router as this linksys one sucks!!

ZyXel do some excellent ones I have a 652 security router and this is being replaced by a 662HW. This can also do radius authenitcation so you would need to set up a small radius server (isn't hard with right instructions).

This way you could log exactly who looked at what at what time too