Linux

Ask something
Discussion Locked

Surfcontrol

0 helpful
14 replies

by eric.talbot

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am currently trying to find a software for Linux similar to SurfControl. The feature i am mostly interested in, is web surfing reporting. Basically i would like to know who browse the internet and where did they go, at what time ...

Any idea ?

14 replies

by jmgarvin

Squid with Squidguard provide excellent blacklisting.

If you have to have blacklisting NOW, then I suggest modifing your hosts.deny with the black listed URLs...until you get Squidguard up and running.

You can check my blog for a quicky squid setup.

by eric.talbot

Can we use SQUID without changing the user's settings. This is because i'd like to roll this out without changing anything on my 289 user's workstation !

I've read a bit on that and it looks like i have to change every user's Web browser to use this proxy server.

Superscout can do that by redirecting the internet traffic ( if my memory is reliable !! ) to a specific server ( ours )

thanks for the input !

by jmgarvin

Your proxy and blacklist would simple filter. Changing the users home pages isn't needed.

I'm slightly confused by your meaning, so maybe I'm not fully understanding your point.

by michael.durkin

I cehcked out Squid and Squidguard. It looks pretty weak to me. I know I am comparing it to commercial packages, but they aren't that expensive and for the improved functionality, it seems to me like it is well worth it. I compared the descriptions and screenshots from SQUID and it looks to me like it lacks many of the basic and critical functionality. Personally, I don't think it is an acceptable alternative.

by eric.talbot

Instead of using a proxy, is there a way i could do a summary of what is going on the network ( source, destination ports ... )

by jmgarvin

You can also use a firewall as a ghetto style proxy and blacklist. You can also track connections to and from IPs. Is that what you need?

iptables can do this for ya...

by eric.talbot

Well it sounds good, but my understanding regarding iptable is that it filter. Can i have iptable being on a subnet and auditing each and every communication ?

by eric.talbot

In fact what i mean is there is something to configure on the browser to use the proxy. My goal is to track user's behavior ( not really blocking them ) and i don't wanna go on each and every workstation to set the proxy settings. So may be the proxy could be a gateway ( acting as a firewall ) but this way, this would be a single point of failure for internet access.

So i found a post on the internet to automatically set the proxy settings on the user's browser :

http://www.grape-info.com/doc/win2000srv/internet-gw/wpad/index.html
And perhaps this can help.

by jmgarvin

I still think the easiest solution (long term) is a proxy. However, iptables will produce pretty good logging of who did what and when and where.

by jmgarvin

iptables is what is called a stateful firewall. Which means (in essence) we are tracking connections and not just a simple packet filter.

There are various log tool analyzers...I've used:
http://www.gege.org/iptables/

As long as the traffic passes through that firewall, it'll be logged.

Does that make sense?

by eric.talbot

Ended up using TCPICK,

This tool can sniff out the network do a reverse dns lookup on destination host, return all the GET command requested from the web sites. No local cache storage therefore can be used on large network.

This discussion is closed to new replies.