limiting URL access

[stratplan]

I thought I would ask for some help from the experts here:

I have a client who sends employees to the field and the employees have Internet access (though AOL) to send back information.

Sometimes the employees use the Internet access to 'browse' inappropriate places, like last week one ordered some stuff off a special credit report deal - charging the company for it. Uh oh. Hey, these offers sound SO good! These field guys are blue-collar good guys who are not net savvy.

Is there a way to restrict a stand-alone computer connected to the internet to say, only one URL like the home office? I know a LAN or firewall might work, but this is a little different.

Any suggestions appreciated.
----added 5/4/04----
After reviewing, I think what I need is a proxy setting. What would be the PORT for accessing the homeoffice URL?

[jwayne]

A personal firewall residing on the pc can be configured to do this. At the most extreme, you would deny outbound access to all apps except for the browser, which would be configured to deny all connections except port 80 to the desired url (possibly also 443 https access needed.)

There are, of course, ways around this unless you spend a lot of time locking down the workstation (Windows 2000, Windows XP), although if the user is computer savvy even this can be bypassed.

Sounds like the real problem, however, is not a technical one but a management one. The client needs to set down the law for employees, or take away their credit cards!

[stratplan]

A personal firewall may be the way to go if I can't modify/tune the browser to only connect to the office URL.

you are correct about user education, but like I said, these are blue-collar guys that are in a rather technical position (the company needs their skills) so it is tough to 'threaten' them with much.

I'll check out firewalls to see if that would do it. Thanks for the pointer.

Dick

[edwurster]

You could set up the AOL internet access as a kids account, and remove IE.

[stratplan]

that sound like it could work...

I'm not an AOL user but their website is about as propriatory as Microsoft's software

Everytime I go to some interesting stuff (using MSIE) it says "The HTTP request presented by your browser is invalid."

Maybe it wants a AOL browser?

Thanks again

[TechWeasel]

Hi strat,

The easiest and best approach I can think of would be to set your "hosts file" on the laptops in question as a whitelist to only allow the particular domain in question, and then use it as the sole DNS.

There's detailed instructions on how to do this here:

http://www.pcmag.com/article2/0%2C17...95227%2C00.asp

It requires nothing other than notepad and would take a couple of minutes tops.

The great thing about this approach is it doesn't matter if the user installs their own software, or uses a different internet connection - they will only be able to access the one site.

Plus it's very difficult to undo, especially so for "non tech" people.

Let me know if there is anything in the article that isn't clear.

[stratplan]

very impressive and on target. I'm not sure if they use XP but maybe this will work on any OS

Thanks for the tip.

Dick

[TechWeasel]

Host File Paths (cribbed from remember.mine.nu )

(Note that the file name is "HOSTS" with no extension so it is not a directory in the paths below... just a file)

Microsoft Windows 95/98:
C:\WINDOWS\HOSTS

Microsoft Windows NT/2K:
C:\WINNT\SYSTEM32\DRIVERS\ETC\HOSTS

Microsoft Windows XP:
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS

Linux/BSD/Solaris/Unixes:
/etc/hosts

BeOS:
/boot/beos/etc/hosts

Macintosh OSX/10.X:
/etc/hosts
(Note: although you need to enable the /etc/hosts lookup... see here )

Macintosh (non osx) method #1 Place the Mac Hosts file in the Preference folder. re-name it "Hosts" (exact case matters) shutdown, restart.

Macintosh (non osx) method #2 Copy the Mac Hosts file to your computer re-name it "Hosts".
In the TCP/IP Control Panel, choose 'Select Hosts file' Select this file.Close and restart.

[TechWeasel]

Incidentally this is a great way to set-up Internet enabled "kiosk" computers if you want them to only be able to access a certain site (say demonstrating a website at a trade show or having a store's online catalogue available at a terminal in the store).

[Nate]

This is definitely right on target. I have been using this technique for a while now and the less tech-savvy people are clueless that I have done it. Works even better if they don't have admin on the machine and thus, cannot change it even if they wanted to. I found another site very useful, with a 'starter' hosts file with lots of bad sites. The only issue I have found is that some XP machines won't like a massively huge hosts file - and if you turn off DNS client service (which you don't really need anyway) and restart it will work fine.

http://www.mvps.org/winhelp2002/