Solved

block website terminal server hosted

Posted on 2015-02-13
13
29 Views
Last Modified: 2015-03-05
hey guys,

we have an offsite terminal server that users connect to. I'd like to block youtube, facebook, etc for the majority of users.

What's the most cost effective way to do this?
0
Comment
Question by:Cobra25
  • 4
  • 4
  • 3
  • +1
13 Comments
 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 40609414
The best way to block content has been and still is at the network edge. A simple UTM can do this, and even the basic models can do this easily. Perfect to drop in front of an offsite server as they can often be centrally managed.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40609416
Cliff, this is hosted outside of our environment. We dont control the network edge.
0
 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 40609428
Ahh. That wasn't mentioned in your question. "Offsite" could be a colo facility or other circumstance as well. But it doesn't change my advice much. Most good hosting environments still provide you a sandboxes network environment where all your host machines can communicate. In that situation, I'd run a UTM as a hosted service. Barracuda, Sophos, and many other UTM vendors can run as software, not just as an appliance. I have this set up for several clients in azure and AWS. But the principle is the same with other hosters as well.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40609432
a UTM device is NOT an option here.
0
 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 40609441
Well, you've painted yourself in a corner then. There are very few agent-based web filtering products that can run on a server OS. They tend to version-check and run on client OSes only. And the few that do often don't run on RDS (the proper name for terminal services.) So you are looking for that 1% of 1%. And they are not inexpensive, as you asked for.
0
 
LVL 13

Expert Comment

by:upalakshitha
ID: 40609777
Add record to host file 127.0.0.1 facebook.com
Do same for other sites.but this will affect for whole server.all users will be blocked.
Thank you
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 13

Expert Comment

by:upalakshitha
ID: 40609781
Also if server is not a member of any domain, if you can point server dns to opendns you can have perfect filtering for free. This also applies to whole server.
Thank you
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40609889
Upalak, yes it is on domain
0
 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 40610271
DNS does not block web traffic *at all.* While it can make finding Facebook 'slightly' harder, it is easy to circumvent.
0
 
LVL 23

Expert Comment

by:Dirk Kotte
ID: 40610853
would suggest to use a content filtering proxy in one arm installation beside the terminalservers and configure the proxy settings via GPO.
These "proxy" can be a UTM (like sophos UTM) also.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40636856
would openDNS work?
0
 
LVL 23

Accepted Solution

by:
Dirk Kotte earned 500 total points
ID: 40636971
i think that`s possible.
but if someone use the IP instead the dns-name the dns-filtering has no effect.
there are ip-reacheble anonymizing  proxys which bypass your dns-filter.
0
 
LVL 13

Expert Comment

by:upalakshitha
ID: 40639612
No.if you have blocked with host or domain name, it does not allow browsing from ip too.
Add facebook & youtube domain to opendns block list. Then block proxy sites catagory it is enough . Now no way to browse fb.
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

Remote Apps is a feature in server 2008 which allows users to run applications off Remote Desktop Servers without having to log into them to run the applications.  The user can either have a desktop shortcut installed or go through the web portal to…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now