LocalHero said:
Someone has asked me how to stop a computer that can be used by a
number of people from connecting to Facebook.
Is this something that could be done with the HOSTS file?
If so, how would that be done?
If not, any other ideas for a simple solution?
Many thanks
What's to stop those users from altering the 'hosts' file? If users
have physical access to a host then they can modify its configuration.
Using admin-level versus limited accounts does not preclude smart users
from getting around those permissions *within* an instance of an OS.
They'll just step outside that OS instantiation to make changes. You
need to employ your censorware somewhere upstream in a host or network
node to which the users do not have physical access, like at a gateway
or router host or even further by enforcing your users to use a DNS
service where you can define what to block in any DNS lookups (which
won't help if the users use IP addresses instead of hostnames).
How is a 'hosts' file going to work on a laptop or network that an
employee brings into work (and upon which your IT department didn't
setup with their customized 'hosts' file)? Does your company even
permit the use of non-authorized hosts on their corporate nework?
In your network's router, block all DNS requests (port 53) that go
anywhere other than to your router. Tell your router to block on
particular hostnames if that feature is available in your router. If
not available, configure your router to redirect DNS requests to a DNS
provider of your choice that lets you add blocks or select categories of
sites. After all, if your company is trying to prevent its employees
wasting time at Facebook then why wouldn't they also want to prevent
wasted time at other ego-stroking childish inane social sites, too? You
can use OpenDNS for free with a single account there. Besides
categories you can also block on specific URLs (hostnames) but there is
a limit of 50 in the free account. If it's a business then they should
afford a business account at OpenDNS. Of course, if it is a business
interested in censoring to where their employees navigate outside their
corporate network then they should be looking something like Websense
for censorware.
If these are children using the same computer, why aren't their parents
monitoring their activities? Or, at least, employing censorware
installed on the kiddies computer to regulate where they can visit? If
they are adults and continue abusing company policy then treat them like
children and take the computer away from them. If that means they
cannot perform their work tasks then suspend them without pay for the
time the computer's access is suspended for their use. Either you treat
the users as adults that get punished when they abuse their use of
someone else's property or resources; else, you treat them like children
for which several censorware schemes are possible. Just telling them
that all their network connections are being logged and any violation
results in punishment might be sufficient to deter that abuse but
obviously that means you must actually have a policy defined that you
will then enforce.
To deter without punishment will eventually lead to the abusive users
finding another means of circumventing your schemes, like using IP
addresses, proxies, tunneling within other (non-HTTP) protocols, etc.
If they have the time to waste at work stroking their egos at social
sites then they also have the time to thwart your local censor measures.
After all, if they are at work and are expected to work during their
work hours then do they really need Internet access at all? Are they
really web site designers testing their output?
