blocking web proxies

Doug.Baggett · 2006-05-23T20:34:03+00:00

I've seen all sorts of people proclaiming that it's impossible to blockpeople from using external web proxies to sites (like myspace) withoutblocking the whole internet.Why could'nt you...1. Require everybody on your internal network to use YOUR authenticatedproxy.2. Block ALL encrypted outgoing activity by default through the proxy(except for authorized individuals). This is to keep somebody fromsetting up squid at home through a broadband connection and connectingto it via SSL or some other encryption. Basically if your sniffer doesnot recognize/can't decipher the traffic...block it.3. Sniff packets at your proxy for your blocked sites (like myspace)and deny them outbound access.This way anybody trying to access myspace through a public or privateexternal proxy would be stopped cold. Even if they successfully connectunencrypted to a public proxy your sniffer should be able to sniff the"" address from the packets and keep it from going through.Plus you'd have their userid and IPaddress on the inside (so you candrop an anvil on them!). In addition things like SSH would get blocked(due to encryption) so no forward or reverse port forwarding/layer 2vpn would work.Are there holes in my Evil(TM) network admin setup? :)