[isalist] Re: Infor - Help - Authentication

You just THINK I didn't get to see :-p

I always loved back in the day with the NEC voice gateway that allowed me to 
connect my DTerm directly to the phone system over an IP trunk where I would do 
a group page from CA.   I think you're the only one who understood how I did 
that :)  Those were the days.

More importantly, what made it TOTALLY appropriate is that it got the message 
across to people.  Don't fark about with my bandwidth, and don't play while at 
work.   Stick to company policy, or suffer the consequences.  That's really the 
message to the OP (who seems to have just dropped off his own thread).  The 
first thing to do is establish a policy with some teeth to it.  THEN implement 
your technological controls.  Otherwise, people will always find some way 
around them....

t



From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of John Wilson
Sent: Monday, October 12, 2009 3:26 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Infor - Help - Authentication

You know, the page really got mixed reactions. Especially since we (and by we, 
I mean Thor) implemented without telling anyone. Some middle-manager types 
tried to act self important, and say it was "entirely inappropriate" and other 
laughed and said it was cool as hell.

But the funniest stuff was the manager or two who got the page and the 
employees in the cubicle-world heard it through the office door. They would 
look at their boss and wonder "What is he looking at??"

T never actually got to see that part of it because he was remote.

John W.

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of Jim Harrison
Sent: Monday, October 12, 2009 4:14 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Infor - Help - Authentication

..probably ended up spending too much money on upholstery and carpet cleaning...

________________________________
From: isalist-bounce@xxxxxxxxxxxxx [isalist-bounce@xxxxxxxxxxxxx] On Behalf Of 
Ball, Dan [DBall@xxxxxxxxxxx]
Sent: Monday, October 12, 2009 10:35 AM
To: 'isalist@xxxxxxxxxxxxx'
Subject: [isalist] Re: Infor - Help - Authentication
I had forgotten about that page... I tried to re-create it here, but for some 
reason they didn't approve it.

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of Steve Moffat
Sent: Saturday, October 10, 2009 8:30 PM
To: ISA Mailing List
Subject: [isalist] Re: Infor - Help - Authentication

I know what it was called....

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of John Wilson
Sent: Saturday, October 10, 2009 8:38 PM
To: ISA Mailing List
Subject: [isalist] Re: Infor - Help - Authentication

So the customized ISA page with the spinning skull and crossbones  that yelled 
"Access Denied!" was pretty funny. It WAS called something else, but we won't 
go into that :)

Dan, sounds like you've got stuff locked down. That's how I'd do it!

John W.

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of Ball, Dan
Sent: Saturday, October 10, 2009 11:36 AM
To: 'isalist@xxxxxxxxxxxxx'
Subject: [isalist] Re: Infor - Help - Authentication

*bow*


From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of Thor (Hammer of God)
Sent: Friday, October 09, 2009 8:13 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Infor - Help - Authentication

Good for you - that's the way it SHOULD be done.

(And John, you didn't tell the class what happened to those people in the "Deny 
All" group as you call it.  And you KNOW it wasn't called that. :)

t

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of Ball, Dan
Sent: Friday, October 09, 2009 12:53 PM
To: 'isalist@xxxxxxxxxxxxx'
Subject: [isalist] Re: Infor - Help - Authentication

Ahhhh, but all of our computers ARE on the domain, they all have reserved IPs, 
they all have the Firewall Client installed, AND they are allowed through the 
ISA server only if they are a member of the proper AD group.  In addition, I 
bring it down to the protocol level, where they have to be in the proper AD 
group to use certain protocols and anyone who brings in a home computer and 
tries to plug it into our network will get an IP address in a range that is 
disallowed pretty much everything.

So.... They act up, they get taken out of the Web Access group, and no Internet 
for them.


From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of John Wilson
Sent: Friday, October 09, 2009 2:45 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Infor - Help - Authentication

Seriously, who do YOU know that dresses monkeys in clothes?

All aside, student PC's may be tough be cause they aren't joined to the domain 
necessarily, so GPO cant be applied if that is the case.

But you could give that computer a DHCP reservation so it gets the same IP 
everytime, and block it's IP address in ISA. Where I used to work, we had had a 
group called "deny all". Just drop the user in the group (if it's Active 
Directory) and they get blocked. If you don't have Active Directory, Just drop 
the computer by IP in the group. Done!

John W.

________________________________
From: Thor (Hammer of God) <thor@xxxxxxxxxxxxxxx>
To: "isalist@xxxxxxxxxxxxx" <isalist@xxxxxxxxxxxxx>
Sent: Friday, October 9, 2009 12:19:19 PM
Subject: [isalist] Re: Infor - Help - Authentication
Yeah, but you can also steal their Facebook account data and post pictures of 
naked monkeys.

t

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of Ball, Dan
Sent: Friday, October 09, 2009 4:12 AM
To: 'isalist@xxxxxxxxxxxxx'
Subject: [isalist] Re: Infor - Help - Authentication

Sounds like my daily battle with student Internet access...  Do you block or do 
you convince them to behave?  I'm lazy, so I block (but they also have an AUP).


From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of Thor (Hammer of God)
Sent: Friday, October 09, 2009 1:03 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Infor - Help - Authentication

Prevent them from making changes to the proxy configuration via group policy.   
Or require authentication for outbound HTTP(s) at the rule or at the web proxy 
network config.  Better yet, write out a corporate policy outlining acceptable 
use and Internet usage restrictions and have employees sign it -- If anyone 
violates policy, terminate their employment with extreme prejudice.

t

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On 
Behalf Of LEANDRO DOS S. FERREIRA - TI
Sent: Thursday, October 08, 2009 1:30 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Infor - Help - Authentication

Hi All,

I have a one user and this user does not have permisson in ISA to access the 
internet. If I login in a computer with webproxy and firewall client checked 
this user can not access internet web. But if I un-check the webproxy , he gets 
access to the internet.

I do know what happened !! A few days ago is OK. I do not know how can I block 
this. I would like to prevent users to access the internet even they 
un-checking the webproxy.

Only the users that have permisson can access the internet.

Can you help me ?!?!?

Regards

_______________________
Leandro dos Santos Ferreira
IT Team - Segurança da Informação
mailto:leandro@xxxxxxxxxxx
CBMM - Companhia Brasileira de Metalúrgia e Mineração
Inovar - Respeitar - Competir

Other related posts: