K-8 Filtering

(412) 690-2316 fax

Joel Lowsky

unread,

Oct 28, 2013, 2:04:22 PM10/28/13

to Edward Crist, Jaymon Lefebvre, Schlorff, Tony, K12 Google Apps Tech List

I'm curious ... is Securly an installed-client, or is it a DNS service?

Sean Eisner

unread,

Oct 28, 2013, 2:06:43 PM10/28/13

to Joel Lowsky, Edward Crist, Jaymon Lefebvre, Schlorff, Tony, K12 Google Apps Tech List

It is a DNS-based service. We just signed up with them last week. I have not rolled it out district-wide yet, but it looks like it will meet our needs.

Sean

Jaymon Lefebvre

unread,

Oct 28, 2013, 2:07:30 PM10/28/13

to Joel Lowsky, Edward Crist, Schlorff, Tony, K12 Google Apps Tech List

strangely, kind of both. its a DNS based service that also has forced sign on integration with GAFE.

Joel Lowsky

unread,

Oct 28, 2013, 2:09:56 PM10/28/13

to Sean Eisner, Edward Crist, Jaymon Lefebvre, Schlorff, Tony, K12 Google Apps Tech List

Doesn't that cause trouble for students connecting to their home networks? They might be able to get online, but they wouldn't be able to access networked printers, I don't think. And if they use the comps on some corporate networks or public libraries, they might not be able to do anything...

Also, are you worried about the kids figuring out how to change the DNS settings?

Thanks for answering...

Joel

Sean Eisner

unread,

Oct 28, 2013, 2:10:25 PM10/28/13

to Jaymon Lefebvre, Joel Lowsky, Edward Crist, Schlorff, Tony, K12 Google Apps Tech List

That is why I want to be a bit more comfortable with it before I roll it out district-wide. I was trying it with different browsers and seeing how browser-cache affects the initial page shown to anyone who plans on surfing while logged in with their district account.

Sean

Sean Eisner

unread,

Oct 28, 2013, 2:14:09 PM10/28/13

to Jaymon Lefebvre, Joel Lowsky, Edward Crist, Schlorff, Tony, K12 Google Apps Tech List

This in an interesting one. Unless I am the only one who cannot get around it (and this is possible) I can't change DNS/network settings on a Chromebook once it's enrolled in a domain. I've called support and I am told this is not possible. I said, "As a super admin, there MUST be a way to do this, right?" The reply, "That's a good idea and will be submitted for future upgrades."

On a non-Chromebook device, I would lock that portion of the network settings down. There is a very extensive audit trail with Securly, but it does have to go through their system, obviously. I am still playing with it, but I wanted something that would easily interface with GAFE.

Sean

Sean

Edward Crist

unread,

Oct 28, 2013, 2:19:41 PM10/28/13

to Sean Eisner, Jaymon Lefebvre, Joel Lowsky, Schlorff, Tony, K12 Google Apps Tech List

Well, Securly and I came up with a workable solution to the "take home" issue.

We have all Windows 7 laptops.

I wrote a script that sets 2 static DNS IP addresses...

#1 IP is our internal DNS server....when in school, all browser traffic goes through this DNS and is forwarded to the Securly servers.

#2 IP is one of the Securly DNS #'s.

So when the student is home, connects to home wifi (or any wifi), DNS IP #1 doesn't work since it's internal here at the school, but DNS IP#2 picks up the traffic and routes it all to Securly's servers

We've been doing this for 2.5 months now and it's working flawlessly.

Edward Crist

Technology Manager

City Charter High School

201 Stanwix St.

Pittsburgh, PA 15222

(412) 690-2316 fax

Bjorn Behrendt

unread,

Oct 28, 2013, 2:29:46 PM10/28/13

to Joel Lowsky, K12 Google Apps Tech List

1. Network printers are all done using Cloudprint (https://tools.google.com/dlpage/cloudprintservice), so the problem is less about access to printers while in school and more about preventing them from printing to the schools printers form home.

2. You set the Securly DNS up as a Forwarder on your internal DNS server, and there is no need to touch the Chromebooks DNS.

3. For take home I am not as verse on (I don't believe in filtering off-campus), but I think it is a Chrome-app that tells the device to look at Secur.ly. I do know that Secur.ly registers the public IP of where the Chromebooks are connecting from. So if I am remembering correctly students can use the default DHCP settings on any network, but if they are logged into the Chrome Browser using their school address they will be filtered if you have that turned on.

Bjorn Behrendt M.Ed ~ Never Stop Learning

b...@askbj.net | (802) 772-0003

Google Apps For Education Certified Trainer

My Sites

~ Edlisten.com ~ Educational Podcast

~ AskBj.net ~ Online Training and Ed Tech Resources

~ VTed.org ~ Vermont's Personal Learning Network

gClassFolders ~ Create Google folders for your class.

Jaymon Lefebvre

unread,

Oct 28, 2013, 2:40:29 PM10/28/13

to Joel Lowsky, Sean Eisner, Edward Crist, Schlorff, Tony, K12 Google Apps Tech List

I think Joel brings up a good point though. If the device with the forced DNS settings goes to a location where DNS is restricted, that would be a problem.

My institution for example, implements a DNS hierarchy. You first use your site based DNS server, which has forwarders upstream to a couple core DNS servers, which then again forward upstream to Google's DNS for public resolution.

If someone was to bring a device on location that forced securly as the DNS as the only option, this would absolutely be a complete fail.

Im not really looking for the off campus filtering (as other's here have also mentioned) so for me this is not a huge concern. In Canada, I do not believe we have the same legislation as the US does.

In a webinar I watched, Securly had made a statement that if the device was owned and provisioned from the school authority, and it was being given to the student's for use at home, then the school authority remained responsible for web content filtering. Again, Im not the expect in this subject matter, it is just what I was led to believe. Maybe someone down south has a better idea. All I know is that in Canada, a piece of legislation or advisement on policy has yet to come across my desk.

Cheers,

Jaymon

Edward Crist

unread,

Oct 28, 2013, 2:51:32 PM10/28/13

to Jaymon Lefebvre, Joel Lowsky, Sean Eisner, Schlorff, Tony, K12 Google Apps Tech List

Jaymon's points are valid. We have over 650 laptops taken home each night and no one is reporting any DNS issues. (been waiting to hear, knock on wood)

Securly also offers a proxy service for take home laptops....more expensive though.

Edward Crist

Technology Manager

City Charter High School

201 Stanwix St.

Pittsburgh, PA 15222

(412) 690-2316 fax

Jaymon Lefebvre

unread,

Oct 28, 2013, 2:57:45 PM10/28/13

to Edward Crist, Joel Lowsky, Sean Eisner, Schlorff, Tony, K12 Google Apps Tech List

Cheers Edward. My authority also restricts proxy services at Layer 7. so you would not get DNS to work, or a proxy solution unless I explicitly allow it.

This is most likely not going to be an issue for use at home, but if Bobby brings the device to Mom or Dad's work to use the guest network there, it most certainly could be. The differentiation is basically going be whether it is a home router (pretty standard default ACL's, allow inside any to outside any) versus a corporate maintained router (which generally is default deny inside any to outside any)

Wes Bartlett

unread,

Oct 28, 2013, 3:03:01 PM10/28/13

to k12ap...@googlegroups.com

For those of you using securly offsite - are you using it with chrome books? I don't see any way to manage the DNS setting which leaves us with the more expensive proxy solution from them. We are getting ready to do a pilot of the service, largely for at home filtering which is desired by others in my environment.

Thanks,

Wes Bartlett

Network Administrator

Perrysburg Schools

419-872-8840

A+, N+, ACMT

Confidentiality Notice: This message may contain student personally identifiable information that is confidential. Such information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution or the taking of any action in reliance on the contents of the information contained herein is strictly prohibited. If you receive this email message in error, please immediately notify me by telephone at 419-874-9131. Please also delete the message from your computer. Thank you.

Doug Blatti

unread,

Oct 28, 2013, 3:00:58 PM10/28/13

to Sean Eisner, Joel Lowsky, Edward Crist, Jaymon Lefebvre, Schlorff, Tony, K12 Google Apps Tech List

Just to clarify – there are 2 products. I believe both can share a single rule-set on the backend. They sell the DNS based service as an on-site filtering solution and the proxy solution as the “Take-home 1:1 Chromebook Filtering”.

Doug Blatti

Technology Program Manager

Community High School District 155

@dblatti, http://blatti.net

Jaymon Lefebvre

unread,

Oct 28, 2013, 3:08:33 PM10/28/13

to Doug Blatti, Sean Eisner, Joel Lowsky, Edward Crist, Schlorff, Tony, K12 Google Apps Tech List

as well, they offer a "relaxed take home" policy, if you wanted to say allow things like social media and chat from home, but not at school.

Edward Crist

unread,

Oct 28, 2013, 3:31:50 PM10/28/13

to Jaymon Lefebvre, Doug Blatti, Sean Eisner, Joel Lowsky, Schlorff, Tony, K12 Google Apps Tech List

We lock our Windows laptops down with GPO's so kids can't get to the DNS settings.

My daughter goes to our school and I did extensive testing with her and her laptop at home, and 12 different private and public internet hot spots. So far, she's connecting and getting filtered through Securly.

The forced login feature is really nice...no browsing at all unless you are logged into our school GAFE account.

The guys at Securly have been great to work with....so far they have shown themselves are really committed to making it work and listening for ideas on future development.

There is no reporting feature to speak of except for an audit download....but it's fine for now till they improve that part of the program.

Edward Crist

Technology Manager

City Charter High School

201 Stanwix St.

Pittsburgh, PA 15222

(412) 690-2316 fax