RE: Internet Cafe

[Terry Peterson <tpeterson () snocom org>]

Unfortunately the current Firewall does not support any kind of bandwidth
throttling.  The ISP will not allow access to the router without giving up
support for it.  After all the feedback I think I will research an open
source solution and put some box between workstations and firewall.  Thanks
everyone for the feedback!

Terry Peterson 


-----Original Message-----
From: DeNoyer, Rick [mailto:rdenoyer () Salinas gannett com]
Sent: Thursday, January 16, 2003 11:06 AM
To: Terry Peterson; security-basics () securityfocus com
Subject: RE: Internet Cafe


Have you tried to use "Bandwith Throttling" at the NAT/Firewall per ip
address?  If you use DHCP perhaps you can just include that whole scope in
the rules you decide to set up.  I know this works with IPFW on BSD.

-Rick DeNoyer

-----Original Message-----
From: Terry Peterson [mailto:tpeterson () snocom org]
Sent: Wednesday, January 15, 2003 12:32 PM
To: security-basics () securityfocus com
Subject: RE: Internet Cafe



I currently own an internet cafe.  Instead of applying strict policies we
have decided to image the hard drives often.  We have found that we had to
lock down the boxes to tight that they became difficult for our customers to
use.  So far, we have not had anyone attempting to compromise the systems or
use our center to source attacks.  Out biggest problem is figuring out a way
to limit bandwidth usage.  Is anyone aware of anyway to limit download
bandwidth on a per machine basis?

Terry Peterson


-----Original Message-----
From: Ferry van Steen [mailto:ferry.van.steen () InfoPart nl]
Sent: Tuesday, January 14, 2003 11:38 PM
To: security-basics () securityfocus com
Subject: Internet Cafe


Hey there,

for the first time I have to setup an internet cafe. I want to use Win2k
on the workstations and "cripple" it using the policies it has, then use
linux as a firewall/proxy with squid. Having only a proxy and not a
gateway should already narrow down a lot of security issues, but I
believe kazaa and some others still work through proxies and I have
hardly any idea on how secure the win2k policies are... Basically all I
want to allow them is using IE on websites/ftp sites, they should be
able to download, but only to a single folder and msn messenger should
work.

Anyways, anyone got any suggestions/comments on what I really have to
look out for? I'm thinking it should be reasonably secure, but in places
like this you always have the added risc of people wanting to damage the
OS/system or use it as a place from which to attack others.

Kind regards and TIA,

Ferry van Steen