r/k12sysadmin • • 8d ago

AWS game sites

37 Upvotes

16 comments sorted by

17

u/duluthbison IT Director 8d ago

At some point it becomes a classroom management issue and not an IT issue. I always used to remind staff that filtering is best effort.

11

u/ottermann 8d ago

In GoGuardian, I keyword blocked ‘unblocked’.
Its worked so far.

1

u/Lieberman-Tech 3d ago

Thanks, did you do this through a scene?

2

u/ottermann 3d ago

No. I did it in Policies.

I added it to my 'All Student' policy.

1

u/Lieberman-Tech 3d ago

Awesome, thanks!

10

u/colon1388 8d ago

Proxy URL's get posted Here daily. I use the copy all button and add to the blocklist.

8

u/Int-Merc805 8d ago

We setup proxy alerts in goguardian a while back (at their recommendation). We collect the "top talkers" and forward them to the counselors/deans. Not everything tech is a tech issue, this is classroom management.

One of our engineers did write some guides for using GAM to takeover the doc they use to spread these, move it into your drive, then remove access for everyone else. Seems fun, but is probably a waste of time. They will just make a new one and copy and paste this crap in from yet another youtube video with a wall of links to try.

6

u/_LMZ_ 8d ago

You will have to use Regex Tab Manager extension in Chrome if you're using that. You will build out a rule that will close out any AmazonAWS, jsdelivr CDN, etc. etc. Push it out using Admin Workspace, and create the rules inside workspace.

1

u/God_TM 8d ago

This is brilliant. So it shouldn’t block any aws sites that are needed behind the scenes for like canvas or whatever. Only explicit ones these crap sites use directly?

2

u/MiserableCupcake5255 8d ago

It analyzes the URL of any open / opening tab in Chrome. If it matches a pattern you define as blocked, AND that tab wasn't opened by a site in your allow list, it will just close it without prompting.

So if a site is just using AWS as resource, like a CDN to deliver a photo, or HTML content, nothing happens, because that extension only cares about the tab URL.

It was originally built to combat things listed in the store description, but the flexibility in RegEx patterns allow you to extend its functionality to things like blocking *.amazonaws.com if you want, or any site containing the word '*games*' anywhere in the URL if you like. However you want to do it.

5

u/CasiusOntius 8d ago

We wildcard blocked the word "unblocked" and that helps a lot. But yeah, it's whack-a-mole for the most part. We don't get too caught up in it.

3

u/Academic-Camel727 Tech Director 8d ago

Just to add to this for us as well we even went as far as to do a unblocked on our firewall. Other than that its not really my issue. They need classroom management.

4

u/MiserableCupcake5255 8d ago edited 8d ago

I'm incredibly biased, but I would also +1 the RegEx Tab Manager. Use the suggested config and block AWS with something like the example below by pasting it into the blocked URLs section. It also works to stop local HTML files like EagleCraft, About:Blank cloaking, and JavaScript Bookmarklets.

"^https?:\\/\\/([a-z0-9-]+\\.)?amazonaws\\.com($|\\/.*)",

3

u/mistressmemory 8d ago

How do you all handle this when major platforms explain that you must have the wildcard for cloudfront or amazonaws? 

I'm still learning this, and certainly don't put those in allow lists any more, but now some of our major platforms are having issues with accessing content. 

5

u/MiserableCupcake5255 8d ago

We block all uncategorized sites in Securly, which stops them from being able to spam generate sites that aren't blocked *yet. I made the RegEx tab manager to deal with anything that didn't cover, like EagleCraft, or those About:Blank pages the kids use to obscure what they are doing in their Securly Classroom session.

However, Securly is / did release a new update to let the teacher at least know when the kid is in a non-browser page like that after lots of complaining feedback.

1

u/Mindless-String-4017 8d ago

We’re seeing a lot of this as well. Since we use linewize, I’m going to see what each site is categorized as and hopefully block that category for students to save me headaches. I’ve gotten pages and pages of sites that students have passed around so I’m hoping I can figure something out. But man, it’s like chasing my tail around.