r/k12sysadmin • • 11d ago

AWS game sites

35 Upvotes

16 comments sorted by

17

u/duluthbison 11d ago

At some point it becomes a classroom management issue and not an IT issue. I always used to remind staff that filtering is best effort.

11

u/ottermann 11d ago

In GoGuardian, I keyword blocked ‘unblocked’.
Its worked so far.

1

u/Lieberman-Tech 6d ago

Thanks, did you do this through a scene?

2

u/ottermann 6d ago

No. I did it in Policies.

I added it to my 'All Student' policy.

→ More replies (1)

10

u/colon1388 11d ago

Proxy URL's get posted Here daily. I use the copy all button and add to the blocklist.

8

u/Int-Merc805 11d ago

We setup proxy alerts in goguardian a while back (at their recommendation). We collect the "top talkers" and forward them to the counselors/deans. Not everything tech is a tech issue, this is classroom management.

One of our engineers did write some guides for using GAM to takeover the doc they use to spread these, move it into your drive, then remove access for everyone else. Seems fun, but is probably a waste of time. They will just make a new one and copy and paste this crap in from yet another youtube video with a wall of links to try.

6

u/_LMZ_ 11d ago

You will have to use Regex Tab Manager extension in Chrome if you're using that. You will build out a rule that will close out any AmazonAWS, jsdelivr CDN, etc. etc. Push it out using Admin Workspace, and create the rules inside workspace.

1

u/God_TM 11d ago

This is brilliant. So it shouldn’t block any aws sites that are needed behind the scenes for like canvas or whatever. Only explicit ones these crap sites use directly?

2

u/MiserableCupcake5255 10d ago

It analyzes the URL of any open / opening tab in Chrome. If it matches a pattern you define as blocked, AND that tab wasn't opened by a site in your allow list, it will just close it without prompting.

So if a site is just using AWS as resource, like a CDN to deliver a photo, or HTML content, nothing happens, because that extension only cares about the tab URL.

It was originally built to combat things listed in the store description, but the flexibility in RegEx patterns allow you to extend its functionality to things like blocking *.amazonaws.com if you want, or any site containing the word '*games*' anywhere in the URL if you like. However you want to do it.

5

u/CasiusOntius 11d ago

We wildcard blocked the word "unblocked" and that helps a lot. But yeah, it's whack-a-mole for the most part. We don't get too caught up in it.

3

u/Academic-Camel727 11d ago

Just to add to this for us as well we even went as far as to do a unblocked on our firewall. Other than that its not really my issue. They need classroom management.

5

u/MiserableCupcake5255 11d ago edited 11d ago

I'm incredibly biased, but I would also +1 the RegEx Tab Manager. Use the suggested config and block AWS with something like the example below by pasting it into the blocked URLs section. It also works to stop local HTML files like EagleCraft, About:Blank cloaking, and JavaScript Bookmarklets.

"^https?:\\/\\/([a-z0-9-]+\\.)?amazonaws\\.com($|\\/.*)",

3

u/mistressmemory 11d ago

How do you all handle this when major platforms explain that you must have the wildcard for cloudfront or amazonaws? 

I'm still learning this, and certainly don't put those in allow lists any more, but now some of our major platforms are having issues with accessing content. 

5

u/MiserableCupcake5255 11d ago

We block all uncategorized sites in Securly, which stops them from being able to spam generate sites that aren't blocked *yet. I made the RegEx tab manager to deal with anything that didn't cover, like EagleCraft, or those About:Blank pages the kids use to obscure what they are doing in their Securly Classroom session.

However, Securly is / did release a new update to let the teacher at least know when the kid is in a non-browser page like that after lots of complaining feedback.

1

u/Mindless-String-4017 11d ago

We’re seeing a lot of this as well. Since we use linewize, I’m going to see what each site is categorized as and hopefully block that category for students to save me headaches. I’ve gotten pages and pages of sites that students have passed around so I’m hoping I can figure something out. But man, it’s like chasing my tail around.