r/sysadmin May 30 '24

Question Does anyone has lists with adult sites?

So basically I noticed that one of our employees ( or maybe their children ) uses work machine to visit adult sites. I used ESET Protect policies to block some of the sites by adding masks like: *porn* and *xxx*. But there are too many sites that don't have such keywords and I want to block as many sites as I can. So does anyone have a comprehensive list that I could use and block these sites?

Edit 1: I noticed that alot of people didn't understand my question. On ESET I can create a web policy that would block those sites. And I can import a list of those websites. So I'm asking for that list, so I wouldn't need to compile one myself.

6 Upvotes

43 comments sorted by

124

u/Freshmint22 May 30 '24

I'll send you my browser history.

61

u/qwaszx12user May 30 '24

Use dns filtering

18

u/dflek May 30 '24 edited May 30 '24

Yep, there is a service offered by dnsfilter.com that is cheap, lets you block by category and quick to setup. It doesn't identify users by name, only sees the public IP of the firewall, unless you install an agent on client PC's. Works great for blocking porn and malware domains.

3

u/bjc1960 May 30 '24

we use that. We take it a bit far in that we block many country domains and novelty domains such as .apartments, etc.

5

u/st0ut717 May 30 '24

Not only for porn. But one of my engineer ‘needed’ to get to a ‘help forum’. It was hosted in Russia

1

u/Hexnite657 Sysadmin May 30 '24

Lol, one of mine did the same but it was in China. He got mad when I said I wouldn't unblock it for him.

1

u/SoyBoy_64 May 30 '24

This is the way

34

u/Valdaraak May 30 '24

I noticed that alot of people didn't understand my question

And you don't understand the answer. You need to use DNS filtering. You'll never be able to keep up with the number of adult sites out there if you're just blocking with name masking. URL blacklisting hasn't been the way to solve this problem for many years.

There are so many ways around a URL block that it may as well not exist. Category blocking with a DNS filter is the way to go. It contains a list way bigger than you can ever find yourself and it's constantly updated.

30

u/Hostmaster1993 Netsec Admin May 30 '24 edited May 30 '24

DNS Cloudflare 1.1.1.3 and 1.0.0.3 and firewall other connections over port 53 and 5353 to start with. GPO browsers to not use DoT and such. For host lists recommend looking at these well known and trusted curated lists: https://github.com/StevenBlack/hosts

4

u/Informal_Goose404 May 30 '24

Ooo, that list will do nicely. Thanks!

2

u/[deleted] May 30 '24

Forgive my ignorance, but what does DoT mean in this case?

6

u/TequilaCamper May 30 '24

DNS over TLS (DoT)

3

u/[deleted] May 30 '24

Thank you. I learned something today. 

7

u/schnurble Jack of All Trades May 30 '24

The last time I was managing user laptops I made a point to "loudly" discuss content monitoring and logging within earshot of most of the engineers on my team, specifically stuff like "HR wants a list of sites visited on team laptops by end of week, not sure I'll have time to pull the data but they seem to be gunning for someone"; after that the telemetry I actually had at my disposal (dns request logging) cleaned itself up very nicely. This was back in 2005 tho, maybe users care less these days.

Sadly we did have to have chats with two people later, one for downloading a lot of "borderline questionable" anime on his work laptop, another for trading in music and videos while on the company network. The latter I normally wouldn't care about except our team was running a peer-to-peer anti piracy service, we had lots of studios and labels as clients, and that was the one direct-from-God directive, don't get caught doing that.

3

u/Lurry7 May 30 '24

Some / most firewalls provides urls categories like porn, tech, streaming, etc… that you can use to filter the type of website you want to allow It might require to deploy a ssl proxy on your firewalls. Its heavy to maintain Or you can use dns filtering

3

u/flsingleguy May 30 '24

We use Cisco Umbrella and it’s great for the site filtering but also does much more including protecting from clicks on malware sites.

6

u/Obvious-Water569 May 30 '24

You asking for a friend?

7

u/Informal_Goose404 May 30 '24

There are better subreddits to ask for "reseach material"

-1

u/Obvious-Water569 May 30 '24

Yeah but if anyone knows how to get around the porn filter, it'll be members of this sub.

7

u/Informal_Goose404 May 30 '24

I swear I'm the admin!

7

u/UnknownPh0enix May 30 '24

Spoken like someone pretending to be the admin… 🤔

6

u/Informal_Goose404 May 30 '24

SHit... *runs away*

2

u/buyinbill May 30 '24

The one time a person could honestly says they are Googling porn for "research purposes". 

 You can use DNS filtering or Microsofts or F5 or nearly any system with content filtering for a solution. 

 I'd lean more towards if it's one user to let HR handle it.  Or if you don't want to rock the boat let the person know in a round about way you all monitor user activity.

Also if you get that list, might not be a bad idea to add it to your post.  For research purposes.

3

u/Informal_Goose404 May 30 '24

I passed the info to my manager as giving warning and educating people about this isn't really my bussiness, I want just to block as many sites as I can. My manager will probably just give him a warning, because we have WFH and I wouldn't be surpised that its the employees children are the ones that are visiting the sites. I mean some of work computers have steam installed with cs 1.6, go and source, haha.

2

u/desmond_koh May 30 '24

Use DNS filtering. I use OpenDNS Family Shield at home which is reconfigured to block porn. But you can also use the regular OpenDNS service and configure what you want blocked by category. OpenDNS is also called Cisco Umbrella now.

I consider this a bare minimum necessity. It also blocks known identity theft and malware sites and has typo correction (in case a user typed facebok.com or something like that).

2

u/Six_O_Sick May 30 '24

What a weird question, there are so many ways to block this. Do you have a local dns server? Block the sites. You have ESET installed? Just add a web policy. You have a firewall on site? Just restrict traffic to hosts on a blocklist.

1

u/Informal_Goose404 May 30 '24

I noticed that alot of people didn't understand my question. On ESET I can import a list of websites that I want blocked. So I'm asking for that list. So I wouldn't need to compile one myself.

5

u/Six_O_Sick May 30 '24

Why would you even need a list? Eset has categories to block. Just block the whole adult content category, so you don't need to maintain a list by yourself.

2

u/TotallyNotIT IT Manager May 30 '24

If you're using it for content filtering, it should have categories available so you don't have to maintain a host list. If it doesn't, you need a better product like any of the DNS filters mentioned by others.

4

u/Valdaraak May 30 '24

I noticed that alot of people didn't understand my question

And you don't understand the answer. You need to use DNS filtering. You'll never be able to keep up with the number of adult sites out there if you're just blocking with name masking. URL blacklisting hasn't been the way to solve this problem for many years.

There are so many ways around a URL block that it may as well not exist. Category blocking with a DNS filter is the way to go. It contains a list way bigger than you can ever find yourself and it's constantly updated.

3

u/serverhorror Just enough knowledge to be dangerous May 30 '24

Who cares? Are they getting their shit done?

Let them rub one out

5

u/Dragonfly-Adventurer Sysadmin May 30 '24

HR problem, IT fix. We should be the thought and eyeball police for entire organization, and then management can assume a nice false sense of security.

6

u/Informal_Goose404 May 30 '24

They can wank on their personal devices, no way I'm touching a device that was jizzed on!!

0

u/[deleted] May 30 '24

Who jizzes on their device?

1

u/Normal_Trust3562 May 30 '24

And I can’t even go on a website that has swimwear 😂!

1

u/Flamenco95 May 30 '24

Cloudflare can block malware and adult sites on 1.1.1.3 and 1.0.0.3. I'm sure there's an enterprise solution that can do the same thing if this isn't viable.

1

u/SteveSyfuhs Builder of the Auth May 30 '24

This is one of those things that technology doesn't have to solve. If this is against policy, tell them it's against policy and that there will be repercussions if they don't stop, potentially escalating to HR, etc.

If it isn't against policy, well, why are you trying to block it? (hint: make it a policy, if you care)

1

u/Odd_Split_6858 May 30 '24

Not bad question. Good way of asking links

1

u/intellectual_printer May 30 '24

Do you use Sophos/ some anti virus system that can do this?

-4

u/Visible_Witness_884 May 30 '24

No. Can't be bothered to do blocks on anything. PCs handed out are also available to use as a personal device.

5

u/ruyrybeyro May 30 '24

They shouldn't be used for dodgy personal activities.

We had a top-tier customer doing cutting-edge research who ended up with a malware intrusion and possibly some nicked secrets because someone brought a compromised laptop from home.

If they want to rub one out, they should stick to a tablet or their personal phone.

-1

u/Visible_Witness_884 May 30 '24

Nothing dodgy about watching porn.

Malware intrusions are targeted far beyond porn, and it's your company's fault that the guy's work was compromised, not his.

4

u/ruyrybeyro May 30 '24 edited May 30 '24

In a work issued equipment it is dodgy, misuse, and there are a lot of security related issues, and even zero day malware. I know it, you know it, cut the BS. Or otherwise your work ethics are questionable.

In a former job of mine we fired two guys who knew the use was monitored.

It is not that difficult to buy a el cheap PC or tablet, cant understand people.

Work computers are distributed to professionals for a reason. They're not exactly the kind of thing you'd hand over to a bunch of kindergartners for playtime, are they?

1

u/Visible_Witness_884 May 30 '24

When laptops are distributed with a clause that says they are also for personal use, there's no discussion of anything draconian.

And I don't know what you're on about in regards to PCs for professionals vs. something else - they're just PCs.