Google HTTPS Safe Search

[dasilva13]

Has anyone configured HTTPS google safe search to work now that google is going to all HTTPS redirects by default? We are using FortiGate as DNS server.

[Istvan_Takacs_FTNT]

I haven' t tried, but if Google is now using HTTPS than you need to enable SSL offload on the Fortigate to be able to inspect the content between the client and the server. If Safe Search is not working, it' s is because the server can' t figure what' s travelling inside the encrypted content.

[hklb]

Hello, There is a solution proposed by google. do a dns serveur for subdomain " www.google.com" (and other country), and create a alias for " www.google.com in cname nosslsearch.google.com." . Like this, the search will not be encrypted. https://support.google.com/websearch/answer/186669?hl=en

[dasilva13]

I have tried to program that exact solution on the DNS on the FortiGate but it does not work. Just wondering if anyone has actually done it.

[dasilva13]

BUMP, as someone has to encountered this issue, especially in a school instance?

[Christopher_McMullan]

If the client can be re-configured to target Google DNS and bypass the FortiGate, that may frustrate a design using a local ' autoritative' DNS server. I worked with a local school district and their SE, who added all the possible domains to a modified hosts.conf file, resolving all Google domains to the IP for nosslsearch.google.com. With the hosts.conf file deployed, we verified all hosts would be forced to the correct site, and Safe Search was consistently applied. It could not be disabled from the browser. One other catch is that the Proxy Options profile (config firewall profile-protocol-options from the CLI) applied to the policy needs to NOT allow chunked bypass. If someone attempts a search (for images or sites) and is successfully blocked, they could refresh the browser a number of times, or repeatedly toggle Safe Search settings until explicit images or search results are returned. With chunked bypass disabled, it will always work. I have attached a reference file for hosts.conf. Append the lines to the end of an existing hosts.conf file to test. Make sure that you run Notepad as Administrator, in order to modify and save the file. Please bear in mind this is from a case over three months ago. I have verified it since then in specific situations, but it would be wise to do a small test first as a proof of concept before relying on this to resolve an issue in any full production environment.

[dasilva13]

This host files would work in the Windows environment where they are used, but I have a full MAC environment with the Fortigate acting as DNS server. Forgot to mention that...sorry

[Christopher_McMullan]

According to Apple, the same file structure exists, just in a different path: /private/etc/hosts Care of: http://support.apple.com/kb/TA27291

[Bromont_FTNT]

Keep in mind that Google sites implement HSTS so browsers that have visited Google sites before the change will need to have their histories flushed

[dasilva13]

issue is, we have 1500+ laptops and we would have to manually add the host file to all of them.