Students Personal Laptops

[Cmd.exe]

Hi all

My school wants to see every student with a laptop in lessons.
They wanted to start a scheme where the parents pay for this, as the school has no money.
The parents have politely declined this, stating (mostly) that their son/daughter already has a laptop at home.

SLT’s response to this was to ask me why we can’t allow students to bring their own devices in to school and access the internet (and VLE) through the wireless.
I have explained that it is a terrible idea, etc, etc, but I can only come up with a few technical issues with the concept: I know that I can secure the wireless pretty tight, but my concern is the myriad of empty wall sockets across the school allowing access to my un-VLAN’d flat network.

MY question is...
Does anyone here allow students to use their own personal laptops in school?
If so, are there any modifications you make to the laptop or your network?
If you don’t currently do this, but were asked, what would you say?

[jamesreedersmith]

Virus's, hacking attempts, unsuitable content, unlicensed/illegal applications the list goes on for reasons not to allow them.

As for locking down the flat network look at the various threads that already exsist about limiting access.

[Dom_]

Do you have ruckus? Sounds like a good arguement to get it, if the guest internet browsing works as advertised (not actually used it here) this would be perfect for what you're after!

The kids won't actually be connected to your network, so you don't have to worry about viruses and the like, but they'll be able to use your internet with no interaction from you :-D

If I were asked this I'd probably support it. It might also be worth arguing that there will undoubtably be an increased workload from student laptops (virus' etc) so an extra pair of hands or two would be required (or something in writing to say you won't have to fix them!)

[DMcCoy]

Hi all

My school wants to see every student with a laptop in lessons.
They wanted to start a scheme where the parents pay for this, as the school has no money.
The parents have politely declined this, stating (mostly) that their son/daughter already has a laptop at home.

SLT’s response to this was to ask me why we can’t allow students to bring their own devices in to school and access the internet (and VLE) through the wireless.
I have explained that it is a terrible idea, etc, etc, but I can only come up with a few technical issues with the concept: I know that I can secure the wireless pretty tight, but my concern is the myriad of empty wall sockets across the school allowing access to my un-VLAN’d flat network.

MY question is...
Does anyone here allow students to use their own personal laptops in school?
If so, are there any modifications you make to the laptop or your network?
If you don’t currently do this, but were asked, what would you say?

6th form can use their own laptops. They have no access to the network sockets (in use or locked out with 802.1x). They are allowed access to a wireless network that has access to an authenticating proxy and nothing else. As the VLE is external they can then access that. Not other network access is provided at the moment. One good thing is that just VLE an internet is the most secure access you could supply reasonably.

If your VLE is hosted locally on or using any Windows authentication then additional license costs may be involved if you have licensed products per machine. This can be external connector or CAL licenses for students for any DCs and file servers that may be accessed. If there is no windows interaction then could be no additional costs.

Security/AV would also be a major concern. I didn't even consider such access until we had implemented vlans and port authentication. Students must have their laptop power supplies PAT tested first.

[Ric_]

I'm going to assume that you have a Windows-based network...

Every time a user authenticates against your servers you need a CAL. You will no doubt have CALs for all your desktops and (under Schools Agreement) this also gives your staff the right to use their personal machines and authenticate against your systems.

I doubt that you buy per user CALs for Server, Exchange, etc. so you will need to purchase ECLs (per server) or student CALs which are additive to your Schools Agreement and you are probably going to be talking about £5 per student.

The reason I know all this, is because we are about to allow our Sixth Form to do the same. Even basic Internet access for us requires authentication (as does access to the Bluesocket wireless) and that is done against AD - CALs!

[dalsoth]

It's bad enough with staff claiming that their school laptop does not connect to the home wireless because of the technician without students doing the same. Oh and what happens when they say the tech buggered up thier expensive laptop and want a refund? Or you see they have oodles of porn that you can not delete because it is not your machine. Or they have loads hack tools they want to test your new wireless security against etc etc..

I support school equipment but not home equipment. I will stretch the rule to help out guests and visitors and a few part time teachers we set up on the guest wireless network but no way for students with thier own laptops. Thats like being pimped out by your own school.

Oh i forgot to say also. Staff love coming in with home scanners and home printers. They demand we install them for school use. Then we end up repairing them and having them electrical tested and so on and the user then takes it home afterwards and enjoys a new repaired PAT tested bit of kit at the schools expense.... noooo way.

[Cmd.exe]

Thanks for your responses.

It is a windows network and we've got a nice centrally managed Cisco wireless, so i don't think that will be replaced any time soon.
I think a big fat AUP or even a contract will hopefully protect the school from claims by parents and I will look into further securing the unused wall sockets as suggested.

I can see the logic with a sixth form - there is that assumption that they are adults (ish) and may even have paid for their machine as opposed to parents. The aim for us would be years 7 to 11!

The licencing is interesting. i would hope to avoid interacting with windows servers and just use the VLE. Though internet access might require some thought - might end up needing CALs just to get out to the internet!

[Ric_]

The licencing is interesting. i would hope to avoid interacting with windows servers and just use the VLE. Though internet access might require some thought - might end up needing CALs just to get out to the internet!

You will also need some way of restricting wireless use to your students so some kind of authentication will need to be done. Since all your users have a Windows account, this is the obvious thing to authenticate against - hence CALs required - but to avoid CALs you would need some kind of additional directory service.

Also check whether your Cisco stuff would need additional licensing - Cisco gear is notorious for requiring licenses for this, that and the other!

[Face-Man]

I would look at getting something like symantec network access control to ensure you don't have an internal DOS or hacking tools brought in Secure Access Control Software | Symantec Network Access Control

Also I would check with your Broadband provider if this is allowed I know in London the LGFL doesn't permit user own equipment to be used across it infrastructure and they can connect to the network but not the internet.

Also XP home on a network ???

[CyberNerd]

The simple solution is to setup the network properly so that all laptops are segregated as if they were internet clients. You could do this by mac authentication on your switches and vlans. If all they have access to is the various web services then you negate the licensing and the security problems. It also means that the experience that students get from home is exactly the same as they would get in school, web based is the way forward.

[maniac]

Check out BWireless, Wi-Fi hotspot solution, managing a system of hotspots, ideal for schools, colleges and universities, wireless internet access

It looks like it does everything you need to allow 'guest' laptops onto your network. The only requiremet is that you can setup Vlans on your wireless network. It provides a simple web based authentication screen which can link to AD as far as I know, and keeps track of whetever users are doing while they're connected.

I've spoken to Christian at ITS on many ocassions about this product, but haven't quite persuaded senior management to part with the cash yet!

Mike.

[mac_shinobi]

vlan the wifi access points like at star bucks ?

but as above ruckus would do what you need and also maybe packet fence and or un tangle ?

PacketFence: Home

not sure if untangle is what you are after

Open Source Network Gateway | Untangle

Short of that maybe smooth wall - Tom and Co. can help with this as well.

[Sylv3r]

We allow our students / staff access to our wireless network which is on a seperate VLAN to the rest of the network via a Smoothwall UTM.

This way the network is segregated away from the wireless network but also all internet activity is logged per user.

[imiddleton25]

We allow our students / staff access to our wireless network which is on a seperate VLAN to the rest of the network via a Netpilot UTM with strong blacklists and time restrictions ( we are a boarding school).


all sockets are secured and therefore not useable for student laptops, all internet activity is logged per user/ laptop.

[Face-Man]

I would just present the head with the following possibilities and ask them to think about whether it is a good idea.

1) Kid brings in inappropriate material from home into school they view this at back on class.
2) This material is distributed across the network to the other computer with the room.
3) Some smart kid takes a picture with their build in webcam of their "favourite" teacher and uses photo shop adapt the photo
4) The student uses school internet connection anonymously send this to a local newspaper/governor...

This is without the issues around playing games, cyberbullying the poor kid with the Apple Mac, compatibility, licensing, virus, hacking etc.

Surely the solution is if the parents have already purchased laptops for the students they will need to replace them in two years or so. Get in contact with the e-learning foundation and draw up a plan to be a replacement service for laptops that can be purchased over the next two years at a reduced price. Every kid has the same device, same software and same security. Though make sure they remember to employ somebody to support them.