Using L*nux in schools

Help please, I'm a new systems manager that is happy with my xp installs, but my AHT's (leadership) have asked for the new cheaper linux versions to be put on the network. I mean in the new mini-laptops. It maybe as a 'leased pc' or as one we'd 'give' to students.

I admit, I'm not great with linux as I've not used it really in the school environment, but have said no to begin with. I'm worried about the lack of ability to 'lock down' linux, and sent this message to SMT but am being hit back with the reports from ICT and e-learning that other schools are using it and there are work arounds so I am feeling out of place! I really want to know how to move my school forward succussfully! Can you advise? I am new but passionate about my position and willing to learn!! My predessessor sent the following message around schools about linux.



1.The operating system on this notebook is Linux. Linux is not a secure operating system and it is not possible to “Lock down” Linux in the way that is possible with Microsoft Windows operating systems. As a result I believe that these computers could pose a threat to the school systems. There are any number of easily accessible websites which offer advice on tweaks and hacks for the Linux operating system.. The risk of the above is twofold: -

a)It could be possible for a malicious user to hack or launch a denial of service attack on the school network infrastructure from this computer.
b)Students could very easily download/install applications and tweak the operating settings rendering the computer inoperable.

Please any plus or minus points would be greatly appreciated! Linux in schools......for or against................


I feel admittedly out of place but help intially would be apreciated and learned from..........


I want to know ways out of this so help would be wonderful............

Quote:

---

Originally Posted by jwdc

Linux is not a secure operating system and it is not possible to “Lock down” Linux in the way that is possible with Microsoft Windows operating systems. As a result I believe that these computers could pose a threat to the school systems. There are any number of easily accessible websites which offer advice on tweaks and hacks for the Linux operating system.. The risk of the above is twofold: -

a)It could be possible for a malicious user to hack or launch a denial of service attack on the school network infrastructure from this computer.
b)Students could very easily download/install applications and tweak the operating settings rendering the computer inoperable.

Please any plus or minus points would be greatly appreciated! Linux in schools......for or against................


I feel admittedly out of place but help intially would be apreciated and learned from..........


I want to know ways out of this so help would be wonderful............

---

Linux is secure (or at least can be made secure by following good practice), probably more so than Windows.

In terms of 'locking' down Linux, yes you cannot use a central server and group policy as you are used to AFAIK, but I think you have to look at this as a paradigm shift in how kids interact with their computers.

Each Laptop will be used by only one student, so they have to take on, and be taught some responsibility in using their computer. They will be the ones who miss out if it has to be taken away from them, either to carry out repairs or because they can not be trusted with it. We need to get away from the view 'oh no Linux its for Hackers', students who take the time to learn Linux properly would also be capable of using Windows to carry out 'attacks' as you put it.

There have been a few years of dominance of one O/S but I think IT professionals with have to expand their knowledge to cover a wider base from now on.

(sorry this doesn't really help you, perhaps someone will will suggest some resources for getting started)

While in general Linux is a secure operating system, some of the smaller distros that are used, for example, on the Asus eee have well documented flaws in them that can allow users in the know to run and install programs on them, and basically gain super user rights on the device. (there are ways to remove these flaws thou)

However, the risk to your actual network is small, the worst they could do is to install software on the device itself, and this would only be if they happened to know how to do it. This can be detured by ensureing the students who get issued these devices sign an acceptable usage agreement, and then you or your team doing random inspections of machines, and taking appropreate action against students who break the rules.

We sucessfully rolled out 45 Asus eee machines with the Asus linux build on at my last school, these were on our network system for internet access only and had been locked down using tips and tricks available on the Asus eee users site, and some firefox plugins to remove access to preferecnes menus etc. An image of this was then taken using Partimage meaning a machine could be restored back to normal in a matter of minutes if necessary. As far as I know they have had few problems with them since they were issued. (I left the school the same week they got handed out, but did most of the ground work in getting them ready)

Excuse me a second for being slightly critical, but rather than 'try and find a way out of it' how about changing tact slightly and try your hardest to find a way to make it work. In the long run you'll earn a lot more respect from your management team for doing this. Linux in schools does work if it's done the right way. :)

Mike.

Quote:

---

Originally Posted by jwdc

I'm worried about the lack of ability to 'lock down' linux



1.The operating system on this notebook is Linux. Linux is not a secure operating system and it is not possible to “Lock down” Linux in the way that is possible with Microsoft Windows operating systems.

---

I'm afraid you've got the wrong end of the stick here - presumably from ignorance (and I don't mean that or any thing else in this post in a nasty way).

Linux doesn't suffer from many of the insecurities or vulnerabilities that Windows does, e.g. viruses. It's not perfect, but it's a whole lot better than windows.

To be quite honest, your message to SMT is misleading and lacking in any kind of knowledge/facts, and anyone with an ounce of linux knowledge will find it quite amusing.

It sounds to me like you have no knowledge of Linux and find it a scary thought, hence trying to put SMT off going with these boxes.

You might want to re-word it, and say that, in all honesty, you don't have the knowledge to support Linux on your network, and would rather avoid it. This is a perfectly legitimate stance to take - if SMT really want to go ahead with these laptops, then they'll have to offer you some way of getting up to speed with Linux.

I assume you're talking about the EEE PC or such like. I bought 3 a few weeks ago - I made a couple of small tweaks to the box (like setting a root (that's the administrator account) password, and removing the ability for the default user to login as root (sudo), then tweaking the wireless settings to auto-reconnect on resume), then handed it over to a student. I have no worries about doing that. None at all.

We wasnt the one who sent the message

Quote:

---

My predessessor sent the following message around schools about linux.

---

If you google with "linux locked down desktop" you can see that facilities are starting to emerge to do this but its early days yet.

Just getting the machines to save/load/print files via a W2k3 server can be problematical :)


regards

Simon

3rd Party Software to combine GPO on Windows & Linux
Group Policies for Linux, Unix and Mac OS X Computers
Likewise - Making Linux and Windows work well together

There is the Linux+ Certification if you want to go on a course.
Free Comptia Linux+ Study Guide - ProProfs Forums
Search for "Linux+" | Scribd

Found this for Ubuntu -

Quote:

---

If you make a new user account, of type "Unpriviledged", they can't fsck about with any system settings, outside of their home directory.

You can also use pessulus (sudo apt-get install pessulus) to further lock things down. (Not allowing screen lock, stopping them moving panels around, saving to disk, printing, etc)

I imagine that it'd be easy enough to write a script that clears any changes made to the user's home directory and settings on reboot.

---

File Permissions in Ubuntu

Quote:

---

Originally Posted by FN-GM

We wasnt the one who sent the message

---

Ah, my apologies.

Quote:

---

Originally Posted by jwdc

my AHT's (leadership) have asked for the new cheaper linux versions to be put on the network. I mean in the new mini-laptops.

---

The Edubuntu Linux distribution is probably a good place to start. Its entire purpose is that it is to be used in schools - we run a whole suite of workstations on Edubuntu and have no problems with security. It's easy to get the hang of if you're new to the job, too.

Quote:

---

I'm worried about the lack of ability to 'lock down' linux

---

Don't be - the entire point of the Unix / Linux file system(s) is that it includes security built-in. You simply make sure that the appropriate read/write/execute permissions are set on your files.

Quote:

---

It could be possible for a malicious user to hack or launch a denial of service attack on the school network infrastructure from this computer.

---

Stopping a denial-of-service attack is going to be more about your network infrastructure than client machines - if anyone can attach a random machine somehow and start sending network traffic then you might be in trouble.

--
David Hicks

Main Page - Schoolforge-UK