Student laptop connection to network

[Joedetic]

I know that at staffordshire uni (where i've just started my BEng in Network engineering) they dont have WLAN acces in the hall of residence. The way the network access is done is by MAC filtering. You have to list your room number, student ID and mac addy of the one piece of equipment you're allowed to connect. And you're not allowed (/meant) to connect routers

Anyway, that's beside the point. What they do do with regards to WiFi is it's open and unsecured as far as the literature says, but the SSID isnt published.

http://www.staffs.ac.uk/airnet/ might give you some ideas as to how they manage the WLAN.

But this is purely for access to your homedrive (map it on the network) and internet...so it's not for domain logons (as far as i've seen) i KNOW there's another wifi network around the buildings but it's unsecured and it's got a published SSID. I'm assuming /that/s the one with the MAC filtering on it.

Anyway...</ramble>

[Geoff]

Fun, I could probably crack that in 5mins. Hiding your SSID and using MAC filtering doesn't work people!

[Joedetic]

I've just had a more careful read and there's CA certs and stuff that you've got to do once you've opened your browser

Typical student...scanning the stuff and taking little or none of it in!

[kingswood]

Fun, I could probably crack that in 5mins. Hiding your SSID and using MAC filtering doesn't work people!

I had this conversation with someone in the past week..they thought that hiding the SSID helped. It doesn't. In fact Windows can be real funny if you hide the SSID.

[Roberto]

I have just been told that we may be getting 80 (approx) laptops to be given to students for home use under a 'laptops for students' pilot program. The inevitable question will arise, can they be connected to the school network too?

Let's clarify one thing.
You say "given to".
Does that mean that they will be the owners of these laptops?
Or do you mean they'll be the property of the school / LEA / whatever and will be issued to students?

If the latter, then just make them normal clients on your network, with whatever minimal compromises might be needed in order to allow users to work locally off the network. No need to make them admins, no need to set up dual boot or any other complex scenarios, no problem at all.

[Ric_]

We have 30 laptops on a trolly... I would suggest you decide whether your current staffing level.

I have a Bluesocket wireless network which will give all the functionality that this sort of set up needs out of the box but it isn't cheap. You should also decide what they will need access to on the network - if it's simply Internet access you can route them all to your proxy and nothing else. If they need complete network access you need to secure them like a normal machine, etc.

[plexer]

Looking at the Staffs page the cert you accept would only seem to be for their http portal.

Ben

[Joedetic]

The way the paper booklet i was given is worded, it would appear that you've got to go onto the webpage before you can use it...


I'm going to take my laptop to the library this evening and see what's what.

[jonbones]

We haved set up a separate Vlan to County broadband connection and installed a WAP in sixth form area. Students have to provide Mac address of wireless connection (mac filtering enabled) on their laptop in return they get wep key and guide on changing proxy settings to get internet via sixth form WAP. As this is on separate VLan no 'network' acess is possible. Taken very little effort to set up and at moent keeping all parties happy.

[Geoff]

MAC filtering and WEP really isn't sufficent these days. I think cleint certificate based WPA would be a better solution for that situation.

[animalboy1968]

sorry to join the forum late but have you seen this?

http://www.vmware.com/products/ace/

the brilliant idea is that you create a vmware machine inside their laptop which you have full admin rights to and they do not. this way you are only responsible for the content on the vmware machine and they are able to do whatever they want on the laptop. it will even check av defs & allow users access to certain parts of the network depending on their logon etc. if you are still contemplating a solution i would advise you to read it. we don't allow students to bring in their laptops from home so i can't play with this myself but i hear it is very popular in universities around the country

[mattx]

I take it you have used Snort Geoff ?

[Ric_]

@animalboy1968: A good idea however it can prove expensive... hence why I do it the opposite way around and use VMWare Player for staff. I create a VM on my workstation and they can use that for testing demos, etc. while the networked settings remain.

[Geoff]

I take it you have used Snort Geoff ?

It's running on my border firewall and also on the externally facing web server (although that one is limited to web related IDS signatures).

It's also a component in Packetfence, an open source NAC solution I'm playing with.

[FN-GM]

Dual boot them. Have one partition running the XP Home that comes with the laptop for use at home...and have the other partition running your volume licensed copy of XP Pro that you'd use for your on-site machines etc.

That way it's /sort/ of kept separate and you can have them hooked up to the network. There's not much point in offereing laptops for students if they cant use them onsite too when they cant get onto a workstation in the library etc IMHO.

What a good idea