Python and the school network

[randle]

I've been asked to add Python to the school network which is easy enough as an msi is provided however am unsure as to whether installing this on the native system is a good idea. Should I be implementing a Virtual PC image with this? With GPO restrictions in place, is this neccessary?

 

The school's never needed anything like this on the network before so haven't had to worry about this before however due to recent public comments, it's been decided that we need this.

[plexer]

Decided by who? in consultation with who? for what purpose?

 

Ben

[randle]

This is a request by the ICT department as they want to teach students Python. Ideally I want to know what the risks are and in what way this could be done if it's a good idea then once I know either way, I can go back to them and the SMT and let them know whether this is possible rather than just saying no from the get go.

[randle]

Are there schools out there who have been asked to implement something similar?

[CyberNerd]

Giving kids a python interpreter means they can use the computer to do what they like with - access the C:\ drive, call system commands, run network commands.

 

Is Python the security risk or is windows the security risk?

 

I personally don't think it's an issue. If you think it is then run it on *nix or in a virtual machine.

[dhicks]

With GPO restrictions in place, is this neccessary?

 

If you're worried about running Python locally on each workstation you could install an SSH client and a text editor on each workstation and have the pupils save and execute code on a central server. Also, this kind of worry is exactly the kind of the kind of thing the Raspberry Pi is designed to take care of - give each pupil a £22 computer and leave them to it.

[tom_newton]

What @dhicks said. You could even set up an ubuntu box joined to AD, one decent desktop should allow for a full class of students (probably more) all doing "commandline" based python. Use an easy text editor like "joe" and you're away. You may have problems with students trying to be clever and DOS the box by running compute-intensive stuff, but it is easy enough to spot these and apply a LART.

 

You could position this as a "first step" into the python world - also one box means you have a LOT of control over the runtime environment, a (competent) IT teacher can easily distribute sample scripts to students, it might even be possible for students to log in from home to do work.

[teejay]

Looking at the same thing here, tbh my preferred option is the raspberry Pi if they can get it out of the doors in enough quantity for September, which is looking increasingly unlikely.

I think we'll be going down the route of having VM's set up with a dev image:

 

Python

Eclipse with PyDev

Android Dev Environment

Windows 7 Mobile Dev Environment

Visual Studio

Microsoft Robotics Developer Kit

Small Basic

Scratch

[Chris_Cook]

Running python programs on windows will give program the same security restrictions that the user would have if the had access to the command line, windows explorer or the save/open dialogs in most windows applications. They could run any program on the system that they have read and execute permissions on.

 

If you have denied students access to a file/folder/network drive, then they still can't get it, because they will be running python under their own account. However, one thing that does occur to me is if the students hand in a program (in any language, not just python) to a teacher and the teacher runs it, then it would run as the member of staff. If a student were crafty, they could get the program to access a confidential file and send it via email or network share to themselves when the teacher runs it. Staff marking the work would need to be very strict about reading the code before running it. I would also give the staff a restricted environment of some kind to run it in, Maybe a vm or linux server, or another un-privileged username.

 

Unless they can find a privilege escalation type bug, then they shouldn't be able to do any admin level stuff. That is assuming you have the PCs locked down properly. I think the worst they are likely to be able to do is crash the pc, or maybe corrupt the python install. Neither of those should take long to fix (either reboot. or reinstall python).

 

You probably want to make sure the rest of the network is secured properly, with firewalls, backups, system images, etc, but any vulnerabilities there are present if the students can bring in their own equipment, or use VMs/ssh/raspberry pi or Java or Visual Basic. Its possible that they could create programs to do denial of service or other attacks against hosts on your network. This applies to any network however, with or with out development tools installed.

 

This is based on my personal experience with python, I don't use it in a teaching environment.

[CyberNerd]

I really think school sysadmins need to relax a little and give kids chance to explore.

 

The worst that's going to happen is they'll create a mass email spam program, temporarily knock out a server or exploit some privilege escalation bug and gain some confidential information. They'll do that if it's on a (networked) raspberry pi or (networked) Virtual machine. There are not going to many kids that could do it, and even fewer that would do it. You or the teachers will be able to identify those bright but misaligned students in a flash.

 

Real learning doesn't happen in a sterile environment. I've had kids that have written their own proxy servers in their bedrooms, to be able to get to games sites and others that have attempted to DoS our internal email system. The only thing that has come from it is good, the kids learned important lessons.

We aren't working in a military environment. Sometimes it is good to say YES to things that will be good for teaching and learning, and learning Python certainly will be. Even of it means 'letting go' a little.

[Blue_Cookeh]

I really think school sysadmins need to relax a little and give kids chance to explore.

 

The worst that's going to happen is they'll create a mass email spam program, temporarily knock out a server or exploit some privilege escalation bug and gain some confidential information. They'll do that if it's on a (networked) raspberry pi or (networked) Virtual machine. There are not going to many kids that could do it, and even fewer that would do it. You or the teachers will be able to identify those bright but misaligned students in a flash.

 

Real learning doesn't happen in a sterile environment. I've had kids that have written their own proxy servers in their bedrooms, to be able to get to games sites and others that have attempted to DoS our internal email system. The only thing that has come from it is good, the kids learned important lessons.

We aren't working in a military environment. Sometimes it is good to say YES to things that will be good for teaching and learning, and learning Python certainly will be. Even of it means 'letting go' a little.

 

I'd have to agree with this.

 

What I would suggest is dropping a couple of Universty IT departments an e-mail, a lot of them have Python and other interpreters installed for CompSci students, in a domain environment. In fact, I learnt Python in a Windows 7 domain environment towards the end of last year.

[skunk]

I really think school sysadmins need to relax a little and give kids chance to explore.

 

They did at the start, then liberties were taken, so it go bolted down a bit, more liberties were taken, more bolts, etc.

 

The worst that's going to happen is they'll create a mass email spam program, temporarily knock out a server or exploit some privilege escalation bug and gain some confidential information. They'll do that if it's on a (networked) raspberry pi or (networked) Virtual machine. There are not going to many kids that could do it, and even fewer that would do it. You or the teachers will be able to identify those bright but misaligned students in a flash.

 

...is that a bunch of laws get broken and the school has vicarious liability to any victims, ICO on its back and a P45 with the sysadmin's name on it. Not a career path I intend to follow or would recommend anyone else doing so.

 

Real learning doesn't happen in a sterile environment. I've had kids that have written their own proxy servers in their bedrooms, to be able to get to games sites and others that have attempted to DoS our internal email system. The only thing that has come from it is good, the kids learned important lessons.

We aren't working in a military environment. Sometimes it is good to say YES to things that will be good for teaching and learning, and learning Python certainly will be. Even of it means 'letting go' a little.

 

Yes and no. Why does a controlled, safe environment have to be sterile? Why does students letting rip with their coding prowess mean that the school network be at risk.

 

I would recommend a bunch of (virtual) servers in a DMZ with only SSH inbound open. The kids can play, the servers can be reset once they have royally stuffed them up and the rest of the school can keep running as normal with a reasonable level of risk.

[CyberNerd]

...is that a bunch of laws get broken and the school has vicarious liability to any victims, ICO on its back and a P45 with the sysadmin's name on it. Not a career path I intend to follow or would recommend anyone else doing so.

 

If you give someone a programming language and they decide to bruteforce your SQL or LDAP then provided you've taken reasonable measures to secure said servers then I don't think you would have too much to worry about from an ICO or p45 perspective. If you are really that paranoid then it might be best to unplug the network cards altogether.

 

Yes and no. Why does a controlled, safe environment have to be sterile? Why does students letting rip with their coding prowess mean that the school network be at risk.

I would recommend a bunch of (virtual) servers in a DMZ with only SSH inbound open. The kids can play, the servers can be reset once they have royally stuffed them up and the rest of the school can keep running as normal with a reasonable level of risk.

 

That would be a pretty sterile environment, albeit secure.

 

I think we shouldn't all overreact to what 'could' happen, or we'll end up banning a whole load of useful educational tools like raspberry pi and running student machines a DMZ; back to the separate staff/student networks of eons ago. Relax, it will be fine

[DMcCoy]

As long as it runs under a standard user account I really don't see what the problem is.

[CyberNerd]

As long as it runs under a standard user account I really don't see what the problem is.

 

stuff like this:

http://www.hsc.fr/ressources/outils/patator/download/patator_v0.2.py

 

 

BAN programming!!!!

[randle]

The worst that's going to happen is they'll create a mass email spam program, temporarily knock out a server or exploit some privilege escalation bug and gain some confidential information.

This is exactly what I'm worried about. Doesn't sound like something I'd like to deal with here if I'm honest.

 

Thanks for the feedback eveyone. I'm more so thinking in the same vein as skunk. I'm not willing to allow any possibilities (that I can control) of access to confidential data as obviously would be held highly accountable for this. Also I've gone to the bother and time to secure the network so am not happy to give them the tools to simply undo all this.

 

I'm in no way saying others are doing it wrong or that their opinion is wrong but just that I'm not willing to go down that route.

 

I do run a vSphere server environment here so a virtual server with SSH/Text editor to provide these needs is a possibilty however have no knowledge of how to set this up but am willing to give it a go. My other option looks to be VPC2007 and images that don't save changes when shutdown. These wouldn't have a network connection but would provide a way to practice in a raw environment as suggested and can still access My Docs for saving through shared folders.

[DMcCoy]

stuff like this:

http://www.hsc.fr/ressources/outils/patator/download/patator_v0.2.py

 

 

BAN programming!!!!

 

They already have physical access to a machine and a valid account. There is only so much you are going to be able to do. I mitigated some of the impact with wired 802.1x and switch ACLs along with client/server firewalls to stop access from student VLANs to sensitive servers.

 

You can't stop the determined hostile user though, just slow them down.

[randle]

This is what I'm trying to find out. If they're running Python in an already restricted account, will it give them the tools to gain elevated access?

[CyberNerd]

This is what I'm trying to find out. If they're running Python in an already restricted account, will it give them the tools to gain elevated access?

 

 

No. Permissions are permissions - but it isn't the security of the local machine you should be worried about.

[randle]

Ok I meant more of a backdoor to the system/network then

 

but it isn't the security of the local machine you should be worried about.

It's not so much. It's network access primarily.

[CyberNerd]

Any modern computer language on a computer could create a risk if you consider that all virus, trojans etc are computer programmes.

 

As @skunk and @DMcCoy say - the best thing you can do is apply a liberal use of vlans and firewalls to mitigate against crackers.

 

My opinion is that the risk is tiny and theoretical. Allowing kids to be able to learn python vastly overweights the negatives.

I think you should install the interpreter, and keep an eye on the log files.

[tom_newton]

As others have said, python won't allow access to anything they don't have already.

It will allow users to do things faster than they could by hand - and if it is on your regular network that could allow students to create a DoS scenario. Very easy to find out whodunnit though.

You could probably stop the interpreter talking to the network using windows firewall, butthat spoils some of the fun.

 

Setting up the single host should be easy enough - ubuntu server on vm, install ssh server, use likewise to link to AD, install python, install easy text editor like joe or pico. Push putty to clients. Done

[dhicks]

if it is on your regular network that could allow students to create a DoS scenario.

 

More probably by accident than anything else, though - when the second years started doing networking in C++ at university the network used to get blitzed on a regular basis.

 

You could probably stop the interpreter talking to the network using windows firewall, butthat spoils some of the fun.

 

Maybe a VLAN with their own route to the Internet?

 

Setting up the single host should be easy enough - ubuntu server on vm, install ssh server, use likewise to link to AD, install python, install easy text editor like joe or pico. Push putty to clients.

 

Depends what they are to be taught - they might need a GUI of some kind (in which case a VNC or X terminal should be perfect). I'm sure we found a browser-based SSH client a few weeks back, too, so you could probably do all access via a web browser.

[januttall]

python works great on windows just a word of warning: python can esaily be used to communicate over the network verry easily so good firewalls might be recomended in a school enviroment and putting it on another machine sounds a good idea