RPi Noob needs help connecting Pi 4 to Windows

[JSpaced]

Hey everyone,

I'm one of the IT techs for a busy secondary school and the Computing Department have bought Pi4s to teach coding, robotics etc. etc.

 

We're also trying to tighten up all our security and safeguarding for the CE+ certification. (It feels like me and the team are gradually being stuffed into a mail sack from which we're expected to do the same job.)

 

(Tangentially related: Our Windows and Mac devices use an Edge Extension to ensure Internet Filtering via Smoothwall, while Smoothwall also provides an app monitoring all Windows devices on the network for safeguarding concerns.)

 

The problem I'm having is the Raspberry Pi 4s are not really conducive for this kind of strict security, filtering and monitoring.

 

What I want is to plug the Pis in via USB and the students to RealVNC or similar to them from the suite computers. That way the Windows PC is doing the filtering and monitoring and the students can copy/paste downloaded files via VNC into the SD Cards of the Pi.

 

I've followed the various instructions online:

 

Installed Bonjour Print Services on my station.

 

Added dtoverlay=dwc2,dr_mode=peripheral to the config.txt file.

 

Added modules-load=dwc2,g_ether to the commandline.txt file.

 

Pi boots up, connected via USB cable to my PC and... nothing. There's no peripheral device, I get a "USB Billboard Device" on Device Manager, which implies something isn't working.

 

Has anyone been able to remote control a Raspberry Pi via USB on a Windows PC?

 

How do you address safeguarding concerns, like: User identification, Internet Filtering, Safeguarding monitoring, on your Raspberry Pis?

 

Thank you in advance, I am tearing my hair out...

Edited December 16, 2024 by JSpaced

[synaesthesia]

Simplify it. Set up a dedicated wifi network for the Pi's with the absolute maximum level of filtering possible. On the assumption the pi's stay in school, then being aware of who's searching for what may be negated if they're not allowed to search. For instance, could the class manage when only the Pi and accessory repositories are available for updates etc? Do they need to be able to browse from them?

[mavhc]

So you're enabling a usb peripherial mode, what OS is on the Pi?

 

But if you want to use VNC that would require a usb network connection

[dhicks]

What I want is to plug the Pis in via USB and the students to RealVNC or similar to them from the suite computers.

 

I'm guessing what you're aiming to do is plug the Pis in to a USB-C power source so that they start up and run. Raspberry Pis are (typically) used as stand-alone computers, you don't program them via a USB connection like you would with something like the BBC Micro:Bit or (confusingly) Raspberry Pi's own Pi Pico microcontroller. The Pi 4 and 5 take a bit too much power to be able to be powered from a laptop USB port, you'll need a dedicated USB power supply. In our ICT suite, we've put in power sockets with integrated 3.1A USB ports, which work quite nicely.

 

Get each device set up and joined to your network. You have a few options for connecting to the Pis from a Windows (or other OS) desktop PC / laptop:

 

- Use Raspberry Pi's snazzy new remote desktop facility ("Raspberry Pi Connect"). They've literally just (6th December) released the "for organisations" version:

 

https://www.raspberrypi.com/news/raspberry-pi-connect-for-organisations-plus-full-screen-support/

 

Pricing is around 50p per monthly active device by the looks of things, so should hopefully be quite affordable. I'm not sure if they do SSO with Google / Microsoft / Apple accounts yet, although I'm guessing that would be a really handy feature for most schools.

 

If I understand correctly, Raspberry Pi Connect should work without any ports needing to be forwarded at your gateway device. Security-wise, you could put the Pis on a wireless guest network, so they would be able to see the outside world but not other devices on your network. As something of an added bonus, pupils will of course be able to connect to the devices from home if they are left powered-on in school.

 

As access is via remote desktop, any text typed will go through the local device, where you probably have some sort of filtering already. On our ChromeOS devices, the Securley filter should pick up any concerning words and so forth that pupils are typing. The Pis themselves can be filtered by basic gateway filtering that blocks unwanted URLs.

 

- Similar to the above, we use a Guacamole gateway server to provide remote desktop services for our users. I have a setup that supports SSO via Google accounts:

 

https://github.com/dhicks6345789/remote-gateway

 

The above is likely to need some tweaks to get working for a particular installation, but once set up should (hopefully) just work and be free to use.

 

- If you don't want to use (or, as is quite likley, teachers can't understand...) remote desktop then you can connect the Pis up to a local monitor. Again, Raspberry Pi themselves have just released a monitor that can be powered from the Pi itself:

 

https://www.raspberrypi.com/news/raspberry-pi-500-and-raspberry-pi-monitor-on-sale-now/

 

You will still need a keyboard and mouse per Pi, which can start to get a little cluttered - I think the remote desktop option is better. If, like us, you have all-in-one desktops or laptops in classrooms rather than "PCs" with monitors, then you can use an HDMI-to-USB (yes, that specific way around!) adaptor to use your monitor with the Pi:

 

https://sansay.co.uk/pi-view/

Edited December 16, 2024 by dhicks

[dhicks]

Just to add: if curriculum are aiming to teach robotics and you're setting up remote desktop, that should (I think) be a really useful way of being able to interact with robots. Pi-based robots on WiFi, remote desktop enabled so pupils can connect nice and easily from any desktop (or laptop) device, minimal power / HDMI / keyboard / mouse cables in the way. I was at the Raspberry Pi store the other week and had a look at the Trilobot:

 

https://shop.pimoroni.com/products/trilobot-full-kit?variant=39861727526995

 

It's was actually quite robust-feeling - maybe not great for primary or as an introductory device (the Micro:Bit seems to have a good ecosystem of entry-level robotics devices, cheap enough to be able to purchase a classes worth at a time), but looks great as a self-contained, remotely-accesible robot.

[JSpaced]

Just to add: if curriculum are aiming to teach robotics and you're setting up remote desktop, that should (I think) be a really useful way of being able to interact with robots. Pi-based robots on WiFi, remote desktop enabled so pupils can connect nice and easily from any desktop (or laptop) device, minimal power / HDMI / keyboard / mouse cables in the way. I was at the Raspberry Pi store the other week and had a look at the Trilobot:

 

https://shop.pimoroni.com/products/trilobot-full-kit?variant=39861727526995

 

It's was actually quite robust-feeling - maybe not great for primary or as an introductory device (the Micro:Bit seems to have a good ecosystem of entry-level robotics devices, cheap enough to be able to purchase a classes worth at a time), but looks great as a self-contained, remotely-accesible robot.

Hi David,

You're definitely more up on RPs than I am. The problem I've got isn't a question of hardware or connectivity, as such, it's more how can I safeguard the kids while they've got access to these computers?

Originally I was hoping to isolate the RPs from ANYTHING on the net, then rely on RealVNC to be able to bring in e.g. downloaded scripts or other bits the students are putting together.

 

It feels like the RPs are built with freedom of the user in mind. (Sign in as an admin, install things, delete stuff, knock yourself out). It just feels so anathema to everything we've built on the Windows network. How are you balancing safeguarding the students with allowing them to study using the RPs?

 

Edit: Just as a side note - we took away users ability to change Wi-Fi settings on our Mac suite (spits on the floor) because the students found if they attempted to connect it to the Authenticated Wi-Fi (for BYOD) they could stop the Macs working until someone came along and undid it on all of them. That's the kind of thing I want to restrict. I want to present the device "as is" and add features/ apps as requested, but I get the impression that's NOT how it works with RPs?

J

Edited December 16, 2024 by JSpaced

[mavhc]

They're just linux, so you could not log in as root, add them to ad etc

[JSpaced]

They're just linux, so you could not log in as root, add them to ad etc

If only it was that simple. We're getting rid of AD in favour of Entra because of the constant demand to "do more with less" so we'll be losing our on site servers at some point.

[dmj]

If only it was that simple. We're getting rid of AD in favour of Entra because of the constant demand to "do more with less" so we'll be losing our on site servers at some point.

 

Perhaps you need to review that decision and get something that you can manage your Linux/Windows/Mac estate with.

[mavhc]

https://canonical-authd.readthedocs-hosted.com/en/latest/ or https://learn.microsoft.com/en-us/entra/identity/domain-services/join-ubuntu-linux-vm

[dhicks]

Originally I was hoping to isolate the RPs from ANYTHING on the net, then rely on RealVNC to be able to bring in e.g. downloaded scripts or other bits the students are putting together.

 

Assuming you have a gateway filtering device that allows you to set up access groups by IP address or network card MAC address, you could assign the Pis to a group where you block everything except a whitelist of sites. I've noticed PythonAnywhere does that - users can access a whitelist of sites / APIs / services rather than being able to access just anything.

 

I want to present the device "as is" and add features/ apps as requested, but I get the impression that's NOT how it works with RPs?

 

As @mavhc points out above, user accounts on the Raspberry Pi don't have to be root users, you can set up accounts with whatever restrictions you like (although there will probably be a bit of a learning curve while you figure out how to apply security restrictions to a platform you're not used to managing). With our remote gateway, the user authenticates with their Google account and then is passed in to their local, standard, restricted user account on our remote desktop server. We're using a Cloudflare Zero-Trust tunnel for authentication and network ingress, which is free for 50 monthly users.

[mavhc]

You'd like my department to support another OS? How do you plan to fund the extra staff?

[Oaktech]

We went the other way - totally seperate wifi network, vlan, DHCP server, Smoothwall policies offering the most restrictive possible filtering but all the RPi services and sites whitelisted. The kids sign into OneDrive in the browser and drag-drop to save. We have them only in one suite, the PCs are connected via DP and then we have flying leads to HDMI for the Pi. KB/Mouse are plugged into the hubs on the monitors so it's a one plug swap between the PC and the Pi. We've been running our Pi's like this since 2016, but we've finally managed to persuade finance to get some USB KVM switches on order, but they're coming economy from China. They were ordered in September and we're expecting them on the 25th of Jan!

[DalekSec]

If only it was that simple. We're getting rid of AD in favour of Entra because of the constant demand to "do more with less" so we'll be losing our on site servers at some point.

 

For love of god don't do it, hybrid only. Went from a Hybrid to Cloud only company and i hate it, not easy to go back and missing so many useful tools!

[dhicks]

You'd like my department to support another OS?

 

Someone could, of course, offer Raspberry Pi device management and remote desktop connection as a managed service. The market rate for Pi remote desktop services seems to be 50p per device per month, so for a class set of, say, 16 devices (one between two) that's around £100 per year - maybe double that if user management / filtering is included on top?