Python on a domain computer

[bwestlake]

Hi Guys.

 

Looking at using Python

 

First Question, how do you guys have it set up, do you use it in sandbox, Virtuals or just installed on the machine?

 

How can i get it to save to there H:\ drive automatically instead of where python is installed?

 

 

and can you guys let me know of any issues/problems you have had to over come?

 

Many Thanks

[bwestlake]

bump

[synaesthesia]

Virtual machine with full admin rights, no network access, shared drive which links to their network home directory. Rather than using the python IDE on it's own, as we do a range of languages we use Netbeans with a python addon, so it covers (but not limited to) C, C++, C#, .NET, Python, Java, PHP etc.

[Chris_Cook]

We install locally. Setting up virtual machines seems like a lot of work as well as more to go wrong, and I can't see the benefit, but I guess in a higher risk environment there might be some.

[synaesthesia]

If it's one thing then it's OK to go local - the very nature of programming is being able to test, tweak, execute - things the typical network is locked down to prevent. Giving them access therefore to a FULL machine with full rights, command prompts etc is heavily advantageous. Real world stuff rather than shoehorning them into a single product on a machine that isn't anything like what they'll otherwise use.

[Arthur]

I can't see the benefit

A locally installed copy of Python (along with PowerShell v3) could enable students to escalate their privileges if they have write access to any of the folders within the PATH variable.

 

The $env:PATH Less Traveled: Subverting Trust with 3rd-Party Applications « Obscure Security

[Chris_Cook]

I stand corrected.

 

It should be possible to still run python locally with the python folder set as read only. That should work round this particular issue. I will have to look into this. Just what I needed - another task to do...

 

I'm still not sure that giving students full access to a system is necessary for what they need to learn. Admin access should only be given out when there is a specific documented need.

 

How do you stop your users from reconnecting the virtual machine to the main school network?

Edited February 26, 2014 by Chris_Cook

[jbailey]

Virtual box vm machine doesn't need a network card for access to folders/shares on the host, also you can lock down access to features of the vm like changing boot orders/ creating new machines etc and you can have a vm image set as "immutable", so on a reboot the machine reverts back the the image as it was - like rolling back a snapshot, so students cannot "break it". It works really well in my opinion and gives you zero security concerns to worry about.

[Chris_Cook]

Ok, thats usefull to know. My last experience of trying to deploy virtual box to client facing PCs didn't go well, but it looks like its moved on since then.

 

No offence though, but I think assuming any solution has 'zero security concerns' is probably a mistake. It always pays to have an open mind.

 

Also, things seem to have a way of breaking around here that defies all logic and effort to produce a reliable system. All things being equal I would prefer a system with fewer components to go wrong.

[synaesthesia]

It is zero concern. As said there is no link between the VM and the host computer other than the shared folder. There is no networking capability. They can do what they like to the machine then when it's turned off, it's all gone and it's back to normal. I think there's a lot to be said for real world environments rather than something so very limited. They will have access and make good use of many windows system tools when programming, otherwise unavailable. The VM can be locked down so there's no menus, it can't be edited or anything, all the kids see is a borderless and barless window with another operating system in it.

Still keep an open mind of course, anything is possible and if someone's going to find a vulnerability it will be the kids. But that's going to be the existing system, not the virtual one.

Edited February 27, 2014 by synaesthesia