Wifi in your school, who has access to it?

[rad]

Quite simply, who has access to your wifi within your school?

 

For us it was staff and sixth form students. It appears the password to the wifi has been leaked and lower years have access to it, I have raised this with SLT.

 

Just interested what other schools do. We have 2000 students.

[FN-GM]

You should use something like radius. The authentication is based on the domain username and password. Set it so only students in 6th form can login.

 

We offer BYOD to staff. Staff are able to login and use the service using AD credentials. Although they get a delivered Citrix session and not an internet connection.

[Sibrows]

We have four SSIDs:

 

The first extending our internal subnet and used only by school owned devices. The passphrase is a very unmemorable and only known by a select few (3 people).

The second is used for guest access but mainly to allow staff internet access for their mobiles etc... access controlled using Radius.

The third is used for the sixth form students bringing their own devices to use in school as above access controlled using Radius.

The forth is used by students participating in a 1:1 device scheme protected using again a very unmemorable passphrase issued using our MDM solution and know by me and written in our site documentation and then radius authentication primarily for keeping track of who is doing what on the web.

[Roberto]

We implement RADIUS so we don't have any "the password" issues and make it available to all staff and students.

[rad]

This is very helpful, I'd like to add, our wifi is in the pipeline for upgrade and I think this will push it along nicely. The current setup is about 6 years old supported by the LEA using Cisco kit.

 

Keep the ideas and info coming

[IrritableTech]

We have different SSIDs for domain connected devices, guest devices, sixth form devices, staff devices and cashless tills.

 

We control access using our ruckus controller, AD and dynamic pre shared keys.

 

I need to setup a radius server though to do dynamic vlan assignments - we've hit the limit on SSIDs.

[Techie-v2]

Using ruckus we have 5 different WLANS:-

 

One for School owned devices (Staff issued laptops, tablets etc) controlled using MAC address.

 

Another for all 5 laptop trolleys, (4 in departments, 1 mobile), again controlled by MAC address

 

Another for Staff BYOD, controlled using AD authentication.

 

Another for 6th form BYOD, again controlled using AD authentication (they have to sign an AUP before they are made members of the security group that the ruckus controller looks for to allow access).

 

And another for guest access controlled using generated guest passes on the ruckus controller.

[IWDave]

I have no objection of staff having access to it as long as they follow our internet usage policy; however they do not know the wifi password; the device has to be manually added and the device, serial and owner are recorded. All pupil devices have it pre-installed and re-registered on ever successful connection.

[FN-GM]

I have no objection of staff having access to it as long as they follow our internet usage policy; however they do not know the wifi password; the device has to be manually added and the device, serial and owner are recorded. All pupil devices have it pre-installed and re-registered on ever successful connection.

 

If staff have admin rights they will be able to view the Key.

[sjpage10]

we have only ever given the key to staff, as giving the key to students would mean that some could access it from home as they live directly behind the school ! however now on the wisdom of a few (not me) we have purchased a batch of android tablets and it's going to be fun locking these down so the kids don't access our key on them (as soon as they do every kids mobile phone in the school will be browsing via our wireless ), surfaces I would have agreed with then I could have used GP .I was asked if our sports hall team that run clubs at night could give our key to it's customers but I had to explain that they had never agreed to our usage policy.

[FN-GM]

we have only ever given the key to staff, as giving the key to students would mean that some could access it from home as they live directly behind the school ! however now on the wisdom of a few (not me) we have purchased a batch of android tablets and it's going to be fun locking these down so the kids don't access our key on them (as soon as they do every kids mobile phone in the school will be browsing via our wireless ), surfaces I would have agreed with then I could have used GP .I was asked if our sports hall team that run clubs at night could give our key to it's customers but I had to explain that they had never agreed to our usage policy.

 

You could setup your wireless so it disables the SSID after hours. No chance of using it then.

[DrCheese]

We have three SSID's.

 

• One for school owned devices, i.e laptops. Only "Domain computers" & a few user groups can access this. This is routeable to the main network
  
• One for ALL students & Staff to access the Internet. They just bump through using 802.11x on our smoothwall machine. Devices on this WLAN can't talk to each other.
  
• Last, I have another one setup for visitors that presents them with a logon page when they join it. We have various AD accounts that can join can login this for a day at a time & we give it out to visitors when they show. This is ran via PFSense. On this, we also have the 802.11x cert available for Staff/student users who can't easily join the 802.11x auth using Windows 7 laptops (There's a guide you have to follow to make Win 7 work with smoothwall)
  

 

As mentioned in various other threads, We have no issue with students using our Internet connection (We have a gb link...) Our logic has always been that if we don't allow access to our wifi, students will just use 3g connections instead that we can't track. Smoothwall allows us to see what each students phone is doing. Also, it helps with devices are stolen as we can see which access point they are connected to and help catch the culprit.

Edited March 1, 2014 by DrCheese

[psydii]

@DrCheese

 

Can you point me in the direction of any guides etc that you used to set us pfsense in this way?

 

To the OP. My answer is 'to anyone who signs the aup' 802.1x with computer account authentication on two essids and one using user authentication (for BYOD) and finally a guest with captive portal (which is horrifically crude, hence my asking about pfsense)

[DrCheese]

Well... I could just use smothwalls SSL login page on the other SSID rather than pfsense, but it offers little in the way of customisation. I couldn't do much beyond change the logo of the page & one line of text. I wanted to be able to let users download the SSL cert for the staff/student wifi as well.

 

Using PFsense I can also set certain devices to bypass login entirely (via MAC) and I can leave a comment showing who's it is (& force it to a certain IP for tracking) I needed this for users that had older phones that didn't want to login every day, which is all I could do with smoothwalls SSL page.

 

Don't have a guide I'm afraid, it was all guess work! It's not too difficult tho, just install Squid and set it to transparent mode. If you want to do filtering you can pass the traffic through the smoothie or install dansguardian and do it that way.

[elsiegee40]

Well... I could just use smothwalls SSL login page on the other SSID rather than pfsense, but it offers little in the way of customisation. I couldn't do much beyond change the logo of the page & one line of text. I wanted to be able to let users download the SSL cert for the staff/student wifi as well.

Pretty much how we did it. We instruct everyone to follow the instructions on our website and download the cert from there.

[FN-GM]

@DrCheese why not use a purchased cert? They are pretty cheap.

[DrCheese]

@DrCheese why not use a purchased cert? They are pretty cheap.

 

For various reasons you can't out a purchased cert on the 802.11x mode of smoothwall. iOS/Android/Mac devices let you just ignore that it's invalid & skip through. Windows 7 on the other hand requires you to install the cert into the computers cert store.

 

Windows 8 lets you skip through it as well.. but no one uses it

[FN-GM]

For various reasons you can't out a purchased cert on the 802.11x mode of smoothwall. iOS/Android/Mac devices let you just ignore that it's invalid & skip through. Windows 7 on the other hand requires you to install the cert into the computers cert store.

 

Windows 8 lets you skip through it as well.. but no one uses it

 

I didn't know that. Could you use the SSL login instead?

[DrCheese]

Ya, but 802.11x auth means the user can sign on once and forget about it. Every time they come into WiFi range they're logged on automatically. It's brilliant

SSL login is a per session thing so no one really used it.

 

It's like cloud wifi in pubs, you can rarely be bothered to login. Whereas nowadays you get an app that installs a profile on your phone so it auto connects. Suddenly it's useful

[FN-GM]

You have a point, just trying to think of something that will be a little easier for the end user. hmmm

[DrCheese]

Well.. in the main the 802.11x auth stuff works brilliantly, it's just Windows 7 devices that suffer. I spoke to smoothwall @ BETT and there's not really much they can do about it. If only Windows 8 had taken off.

[mthomas08]

Quite simply, who has access to your wifi within your school?

 

For us it was staff and sixth form students. It appears the password to the wifi has been leaked and lower years have access to it, I have raised this with SLT.

 

Just interested what other schools do. We have 2000 students.

 

We have three separate Wi-Fi's, one for open access to all, a secure one and a hidden secure one.

 

The open one is completely cut off from everything and when the upgrade is finished we will be okay for any more additional devices being added. We are a 1400 Student based School where all Year 7, All Year 8, All P16 and some of Year 9 have devices. We also allow them to put their own devices on to it.

[tmcd35]

What's WiFi?

 

Any signal you think you can pick up is officially unsupported. Got plenty of network cables though...

[Earthling]

Very spread out campus here, makes wi-fi an expensive luxury right now, but obviously we'll have to bite the bullet and spend the money eventually......soon.

 

As soon as the only couple of blocks (so far) were wi-fi'd, I had a constant stream of staff in to connect their personal iPads and phones. Sent them all away again on the basis that they don't need to/shouldn't be using their personal devices for school-work.

 

I'm hoping by the time we get round to wi-fi'ing the whole school, it won't be my problem anymore.