Raspberry Pi Security

[BFCIT]

We are looking at getting a handful of Raspberry Pi's but are a little concerned.

 

Before we give the go ahead - has anyone come across any situation where students have managed to gain access to internal systems using these devices?

 

My knowledge of Raspberry Pi's is limited but I believe there is a linux shell on the Raspberry Pi 2 O/S which could provide elevated permissions, access to files/folders on a windows server network that we wouldn't want to share with students and just in general cause us server issues and headaches?

 

If so I am wondering what ways you would take to minimise said risk. The reason we need them to be connected to the network is because they require internet access. I am aware things like VLANS could be used and/or port-security, but thought i'd ask first.

 

Thank you.

[plexer]

Access to network files and resources can only be done with relevant credentials just having access to a "unix" command line doesn't provide this.

 

Ben

[free780]

Do the Pi's need to be on the network? If so why not a separate vlan. If they just need an internet connection, will they need a proxy configuring? If not a separate vlan give them assigned IP addresses which have limited access.

[boblatimer]

some advice here....

 

RasPi

[mrcrazy04]

It's probably worth ensuring users don't have the ability to gain root privileges (so they can't install software or make other changes to the system setup), and ensuring any utilities that could be used for mischief (such as nmap) aren't installed (I'm sure there'd be one who'd run nmap, list some open ports and then go round bragging that he'd "hacked" the network).

 

You could also use AppArmor to prevent applications behaving in an unwanted manner, but it can be tricky to get right.

[FN-GM]

Do the Pi's need to be on the network? If so why not a separate vlan. If they just need an internet connection, will they need a proxy configuring? If not a separate vlan give them assigned IP addresses which have limited access.

 

This is what I would do.