davephs Posted May 7, 2015 Posted May 7, 2015 We have a been asked by our Junior IT Teacher to enable DOS (cmd.exe) for students? As apparently this is now part of the curriculum? Have you encountered this? - Obviously we cannot enable the DOS prompt... Are there any emulators out there, we can use instead of the real thing ? Any help would be appreciated... Thank you
kennysarmy Posted May 7, 2015 Posted May 7, 2015 We have a been asked by our Junior IT Teacher to enable DOS (cmd.exe) for students? As apparently this is now part of the curriculum? Have you encountered this? - Obviously we cannot enable the DOS prompt... Are there any emulators out there, we can use instead of the real thing ? Any help would be appreciated... Thank you Sandbox environment?
sparkeh Posted May 7, 2015 Posted May 7, 2015 As far as I've seen, the curriculum does not insist on using cmd.exe but some schemes of work suggest it as one of the possible tools to use. AFAIK everything can be done with other tools, we do not allow our pupils access to cmd.exe Do you know exactly what piece of work/topic they are doing?
mats Posted May 7, 2015 Posted May 7, 2015 If it's Switched On Computing, it'll be Year 3 / 3.4 We are Network Engineers (!) and they'll be after ping, nslookup and traceroute commands. I gave them a link to putty which auto connected (ssh) to an old linux box with their username pre-entered so they just had to stick a password in. Staff / children just copied text from the putty box into a document for evidence. It also introduced them to the concept of operating a computer without being sat in front of it.
CAM Posted May 7, 2015 Posted May 7, 2015 Wouldn't Powershell be more up to date for the kids to learn?
mavhc Posted May 7, 2015 Posted May 7, 2015 Why is it obvious you can't enable the cmd prompt? what are they going to do, ping you to death?
davephs Posted May 7, 2015 Author Posted May 7, 2015 I have tried DosBox unfortunately it doesn't appear to have ping or nslookup commands etc which are required. Is this correct ? The sandbox & Linux Box do sound like possible solutions, but we were hoping to keep it as simple as possible... and if there were a standalone emulator that would be the best way forward ? Do you know of any online based emulators ?
MrKJLS Posted May 7, 2015 Posted May 7, 2015 Powershell Web https://technet.microsoft.com/en-gb/library/hh831611.aspx
Roberto Posted May 7, 2015 Posted May 7, 2015 We have a been asked by our Junior IT Teacher to enable DOS (cmd.exe) for students? As apparently this is now part of the curriculum? Have you encountered this? - Obviously we cannot enable the DOS prompt... Why ever not? If your systems are configured correctly then this shouldn't result in a serious risk to your security. If your systems are not configured correctly then the risks that can be realised via the command prompt are equally vulnerable in other ways and so should be fixed by methods other than pretending the command prompt is where the devil lives.
davephs Posted May 8, 2015 Author Posted May 8, 2015 How is your system configured so that the Command Prompt doesn't pose a serious security risk? Surely if students can access this, then they could potentially wreck the local PC, if not the network ? (Bearing in mind we have no budget to upgrade our switches with VLAN capability, etc.) If you can provide a method where students can access the command prompt without any issues, then we are open to suggestions.
kennysarmy Posted May 8, 2015 Posted May 8, 2015 How is your system configured so that the Command Prompt doesn't pose a serious security risk? Surely if students can access this, then they could potentially wreck the local PC, if not the network ? (Bearing in mind we have no budget to upgrade our switches with VLAN capability, etc.) If you can provide a method where students can access the command prompt without any issues, then we are open to suggestions. Interesting debate, looking forward to seeing how a "safe" command prompt can be achieved....
Bertie_Dellend Posted May 8, 2015 Posted May 8, 2015 Why ever not? If your systems are configured correctly then this shouldn't result in a serious risk to your security. If your systems are not configured correctly then the risks that can be realised via the command prompt are equally vulnerable in other ways and so should be fixed by methods other than pretending the command prompt is where the devil lives. Come on then Roberto - tell us how to enable the command prompt and "configure systems correctly" without exposing all sorts of potential issues
dhicks Posted May 8, 2015 Posted May 8, 2015 Obviously we cannot enable the DOS prompt... There was a similar thread recently (I've searched, but I can't find it) about enabling the command prompt - I think that thread gave some specific examples of security issues, along with how to solve them. Can anyone remember the thread, or give us a list of security vunerabilities that have no solution but to disable the command prompt? The suggestion by mats, above, sounds good - set up a Linux server and let pupils log in to that. If there's a later requirement for pupils to have their own web development area or similar you can use it for that, too.
TechSupp Posted May 9, 2015 Posted May 9, 2015 (edited) Slightly of thread but not quite, could not use nslookup and ping in dos with my Y3's it would just not mean anything and go over their heads! Switched on has some good topics but not overly convinced with its suitability at times. Have used a visual traceroute website for doing this kind if stuff with kids (done with my Y6's) and they get much more out of it than looking at response times in a dos window. Teacher needs to be a bit more flexible in resources to use and not stick rigidly to Switched On really. Anyway thats my two penneth. Anyway seems a heck of alot of work for what would essentially be one lesson. Edited May 9, 2015 by TechSupp 1
Roberto Posted May 13, 2015 Posted May 13, 2015 (edited) How is your system configured so that the Command Prompt doesn't pose a serious security risk? Surely if students can access this, then they could potentially wreck the local PC, if not the network ? (Bearing in mind we have no budget to upgrade our switches with VLAN capability, etc.) If you can provide a method where students can access the command prompt without any issues, then we are open to suggestions. Sorry I didn't reply to this sooner - didn't get notifications. Simply put - nothing magically bad happens just because someone opened the command prompt. It respects the permissions the user has been given anyway. If you don't want students (who I assume would be normal users on a workstation) to be able to view other people's user areas or delete system32 then don't give them permissions to do so (as is the case by default). If you don't want them to be able to alter the system from the command line, e.g. changing the IP address, then again, don't give them permission to do so (as is the case by default, again). This relies on locking things down properly (e.g. securing the c: drive with ACLs rather than hiding it and pretending it doesn't exist) but this is a more robust solution than hiding but not securing settings and files and hoping someone doesn't discover a route to access them that you haven't thought about. As for the network - yet again, by default, normal users shouldn't have permission to change anything just by having access to the command prompt. If your network is so insecure that a random user can reconfigure a server just by having access to the command prompt then you need to fix the security on that server, not pray that no one finds a route to the command prompt you haven't thought of. We have several thousand 16-19 yr old students with access to the command prompt here, for several years now. We've had no issues caused to either individual workstations or the network at large by allowing them access to the command prompt or to tools like visual studio. Come on then Roberto - tell us how to enable the command prompt and "configure systems correctly" without exposing all sorts of potential issues Without wanting to sound like I'm attacking you on a personal level Bertie, this is the kind of attitude that annoyed me in the last thread on this - talking about "exposing all sorts of potential issues" is trading on technobabble and fear of the unknown and it's poor customer service to deny a learning opportunity with a reply like that (if anyone is, not suggesting you or anyone actually does do that). Let's talk about specific threats and we can then talk specifically about how to counter these threats and have a balanced discussion of the potential risk vs. reward of enabling access to something. After all, if we can't expose the network to students because of the threat of "exposing all sorts of potential issues" then why do we even allow students to use computers in schools and colleges at all? There are always all sorts of potential for all kinds of issues, after all. Edited May 13, 2015 by Roberto 2
Bertie_Dellend Posted May 15, 2015 Posted May 15, 2015 Sorry I didn't reply to this sooner - didn't get notifications. We have several thousand 16-19 yr old students with access to the command prompt here, for several years now. We've had no issues caused to either individual workstations or the network at large by allowing them access to the command prompt or to tools like visual studio. Without wanting to sound like I'm attacking you on a personal level Bertie, this is the kind of attitude that annoyed me in the last thread on this - talking about "exposing all sorts of potential issues" is trading on technobabble and fear of the unknown and it's poor customer service to deny a learning opportunity with a reply like that (if anyone is, not suggesting you or anyone actually does do that). Nothing personal taken here Roberto. Although I don't see why any of this should "annoy" you? I am not trading on fear of the unknown - but past experience. May I ask what your 16-19 year olds actually use the command prompt for? What are they actually able to do with it? (And learn from?)
dhicks Posted May 15, 2015 Posted May 15, 2015 I am not trading on fear of the unknown - but past experience. Can you give us specific examples of what happened - are there some things we need to check on our own systems?
Bertie_Dellend Posted May 15, 2015 Posted May 15, 2015 Can you give us specific examples of what happened - are there some things we need to check on our own systems? This is going back to my first technicians job in a school about 13/14 years (Windows 2000/XP). Cmd.exe was not blocked by the network manager. The things I can remember from the top of my head - Students used telnet to access our exchange server to spoof emails from teaching staff (very amusing, but potentially disastrous). Students enabled the net send service and sent random explicit messages to other pc's on the LAN. They created different .bat files and saved them in the "all users/startup" folder. The script rebooted the pc after 5 mins etc. 1
Roberto Posted May 15, 2015 Posted May 15, 2015 Nothing personal taken here Roberto. Although I don't see why any of this should "annoy" you? I am not trading on fear of the unknown - but past experience. May I ask what your 16-19 year olds actually use the command prompt for? What are they actually able to do with it? (And learn from?) Fair enough - And they are generally using mickey mouse network commands to get some practical experience of networks, so things like ping, tracert, etc. This is going back to my first technicians job in a school about 13/14 years (Windows 2000/XP). Cmd.exe was not blocked by the network manager. The things I can remember from the top of my head - Students used telnet to access our exchange server to spoof emails from teaching staff (very amusing, but potentially disastrous). Students enabled the net send service and sent random explicit messages to other pc's on the LAN. They created different .bat files and saved them in the "all users/startup" folder. The script rebooted the pc after 5 mins etc. These are all examples of not locking things down correctly (though some of it is down to more lax defaults from Microsoft back in the day). Students used telnet to access our exchange server to spoof emails from teaching staff (very amusing, but potentially disastrous). -- Ouch. But either they were authenticating as the teachers concerned or someone had configured the Exchange server to allow anon spoofing. Not good either way. Students enabled the net send service and sent random explicit messages to other pc's on the LAN. -- By default, users should not be able to enable a disabled service. Microsoft were a bit lax on this back in the day so it might be on them. They created different .bat files and saved them in the "all users/startup" folder. The script rebooted the pc after 5 mins etc --Again, incorrect permissions - they should never have been allowed to do anything more than read/execute from that area. Now, don't misunderstand me: I do think there's a case for saying "I have no business / learning requirement to enable something here, so I won't. Perfectly reasonable choice. There is also be one for saying "I don't have the resources to check this is secure and on balance the school has decided it doesn't want to take the risk". But nothing you describe above is a fundamental flaw in the command prompt itself.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now