Visual Studio (VB) running executables - How do you do it? Do you allow it?

[Sam_Brown]

We've started teaching VB where I work. Getting issues when users are compiling to an EXE as obviously by default they can't run those files from their home area (for good reason!).

 

How do people get around this? Using a virtual machine on each PC? Giving the students the ability to run EXE files? Some config changes within VB?

 

Just curious how other people do it?

[Sam_Brown]

Anyone?

[MouseAT]

I've not had the opportunity to look into how executable signing works in Visual Studio, but I wonder whether it's possible to have it automatically sign the executables it creates using a trusted certificate from an internal CA. If that's possible then you could just create a certificate rule in software restriction policies to allow said signed executables to run. That's just a quick thought of the top of my head - I have no idea if it's feasible to implement in the real world.

[localzuk]

Once you give them access to run applications via Visual Studio, you have given them a simple way around any H drive protections anyway - as you could just launch other processes via an executable created in VS.

 

So, if you're going to give them access to Visual Studio, you would either need to put it in its own environment, where they can break things without issue, or accept the extra risk involved.

[rrrrr]

We have different file screens for students who use visual studio, allowing only them to run exes. We use sophos application control running stopping them from using any malicious exes or utilities.

[garethEds]

With our redirected MyDocuments/Documents we let them run .exe files from within the Visual Studio Projects folder. I'm sure that one day one bright kid will realise they can run applications from that directory and the decision will probably bite me in the bum - but never mind.

 

I'm sure people will think I am too relaxed.

 

Gareth

[garethEds]

Its not the bright kid you have to worry about, its the kid who wants everything to crash and burn you have to worry about. If you had the functionality to only allow during actual lessons that required it then you can mitigate it but to allow it all the time 'cus i have to teach' is just asking for trouble. Still ... your at that grade that should have risked assessed it and understand the risks.

 

I love the tone of disdain in your message :-)

 

Let's be honest though - we are a school. I want my Computer Science pupils to use the application whenever they want - not just during lesson times. 'At my grade' - not your place to point that out.

 

You have quoted 'cus I have to teach' - that wasn't in my message so you are putting words in my mouth.

 

Whilst I do not have to justify my decision to you, I can assure you that we have looked at the situation and do monitor it. I'm sorry if some one 'at my grade' is such a disappointment. In the 16 years of looking after this network we've not had a day's trouble.

 

Gareth

[garethEds]

I rest my case.

 

You "rest your case" - bit vague. Give your opinion by all means but don't just walk away all high and mighty. It brings you over as slightly condescending - that's not nice, and I'm sure you are a better person than that.

 

However - you run your network how you want to. I'll do mine. Enjoy your day.

 

Gareth

 

[theeggmaster]

I've never found a 100% 'safe' way of allowing users to run compiled executable files without investment in separate systems, which is why I always try and find out what the course requires so I can give some advice about what to use. We're currently looking at Python/Scratch which can be done either online or on a Raspberry Pi (connecting to PiNet where everything is saved to the PiNet server), or the educational version of GameMaker Studio, where compiled applications run within the editor.

[Sam_Brown]

Once you give them access to run applications via Visual Studio, you have given them a simple way around any H drive protections anyway - as you could just launch other processes via an executable created in VS.

 

So, if you're going to give them access to Visual Studio, you would either need to put it in its own environment, where they can break things without issue, or accept the extra risk involved.

 

Exactly. This is the conundrum. I'm contemplating installing Virtual Box on the PCs locally and giving them a VM with VB and no restrictions to do whatever they want in. Script it so a snapshot is restored everytime the VM is launched and that's probably the safest way.

[rrrrr]

If you give them a vm will it have network / internet access? If not, how would you disable them from controlling the vm properties and adding this? that means that the students have an unmanaged/unmonitored network attached computer with local admin access.

[Sam_Brown]

If you give them a vm will it have network / internet access?

 

I've not looked into this fully but I'm assuming it won't need internet \ network access.

 

how would you disable them from controlling the vm properties and adding this?

 

If we go this way I'll just have them connect to the VM via RDP shortcut in the start menu. But running it in a VM just seems like another layer to go wrong.

 

End of the day I'm here to enable teachers and students to do whatever it is they need to do. It's my job to come up with a decent solution that's easy and reliable to use but also has mitigated risk. This topic seems to show this is an area that is quite emotive for some people and most of the posts in here seem to be pretty negative and pointing out what not to do, which is still important mind you, rather than offer any advice on a potential solution :/ We're all friends here trying to make life a little easier for each other. Anyone else got any positive experiences of solving this sort of issue?

Edited October 20, 2015 by Sam_Brown

[rrrrr]

I've not looked into this fully but I'm assuming it won't need internet \ network access.

 

 

 

If we go this way I'll just have them connect to the VM via RDP shortcut in the start menu. But running it in a VM just seems like another layer to go wrong.

 

End of the day I'm here to enable teachers and students to do whatever it is they need to do. It's my job to come up with a decent solution that's easy and reliable to use but also has mitigated risk. This topic seems to show this is an area that is quite emotive for some people and most of the posts in here seem to be pretty negative and pointing out what not to do, which is still important mind you, rather than offer any advice on a potential solution :/ We're all friends here trying to make life a little easier for each other. Anyone else got any positive experiences of solving this sort of issue?

 

Below is how i run it;

1,Use a separate file screen for students who need vb to allow exes from home drive. Exes disabled for all other students.

2, use software restriction policy to disable exes from all other areas. (Usb, desktop, profile etc)

3, use sophos av and application restriction to stop students running malicious or unapproved exes ( hacking tools, chat programs, portable browsers etc)

4, use Acls and port isolation on switches to stop computer to computer communication at desktop level.

 

If you run vm software locally, i cant think how you would stop them booting from iso's and adding network access. Very insecure

If you remotely host vm, and rdp to it you would need to give vm network access for rdp to work and to be able to transfer their work on and off vm.

Both the vm solutions give the students an unrestricted, unprotected, unmonitored computer attached to your network.

[Arthur]

If you run vm software locally, I can't think how you would stop them booting from iso's and adding network access. Very insecure

@synaesthesia managed to lock down VirtualBox to prevent students from messing around with the VMs settings.

 

www.edugeek.net/forums/how-do-you-do/95325-virtualbox-image-programming-classes.html#post1045907

[Sam_Brown]

If you run vm software locally, i cant think how you would stop them booting from iso's and adding network access.

If you remotely host vm, and rdp to it you would need to give vm network access for rdp to work and to be able to transfer their work on and off vm.

Both the vm solutions give the students an unrestricted, unprotected, unmonitored computer attached to your network.

 

I think you can avoid giving the VM network connectivity. Reading up on this. You can have Virtual Box on your computer and RDP to it using localhost as the IP and setting it to a specific port so it doesn't need network connectivity to RDP to.

 

Also if you use an RDP shortcut and set it to LOCALHOST:PORT of the VM then you don't even need to give them access to Virtual Box admin panel. Just have it run in a service in the background.

[Sam_Brown]

@synaesthesia managed to lock down VirtualBox to prevent students from messing around with the VMs settings.

 

www.edugeek.net/forums/how-do-you-do/95325-virtualbox-image-programming-classes.html#post1045907

 

Yes. This is the sort of thing I'm currently looking into. Reading into it further you can have a script to start VBox in the background and not have V Box console show up at all and can even start a VM. Then just add a line to RDP to the VM and you're away... all form just clicking on a shortcut on the start menu!

[rrrrr]

Yes. This is the sort of thing I'm currently looking into. Reading into it further you can have a script to start VBox in the background and not have V Box console show up at all and can even start a VM. Then just add a line to RDP to the VM and you're away... all form just clicking on a shortcut on the start menu!

 

If they only have access to rdp to a local vm without network access, how would the students transfer their work on and off the vm so they can continue to work on it else where and to back it up?

[Sam_Brown]

If they only have access to rdp to a local vm without network access, how would the students transfer their work on and off the vm so they can continue to work on it else where and to back it up?

 

Not sure. Do you know if Virtual Box has a way to map to local folders?

[synaesthesia]

It does indeed; in Shared Folders set up a drive mapped to your home folder. That should work across RDP as well as in a console window and there's still no network access/activity between them.

[Arthur]

If they only have access to rdp to a local vm without network access, how would the students transfer their work on and off the vm so they can continue to work on it else where and to back it up?

VirtualBox doesn't need the network in order to access a mapped home drive on the host from within the VM.

 

If connecting to a Windows VM via RDP you could setup the RD connection so that it maps the user's home directory to the VM (in the same way you would for printers).

 

Edit. Too slow.

[FragglePete]

We use VirtualBox and have it locked down so all they can do is launch that particular VM and do nothing else. Network access is blocked with the exception of a folder that maps to a directory on the home drive. The VM is immutable so that can do what they like with it, but will always return to it's previous state when restarted; I have a pop up message that appears reminding them where to store files on the VM to ensure they are not lost.

 

Last year we ran Windows 7 32Bit in the VMs, but this year have moved over to Ubuntu VMs and this is proving very popular - Python is the main choice of app here.

 

However, I've just been informed that they want to start teaching VB at A/S level next year so now have to think about how to handle that; we may have to go back to Windows VMs. The downside is that the VM files are large, and some of our machines with 64Gb SSD are starting to struggle for space after a few student profiles are in place.

 

Pete

Edited October 21, 2015 by FragglePete
Spelling!

[synaesthesia]

Indeed, some of our 80gb drives started to fall over and we've been hastily replacing them as we go along. All ICT machines that host the VM's are up to spec anyway, however we find that 120gb SSD's still give us a good 40-50gb spare with everything installed (Win7, 15GB VM, Solidworks, Adobe CS5, Office 2010, the Serif Suite and countless smaller programs).

Would certainly recommend an SSD for this particular task, the majority of ours are hard drive and performance in the VM isn't bad but an SSD makes a lot of difference.