Secure Computer Science

[KCMD]

Just wondering what your setups are for providing a secure, suitable solution to the computer science curriculum in a secondary school?

 

For the past two years we have been running a local VirtualBox VM with the software installed. But last year the software stopped working for unknown reasons. I've brought it up for help on the VirtualBox forums and I exhausted their knowledge. It's completely unusable. The obvious problem is that it's free software and we're left on our own no matter how bad the issue is. I think we came to the conclusion that the HW was just too old.

 

As a replacement we are trying to get a Hyper-V VDI solution running. This looks like an ideal solution; it allows students to have a persistent machine, we can apply GP, ACLs, firewall rules, map drives etc. But again we are having an issue with the guests failing to connect sometimes. We're still working on this.

[3s-gtech]

My problem with using a Hyper-V VDI was that by definition, the VM was connected to the network and had to authenticate. This didn't sit well with me - I wanted the students to have full admin access to their own VM without having any ability to touch the wider network at all. I'm sure this can be done with Hyper-V, but damned if I could do it (I'm no hot-shot with it, my setup is fairly simple). In the end I repurposed another server as a VirtualBox host which students remote to - a class of 30 all using it at once is a bit of a struggle but it works.

[KCMD]

Thankfully the guy that set up our VDI is decent with networking the plan was to have the guests in a separate VLAN with ACLs and firewall rules to reduce the traffic down to the absolute minimum. Not a perfect sandbox but we at least have a lot of centralised control over it.

 

I admit our hosts are struggling a little with 40+ guests. Storage performance is even worse. It will certainly require investment if we ever get it up and running.

[jtotheb]

We initially did it with VirtualBox, but found that limiting to scale up once more than a few classes needed it.

 

Now we have snapshotted VDIs in an isolated network running on Hyper-V managed by Ericom PowerTerm WebConnect. Once they're finished with they flip back to a known working state so no matter how much they're mashed up they just revert to a working state. Work can be saved out to school GApp or O365 accounts.

 

The VDIs themselves are standalone - one good machine that's batch cloned and snapshotted. Access to the VDI frontend/portal is done with AD credentials, but the Ericom software then allows us to have a single user that exists on the VDI to be used on the VDI. That way there's no additional accounts and passwords for students and staff to worry about. Base image is on SSD, differencing on spinning rust.

 

(The newest version of their software Connect doesn't yet support VDI in the same way. If you're interested in trialling it make sure you get a trial of WEBConnect)

[Steve21]

Now we have snapshotted VDIs in an isolated network running on Hyper-V managed by Ericom PowerTerm WebConnect.

 

How's it isolated if they can remote to them? Got to be some link to the main network surely :s or am I missing something?

 

Steve

[3s-gtech]

If it's anything like the VB solution, the host server runs a remote desktop (or similar) service out to the users, which can access the client VMs and broadcasts their display. Quite intensive on the host, but it means that the console is producing the video feed from the VM rather than RDS.

[Steve21]

If it's anything like the VB solution, the host server runs a remote desktop (or similar) service out to the users, which can access the client VMs and broadcasts their display. Quite intensive on the host, but it means that the console is producing the video feed from the VM rather than RDS.

 

Doesn't that mean the VM needs an IP to remote into though? or does it do a magic redirecr from the HOSTs connection then?

 

Steve

[3s-gtech]

I couldn't say more from a Hyper-V perspective with any authority - I'd only be conjecturing. In VB though:

 

Client workstation fires up RDS to VM host server,

VM host server connects to the console view output for the specified VM (denoted by the port number) using the VirtualBox Remote Display Protocol (in the add-on pack). Note that it doesn't connect to the VM over its network connection - our VMs have no net connection at all,

Client workstation receives a RDP connection to the VM, but views it as if it's a physical machine (because the VM sees this connection as a normal video output). That means full graphics acceleration with the right drivers, Aero effects, the lot (which can obviously cripple the host if too many are on it!)

[Steve21]

I couldn't say more from a Hyper-V perspective with any authority - I'd only be conjecturing. In VB though:

 

Client workstation fires up RDS to VM host server,

VM host server connects to the console view output for the specified VM (denoted by the port number) using the VirtualBox Remote Display Protocol (in the add-on pack). Note that it doesn't connect to the VM over its network connection - our VMs have no net connection at all,

Client workstation receives a RDP connection to the VM, but views it as if it's a physical machine (because the VM sees this connection as a normal video output). That means full graphics acceleration with the right drivers, Aero effects, the lot (which can obviously cripple the host if too many are on it!)

 

That's pretty cool, need to have a nosy at that. I'm guessing the only downside is say you have 30 machines you need 30 ports setup? So what stops one kid connecting to someone elses?

 

Steve

[3s-gtech]

We custom built an authentication system that fires up the correct VM/port depending on the student's AD username, so the port is tied to their AD user. They don't have RDC in their Start menu so they can only fire it up with our little custom program. The other cool thing it can do is it will create a VM for them if they don't have one already (and if they're on an 'allowed' list of users). As each user has their own VM, the server needed a bucket load of storage - we just plonked a load of big consumer SATA SSDs in there to do the job.

[Steve21]

Ah ok, that's a cool idea so take it they save work locally then? No network documents etc

 

Thanks,

Steve

[3s-gtech]

The VM has a mapped network drive through VB, which the students can save work to (this is also created alongside the VM). This is isolated from their network home area, and can only be accessed from the VM, but it's backed up along with our other shares. It means that if their VM is nuked and has to be rebuilt they don't lose anything. Permissions and drive mapping mean that there's no route out from this area.

[jtotheb]

How's it isolated if they can remote to them? Got to be some link to the main network surely :s or am I missing something?

 

Steve

 

A gateway component sits in the VLAN with them and a port is open to that. There are ACLs in place to stop client traffic. You're right, it's not no-connection isolated rather it's isolated from domain traffic and vice-versa.

[flyinghaggis]

In VB though:

 

Client workstation fires up RDS to VM host server,

VM host server connects to the console view output for the specified VM (denoted by the port number) using the VirtualBox Remote Display Protocol (in the add-on pack). Note that it doesn't connect to the VM over its network connection - our VMs have no net connection at all,

Client workstation receives a RDP connection to the VM, but views it as if it's a physical machine (because the VM sees this connection as a normal video output). That means full graphics acceleration with the right drivers, Aero effects, the lot (which can obviously cripple the host if too many are on it!)

 

That does sound pretty interesting. We have Virtualbox installed on our client PC's with locked down settings (as per this thread) however we've found that pupils keep finding ways of gaining access to the settings. I was thinking our next step should be to implement some kind of VDI server based solution so it would be helpful if you had any guides or links to articles online which would help us create something similar to your setup?

 

Given the requirements in the new computing curriculum this seems to be becoming a common issue. There are so many programming and development utilities they expect pupils to use (Python, PHP, Apache,etc) which really aren't suitable for running on a live network as they give the pupils access to way more than is safe to do so.

 

It's a shame as it's causing quite a lot of friction between ourselves and the computing department.

 

They're asking for pupils to run these apps on live network PCs with access to the internet and network shares/printers/etc but IMHO it simply isn't feasible to give them that kind of access on anything but a separate network isolated, to some degree, from the rest of the school. The problem is the overheads of running such a setup can be pretty heavy in terms of the time it takes to configure/manage it and/or the additional hardware/software required to support it.

 

Edited September 27, 2016 by flyinghaggis

[3s-gtech]

While I can't share the source of our software, it's fairly simple in operation, and consists of a program on the server which listens for incoming connections and uses the VirtualBox command line extensions to execute each command (check if VM exists, create VM, start VM, shut down VM). It could be done with a web interface if you were so empowered - we used Visual Studio.

 

We used the normally available VB setup and extensions otherwise, in conjunction with these guides, to create a 'VirtualBox Server'.

 

What is VirtualBox Server, Headless, Service and Where to Download it?

How to Connect and Use Multiple Remote Displays in Sun VirtualBox

Chapter7.Remote virtual machines

 

One other thing to bear in mind - your VB host server will need a Windows Server Datacentre license to host an unlimited number of Windows VMs. Our host runs Server 2012 R2 Datacentre. Also check your RDS licensing.

 

We have given the students the option of using a ready-made Debian VM if they wish also. Both images have Python and Scratch installed (obviously no way of using Scratch to control motors etc this way - that's a job for Raspberry Pi here).

[kennysarmy]

That does sound pretty interesting. We have Virtualbox installed on our client PC's with locked down settings (as per this thread) however we've found that pupils keep finding ways of gaining access to the settings. I was thinking our next step should be to implement some kind of VDI server based solution so it would be helpful if you had any guides or links to articles online which would help us create something similar to your setup?

 

Given the requirements in the new computing curriculum this seems to be becoming a common issue. There are so many programming and development utilities they expect pupils to use (Python, PHP, Apache,etc) which really aren't suitable for running on a live network as they give the pupils access to way more than is safe to do so.

 

It's a shame as it's causing quite a lot of friction between ourselves and the computing department.

 

They're asking for pupils to run these apps on live network PCs with access to the internet and network shares/printers/etc but IMHO it simply isn't feasible to give them that kind of access on anything but a separate network isolated, to some degree, from the rest of the school. The problem is the overheads of running such a setup can be pretty heavy in terms of the time it takes to configure/manage it and/or the additional hardware/software required to support it.

 

 

What's the worst that they can damage by gaining access to the settings?

[flyinghaggis]

If they get on the Virtualbox management utility (or find a way to get Vbox to run with command switches or a specific startup script) they could re-enable the network interface on the VM or use the console to add a VM of their own making with access to the school network. This is what's making me want to move to a system where we run the VM's on a central server rather than on client machines as we'd be able lock down security settings more tightly. Edited September 27, 2016 by flyinghaggis

[3s-gtech]

To give a little more context to our setup, we're using:

 

HP DL385 G5P (pretty old now)

2 x Opteron 2354 quad core processors

P400 SAS controller on latest firmware (definitely a weak point)

60GB of RAM

4 x 146GB 10k SAS for OS (RAID 10), 4 x 512GB SSD (RAID 0) - yup, RAID 0. Only way to get the speed and capacity needed on a P400. All data on this array is disposable.

Server 2012 R2 host OS

VirtualBox 5.1

VM OSs - Windows 8.1 64 bit (1.5GB RAM, 2xvCPU, 30GB storage), Debian 6.0.6 (1GB RAM, 1xvCPU, 10GB storage)

[forkies]

I have just been asked (a week before they want to start) getting Linux running for a controlled assessment. I am thinking of hosting up a load of virtual guests on a VMware server, all guests on a vlan with act so they can only see the student computers. Then installing putty on the student computers and assigning one guest per student (incremental IP) and getting them to set a new password on login. Once finished I just restore all guests back to original state and power off.

 

Luckily I have a spare server with plenty of space and ram to host these guests on.

 

Then I would look to setting a policy to ban putty outside controlled assessments.

 

For future I want to look at some sort of internally hosted sandbox virtual infrastructure so all student coding and controlled assessments can be done without potentially affecting system security. Does anyone have anything like this, maybe VMware horizon? Would be interested to learn more before I get asked to do something again with no time to test!

[kennysarmy]

If they get on the Virtualbox management utility (or find a way to get Vbox to run with command switches or a specific startup script) they could re-enable the network interface on the VM or use the console to add a VM of their own making with access to the school network. This is what's making me want to move to a system where we run the VM's on a central server rather than on client machines as we'd be able lock down security settings more tightly.

 

In case you've not come across this:

 

Chapter9.Advanced topics

 

 

Also you can lock down the setting by editing NTFS permissions on Sandbox.vbox & VirtualBox.xml so that students cannot write to them.

 

Cheer

[flyinghaggis]

Are the above just command line switch options or does running this command permanently change the way vboxmanage.exe launches. For example if a pupil manages to run vboxmanage.exe directly will it still give them the default range of options after running that command?

 

We already have a customised executable to run a locked down version of the startup script but pupils have been finding ways to launch the vboxmanage.exe program directly bypassing all the security settings the script puts in place?

[kennysarmy]

Are the above just command line switch options or does running this command permanently change the way vboxmanage.exe launches. For example if a pupil manages to run vboxmanage.exe directly will it still give them the default range of options after running that command?

 

We already have a customised executable to run a locked down version of the startup script but pupils have been finding ways to launch the vboxmanage.exe program directly bypassing all the security settings the script puts in place?

 

They change the behaviour until the relevant command is run to change it.

 

 

How are they getting to vboxmanage.exe - are they able to browse the C:\ drive ??

[Steve21]

How are they getting to vboxmanage.exe - are they able to browse the C:\ drive ??

 

You can just run it directly via shortcut etc, or open file tab blahblah

 

Steve

[flyinghaggis]

You can just run it directly via shortcut etc, or open file tab blahblah

 

Steve

 

That's the problem. We hide the C: drive and have even created a custom executable to hide the scripted shortcut location and parameters but there's always an old wind9x/3.1 based program they need to run which lets them freely browse the C: drive and find out where it's installed. And if they google Virtualbox with a little bit of investigation they can (and already have) guess where it points to.

 

It's worrying as they've set these applications as being part of the curriculum but nobody appears to have given any thought to the security implications of running development/coding apps on school networks. Most of the other local schools I've spoken to have just installed Python/EasyPHP/Vistual Studio/etc directly onto the computers and given pupils access to run them.

Edited September 29, 2016 by flyinghaggis

[kennysarmy]

 

Our students get this when they try to "Open File Location..."

 

This is restricted via our student group policy restrictions.