Computer Science - Python, Scratch in Network Envrionment

[Theldron]

Hello all,

 

I have been asked to setup python and scratch on domain PCs for the computer science course next year. I am fair to say very, extremely reluctant (not happening)! But I have been asked to find a way round it. Previous years, we had a seperate room on its own network running the software which worked really well, but as the course was not run last year the room was turned into a proper PC room.

 

So now we have no spare rooms that I can do this to. What do others do? I was thinking VirtualBox as a way forward.

 

Thanks

Sean

[synaesthesia]

Look up virtualbox programming environment on the search here, it's been well documented how to achieve exactly that complete with a link to the student's home directory. Works really well although you won't need it for Scratch, there's no issue running that on a standard network.

[FN-GM]

If your system is locked down properly I can't see an issue in having it on the production network.

[synaesthesia]

If your system is locked down properly I can't see an issue in having it on the production network.

 

Do you have an example setup for such a locked down system? It would of course be highly preferable to running 3rd party software and accounting for extra OS licenses, however there's risks-a-plenty mostly with executable files involved. For instance, the ability to run a command prompt even with it disabled from within most IDE's as well as being able to run various bits of software. However with the ease of the VirtualBox setup I never looked at it any further with more logic so would appreciate any tips on doing so. It doesn't help with my own knowledge of the IDEs being limited so unsure as to what needs locking down.

[FN-GM]

What could they do in the command prompt?

[jdell]

I agree with FN-GM, if you lock down the network properly in the first place even if they have the IDE installed then CMD wont be able to do anything. We run Phyton and visual studio in our environment and we have never had any issues with students running code on the computer suites. I previously ran a large organisation that offered 16+ education and we never had issues there.

[synaesthesia]

I'm not talking about cmd or the command prompt, I mean a command prompt; such as the many 3rd party available that would offer the same functionality. Granted the majority of things we wouldn't want them to access would already be locked either by disallowing access or NTFS permissions but you'd still be able to browse a computer's hard drive generally, delete bits and bobs that don't want deleting for things to continue working... That's one of the things I remember doing in initial testing as a student user using one of the many 3rd party apps.

But it's more than just that. Exe files compiled in home directories; do they need that at all? I don't want *anyone* running *any* EXE for obvious reasons other than those we mandate. Can such projects just be kept in an unbuilt state and compiled as needed?

[FN-GM]

I still don't see the argument for the command prompt, any changes to the machine will be stopped via UAC. They do not use them as complied .exe here.

[Primus]

Python is an interpreted rather than compiled language so students wouldn't be running .exe files.

 

There's no issue having Python or Scratch installed - this is now the second school I've been at where we've had both installed and we've never had a single issue with either.

[Anonimouse007]

Interesting topic, as I've just been asked to do exactly the same!

 

I've been asked to install Scratch, Build Your Own Blocks and Python/Python IDLE on our network. Scratch is harmless, as is Build Your Own Blocks. In fact, the latter is a fancier, web-based version of the former! I haven't had much experience of Python myself, but as you say, from a brief glance, it looks as though students could cause damage to the network/computers. I understand that quite a few secondary schools in our area have a dedicated computer suite, complete with server, for such applications. I've heard of VirtualBox too, which was next on my list to test ...

 

However!

 

The majority of our curriculum network is VDI based. Scratch is already installed on the network (other IT teachers have used it!) and I doubt Python will be difficult to install on the software template. Students only have access to their home folder - Access to Command Prompt, Control Panel, or others areas of the network have been disabled. Do you think it's safe to run Python on the network? To be honest, if a student did somehow damage the Windows 7 VM their session is running on, the VM rebuilds itself overnight ... or immediately, if prompted by myself.

 

Thoughts?

[Anonimouse007]

I think someone above has just answered my own question - Thanks!

[Fazza]

We install Scratch and Pyton on all the computer suites used by our ICT department in case they have any last minute room changes etc. and all works fine with no issues. Been like this for a few years now and our 'little rascals' have not caused any issues.

[jthompson]

We have Python deployed to computer rooms like other regular applications (I haven't had the time to explore the VM option for it yet, but would like to). We've had a few users breaking the house rules, mucking about with Python during other lessons, including libraries that they've downloaded, etc. so I rolled out a startup script that adjusts the permissions on the main Python executable to deny execution for members of a particular group (named 'Banned Python Users' or somesuch). Dropping troublesome users into that group prevents them from running any Python code. I need to formalise the rules to make things fair, but it does give us an emergency killswitch, should it be needed.

[synaesthesia]

The biggest thing the VM does for us is to give the users as much of a true-to-life experience as possible. So if they wanted to create a program that interacts with part of the system they would otherwise be unable to access, they're free to do so.

[3s-gtech]

We have Scratch available site wide but Python is only in our (network accessed) VM environment as it can be used to get around some pretty well locked down parts of Windows IIRC. This also gives us the flexibility to also run other software that the board requires like Greenfoot, WAMP etc on a VM which the students use as an admin. I can quickly rebuild them if they break the OS, and they can't access the network from the VM. Edited June 5, 2017 by 3s-gtech
speelong

[JATSO]

They are a default install for my schools and never had an issues with them.

[dhicks]

I was thinking VirtualBox as a way forward.

 

Trinket lets you run Python code in a web browser:

 

https://trinket.io/

 

Myself, I have an account with PythonAnywhere, who are excelent, London-based, and keen to cater for the edutcation market:

 

https://www.pythonanywhere.com/

 

You could also provide a classes-worth of Raspberry Pis. Have them permanatly set up and available on the network for browser-based remote access, that way there's no setup time each lesson.

[Tefters]

This looks like my thread from a year and a half ago.

In short - make sure all GPO's are in-place and working 100%, cmd and powershell are properly locked down and that you have app locker at the ready.

[al80]

Not sure if it'll do for a Computer Science course but I've just started using repl.it to teach Python to KS3 and that's been great so far. You can set up classes and set assignments with it and because it's cloud based pupils can use it in their own time... if they are so inclined. Edited June 6, 2017 by al80

[AlanD]

They are a default install for my schools and never had an issues with them.

 

Perhaps your students are well behaved - or perhaps they don't know much about programming....If they have access to running any code it would be possible to do a lot of mischief for a laugh (even if its all seemingly locked down) ....or maybe it won't be such a laugh if you have to fix it afterwards. I've not had (or at least not known of) a concerted attempt by any student in recent years ...but that doesn't mean I trust them - the next generation of programming wizards.

 

I think virtual boxes are the way to go - so that each time it starts they get a completely clean slate to load their code into. And I wouldn't give that box any access to the network....

[3s-gtech]

Got WJEC Computer Science exam coming up, which needs Greenfoot amongst other things. I don't think I'd have been able to provide all of the requirements of the course to normal user accounts - too many holes, allowing random .js and exes through. VMs made it easy.

[JATSO]

Perhaps your students are well behaved - or perhaps they don't know much about programming....If they have access to running any code it would be possible to do a lot of mischief for a laugh (even if its all seemingly locked down) ....or maybe it won't be such a laugh if you have to fix it afterwards. I've not had (or at least not known of) a concerted attempt by any student in recent years ...but that doesn't mean I trust them - the next generation of programming wizards.

 

I think virtual boxes are the way to go - so that each time it starts they get a completely clean slate to load their code into. And I wouldn't give that box any access to the network....

 

Yes I agree about the use of VBoxes for coding in secondary schools but were primary they are behaved users at all four schools and they don't do much anyway, its all very basic coding no pun intended.

[dhicks]

Trinket lets you run Python code in a web browser:

 

https://trinket.io/

 

Just to add that I saw this is use with a Year 4 class yesterday, and it seemed to work very well. Pupils can log in with their existing Google / Clever.com accounts, so minimal admin setup, and Trinket's Python implementation includes the Turtle module, so our year 4s yesterday were drawing pattern with turtle graphics. I think Trinket have actually written a Javascript-based version of Python, so I'm not sure their version of Python includes all of the standard library, so for more senior school exercises you might want to check what libraries you need before you start. For actual software, I'd use Python Anywhere, as they provide a nice easy-to-use Flask implementation.

[mavhc]

Perhaps we need a red-door thread "things pupils were able to do with a programming language, and how to block that hole if possible"

[Theldron]

Thanks for all the posts and advice.

 

I have checked and powershell and cmd are well locked and cannot be run through python. But I am still paranoid and rather err on the side of caution with a VMBox. This paranoia has come from experience as a few years back a student (clever little sod when it came to programming) managed to play with different parts of the network, nothing malicious but still makes me cautious.

 

I just don't think anything can be 100% blocked, locked down or safe (otherwise there would be no hackers) and with some of the kids we have here they will always find a way round to "mess".

 

- - - Updated - - -

 

Perhaps we need a red-door thread "things pupils were able to do with a programming language, and how to block that hole if possible"

 

Like that idea, would be helpful.