Access to Python, PHP, MySQL for students

[Nausing]

Hi all,

 

Our ICT teachers are requesting a number of applications for students to access next year in IT Suites, including Python, MySQL and PHP tools.

 

I'm concerned giving students access to a Python console could allow them to tinker and cause damage. I'm also not sure how to offer MySQL access as I believe this needs to run as a service on the device?

 

When I was in college we had a lab with two desktops per student, one on the domain and other off the domain with these tools installed.

 

How do you manage these applications?

 

Thanks

[jthompson]

We use a hardened VirtualBox VM for python coding (immutable vhd, no network connectivity, VirtualBox UI locked down for students). That might not be suitable for work being done on something like MySQL, however.

[ChrisMiles]

What would they do with Python that they couldn't do anyway? If they have permission to do something that you wouldn't want them doing then address that instead.

If it's anything like here, they can barely write code to display text and read text responses.

[jthompson]

What would they do with Python that they couldn't do anyway? If they have permission to do something that you wouldn't want them doing then address that instead.

If it's anything like here, they can barely write code to display text and read text responses.

 

Our experience was that there were lots of 'prank' scripts. infinite loops that launched IE endlessly, etc. At least with Python sandboxed in a VM, only the VM would lock up, not the host system.

[Nausing]

We use a hardened VirtualBox VM for python coding (immutable vhd, no network connectivity, VirtualBox UI locked down for students). That might not be suitable for work being done on something like MySQL, however.

 

 

Interesting setup. Did you follow a guide or have any resources to point me in the right direction?

 

I assume the student loads VirtualBox after they log into the lab PC and it has a restricted view so they can only run the single VM and nothing else.

 

Where does the vhd sit?

 

Thanks

Edited June 6, 2019 by Nausing

[mdrabble]

We currently use a VM (immutable vhd, no network connectivity, VirtualBox UI locked down for students) like jthompson but come September will be moving away from that due to them wanting to use Visual Studio and Unity and that requires internet access to check the licence etc.

 

Used a central VHD sat on a network share on which made it easier to update etc.

 

May keep the VM as sandbox to test/compile their apps etc as they dont have permission to save or run apps from their home folders.

[Nausing]

We currently use a VM (immutable vhd, no network connectivity, VirtualBox UI locked down for students) like jthompson but come September will be moving away from that due to them wanting to use Visual Studio and Unity and that requires internet access to check the licence etc.

 

Used a central VHD sat on a network share on which made it easier to update etc.

 

May keep the VM as sandbox to test/compile their apps etc as they dont have permission to save or run apps from their home folders.

 

Interesting. Does it not cause an issue having several instances of VirtualBox accessing the same VHD file at once?

 

What are you planning to do next year now you need internet access?

[jthompson]

Interesting setup. Did you follow a guide or have any resources to point me in the right direction?

 

I assume the student loads VirtualBox after they log into the lab PC and it has a restricted view so they can only run the single VM and nothing else.

 

Where does the vhd sit?

 

Thanks

 

Yes, end users are restricted in what they can do to VirtualBox. The key part for locking down the UI is vboxmanage.exe, which is a command line utility that comes with VirtualBox (documentation is here). We have a batch script running at user logon with all of the various commands to register the VM and lock down the UI as we want it. Our vhd currently resides on the local machine. Bit of a pig to deploy those files reliably due to their size, but once it's successfully copied down to a machine we don't have any issues really. There'll be threads on here about setting up VirtualBox for things like Python.

 

Our users are prevented from registering any new VMs with VirtualBox, so they can't bring in their own VM and run it. We also adjust the file permissions on the VM's main config file (vbox file) to prevent users from making changes to it (e.g. specifying a different vhd, adding network devices, etc.).

[Nausing]

Yes, end users are restricted in what they can do to VirtualBox. The key part for locking down the UI is vboxmanage.exe, which is a command line utility that comes with VirtualBox (documentation is here). We have a batch script running at user logon with all of the various commands to register the VM and lock down the UI as we want it. Our vhd currently resides on the local machine. Bit of a pig to deploy those files reliably due to their size, but once it's successfully copied down to a machine we don't have any issues really. There'll be threads on here about setting up VirtualBox for things like Python.

 

Our users are prevented from registering any new VMs with VirtualBox, so they can't bring in their own VM and run it. We also adjust the file permissions on the VM's main config file (vbox file) to prevent users from making changes to it (e.g. specifying a different vhd, adding network devices, etc.).

 

That's really helpful info thanks.

Our student PCs are pentium with 4GB RAM and normal HDDs.

 

Not sure a VM will work very well with those specs! I'll speak to the curriculum leader about they expectations next year.

[dmj]

If you don't want to build it yourself there are a number of online IDE's , many of which provide educational discounts and will link into your Google/One drives and authentication systems.

https://codeanywhere.com/pricing

The Computing department may be able to get a budget for this.

[mavhc]

Firstly read them https://en.wikipedia.org/wiki/Computer_Misuse_Act_1990

 

Unauthorised acts with intent to impair operation of computer, etc. punishable by up to ten years in prison or a fine or both.

Making, supplying or obtaining articles for use in computer misuse offences

 

Point out it's pretty obvious who was logged into the computer. And point out that's another reason to make sure no one else accesses your account.

 

Onto technical issues: Python is pretty easy to set up. Although the new installers are annoying, MS decided to tell everyone MSIs were bad so they could sell more deployment software.

 

Security issues would be you actually need to have security now, can't just hide things in Explorer.

 

How is php and mysql going to be used? For webdev? So you'll need an http server as well. Option 1: install it all locally, Option 2: install it centrally, give everyone access to their own tables, web server folder. 2 means working with IT teachers defining exactly what they need.

 

Don't really need to run it as a service, just need to check the firewall to allow localhost connections.

 

First thing I'd do is get SSDs for all the computers, without that you're 10 years behind. 120GB £10, 240GB £16. You'd be crazy not to get them.

[timbo343]

@Nausing did you get anywhere with this?

 

To the group. We are in the same situation as the OP and i don't want to have python on the desktop machines. Having the VHD on the local machine would be the easiest option however if the machine needs to be re-imaged then it takes down the VHD with it. Maybe having the VHDs on a NAS or a file share would possibly be the next option however there is no budget for a NAS.

 

Running VMs on a HOST is out the question too as we don't have the resources or hardware to run 30+ VMs at a time for a lesson.

[jthompson]

We don't deploy our VM to all of the student PCs, just to the rooms where ICT is taught.

At the moment, to copy down the VM files to the local system, we have a script that we run manually after imaging those machines. That script also adjusts permissions on the vbox file to prevent end users from modifying it at all and places a shortcut in the Start menu to launch the VM.

 

Everything else is automated: the VirtualBox application itself is installed via GPO and all of the vboxmanage commands to lock the interface down for end users are in a user logon script.

[dhicks]

We are in the same situation as the OP and i don't want to have python on the desktop machines.

 

What are they going to be doing with Python - terminal-only output, maybe some web development? You could set up a Linux server for the pupils to log in to, autheticated against Active Directory so they can log in with their usual usernames and passwords. If you don't want to set up a server environment yourself, you could have a look at Python Anywhere, which provide (free) hosted accounts with a whole slew of Python libraries pre-installed and tested, ready for pople to start programming. They also provide easy-to-use Flask hosting for web-based projects.

[timbo343]

Hmmmm python anywhere might be an option especially when the basic version is free to use. Ive looked at the spec and it looks like they will need some form of database to lookup users (to authenticate to play the game), record scores, depending on how many guesses denotes the score.

[dhicks]

Ive looked at the spec and it looks like they will need some form of database to lookup users (to authenticate to play the game), record scores, depending on how many guesses denotes the score.

 

Do you mean: the pupils are required to write a terminal application (i.e. something that reads user input via a simple text prompt and writes output via "print" commands) that implements a simple guess-the-number (or similar) game? Python Anywhere (I think) supports MySQL databases for each user, but I would have them use SQLite - it's built-in to Python as one of the standard libraries, and data is stored in a simple file.

[mavhc]

And you're worried about python when you've left MS Office with macros enabled? Isn't the whole point of having accounts for students that aren't root is that they can only break their own stuff?

[supportman]

No issue running python nativlely here in our environment. We just have it installed on the CS machines on the C: drive. IDLE and Pycharms installed.

 

We do any pip installs manually when requested.

[jthompson]

You don't need any unusual privileges to bring a system to its knees with a while loop that endlessly spawns notepad.exe. That then usually means the computer will get turned off at the wall by someone. That's the sort of thing that led us to put python in a sandbox VM and take it off the host OS.

 

YMMV, but we had a lot of that here.

Edited October 9, 2019 by jthompson

[supportman]

You don't need any unusual privileges to bring a system to its knees with a while loop that endlessly spawns notepad.exe. That then usually means the computer will get turned off at the wall by someone. That's the sort of thing that led us to put python in a sandbox VM and take it off the host OS.

 

YMMV, but we had a lot of that here.

 

Can't you just look at the sign in logs and punish any student that does that?

 

As I say we've had this for 4 years+ now and any student doing that would be disciplined quite severely here. The teachers can all see the students screens with ABTutor in computer science lessons so its not like they are doing anything in secret.

[jthompson]

Can't you just look at the sign in logs and punish any student that does that?

 

As I say we've had this for 4 years+ now and any student doing that would be disciplined quite severely here. The teachers can all see the students screens in computer science lessons so its not like they are doing anything in secret.

 

Like I said, ymmv. For us, sandboxing python wiped out an entire class of pebkac (deliberate or otherwise) overnight.

[mavhc]

Like I said, ymmv. For us, sandboxing python wiped out an entire class of pebkac (deliberate or otherwise) overnight.

 

Can do exactly the same with Office macros though.

 

I could just turn the computer off at the wall anyway to do the same thing.

 

In general, don't bother doing it until you have problems not doing it.

[timbo343]

Do you mean: the pupils are required to write a terminal application (i.e. something that reads user input via a simple text prompt and writes output via "print" commands) that implements a simple guess-the-number (or similar) game? Python Anywhere (I think) supports MySQL databases for each user, but I would have them use SQLite - it's built-in to Python as one of the standard libraries, and data is stored in a simple file.

 

So one of the tasks is:

 

 

The game is played as follows:

 

• A random song name and artist are chosen.

 

• The artist and the fi rst letter of each word in the song title are displayed.

 

• The user has two chances to guess the name of the song.

 

• If the user guesses the answer correctly the fi rst time, they score 3 points. If the user guesses

the answer correctly the second time they score 1 point. The game repeats.

 

• The game ends when a player guesses the song name incorrectly the second time.

 

 

 

Design, develop, test and evaluate a system that:

 

1. Allows a player to enter their details, which are then authenticated to ensure that they are an

authorised player.

 

2. Stores a list of song names and artists in an external file.

 

3. Selects a song from the file, displaying the artist and the first letter of each word of the song title.

 

4. Allows the user up to two chances to guess the name of the song, stopping the game if they guess

a song incorrectly on the second chance.

 

5. If the guess is correct, add the points to the player’s score depending on the number of guesses.

 

6. Displays the number of points the player has when the game ends.

 

7. Stores the name of the player and their score in an external file.

 

8. Displays the score and player name of the top 5 winning scores from the external file.

[mavhc]

Can do all that in IDLE, just install python and won't need anything else. Unless it specifically says use a database. Username/password can just be stored in a list in the program, or file in csv.

[dhicks]

Can do all that in IDLE, just install python and won't need anything else. Unless it specifically says use a database. Username/password can just be stored in a list in the program, or file in csv.

 

I'd want to check with the ICT teacher and see what they had planned - the exercise given above certainly sounds like it's written with the idea that people write a terminal application, but the teacher might be using this as the basis for a GUI / web based application.

 

You can store data in plain files, or in CSV files that you parse yourself or via the CSV module, but again the ICT teacher might specifically want people to start using SQL queries.