Veyon - key file?

[gerardsweeney]

Hello, all..

 

I'm looking at installing Veyon in our classrooms.

My needs are simple - pupil PCs will only accept a connection request from Teacher PCs (Masters) with a relevant key installed.

This is to get round the possibility of some scamp installing it on their own laptop, hooking it up to an existing ethernet cable and being able to monitor other PCs.

Yes I know it's unlikely, but it needs addressing.

 

 

I tried configuring that way, but I was either in the situation where any PC could monitor or NO PC could monitor

 

Does anyone have any experience of setting this up?

 

Cheers,

Gerard

[Steve21]

I mean that's the standard of two options it provides. It's either using a key file, or authing users against AD etc, both stop the issue you mentioned

 

More details here:

 

https://docs.veyon.io/en/latest/admin/configuration.html#authentication

 

Not really sure what you are asking

 

Steve

[gerardsweeney]

Hi..

 

OK - a bit more detail.

The AD authentication doesn't support nested groups - other people on their forum have said the same thing.

So for example, my Maths teachers are in a group called School1_MathsTeachers, which is a member of AllSchools_MathsTeachers, which is a member of AllSchool_Teachers (not real AD names, but you get the idea).

 

If I add AllSchools_MathsTeachers, the AD test fails - user doesn't have access.

If I add AllSchools_Teachers, the AD test fails - user doesn't have access.

If I add School1_MathsTeachers, the AD test works.

So I have 50 schools. I'd need to add every department in every school. We get a new department, I need to redo it. That's not happening.

The AD authentication doesn't bother me too much - I'll use NTFS to block access to the exe on the teacher PC.

 

For the key access, I tried the following:

 

Test PC1 - install out the box. Create key. Export public and private key. Export settings.

Test PC2 - install out the box. No settings changed/created, beyond adding the name of PupilPC1 (see below)

Pupil PC1 - Install with settings file specified. Import public and private key via veyo-cli

 

When I ran Veyo Master on Test PC1 (which had the key) and PC2 (which didn't have any keys at all), I could view PupilPC1.

I ran out of time for more testing, so posted on their forum and here in case someone who used it could tell me that I'd missed something really obvious.

[jmcdermott]

We use it.

 

1) store keys on a hidden share on the master computer.

2) use GPO to set the key location per room.

3) we still create the machine list manually.

4) as an extra we have also used the gpo to disable client machines from running the veyon master application.

 

Job done.

[gerardsweeney]

We use it.

 

1) store keys on a hidden share on the master computer.

2) use GPO to set the key location per room.

3) we still create the machine list manually.

4) as an extra we have also used the gpo to disable client machines from running the veyon master application.

 

Job done.

 

Hi - thanks for the reply.

 

Is there an ADMX file for this software available?

I found mention of one on https://getadmx.com/?Category=Veyon but couldn't find the file itself.

 

You say you have the key stored on a share on the teacher (master) PC...

I have 20 pupil PCs and 1 teacher PC per room - which will exceed the share connection limit for workstation OS.

Or am I picking you up incorrectly?

 

So - basically - what I did SHOULD have worked? (Key exported from a PC, import to client, import to teacher PC).

It's just you have the key on a share to avoid having to import it on all of the clients?

Is it JUST the private key that I need? I think I might have imported both.

 

Also - when you created the key, which security group did you make it available to in the GUI?

The AD part of Veyon doesn't appear to properly understand nested groups, so I'm hoping you're going to say a built-in group

 

Thanks,

Gerard

Edited June 9, 2020 by gerardsweeney

[computer_expert]

This is to get round the possibility of some scamp installing it on their own laptop, hooking it up to an existing ethernet cable and being able to monitor other PCs.

 

Providing you have managed switches (that support 802.1x) everywhere, you should look at enabling 802.1x with certificate based authentication as that will stop people from connecting their own machines and gaining access to your internal network.

[jmcdermott]

If you want to pop me your email in a PM I can send you a copy of the admx.

[gerardsweeney]

I'm just a desktop bod.

Switch management and the like is way above my pay grade

[gerardsweeney]

Huh...

 

As the song goes - I ripped it all up and started again - and it only bally well works (that bit isn't in the song). Hurrah!

I'll use a script to modify the perms on the installed keyfile so that pupils don't have read access to the key file - preventing them from being able to run Master on a Teacher PC.

 

Huzzah!

 

Quick question - is there a way to force the pupil to click "Allow" before connection attempts are allowed in?

I can only see an option to notify them when someone is connected.

[jmcdermott]

Not as far as I am aware.

[gerardsweeney]

Thanks - at least I wasn't overlooking something REALLY obvious

 

The next challenge - working out how to detect that I've imported the workstation files.

I'll be deploying this with SCCM, so the plan is to have it install the software and key as a job and then import the relevant Location/PC list as another.

That'll let me have different master PCs able to talk to different classes.

EG - ICT01 Teacher PC only gets ICT01 class PCs, but the PCs in the ICT Base could have ICT01, 02, 03 etc.. Something like that.

 

I was hoping that the imported PCs would be in something human readable like the registry, or a file so that I can roll it out as an Application.

However, it looks like it manipulates the registry with it all encrypted...

 

Looks like I'll need to pockle something together in AutoIT to import the file, then scrape the output of "veyon-cli.exe networkobjects list" to verify that all of the PCs in the input list are in the active list.

Hopefully not a huge task.