LGfL - Cisco Anyconnect VPN (RAV3) - file transfer yes/no?

[Koldov]

Not sure where to post this, as it's a bit of everything (security/GDPR/cloud/Internet).

 

Just before lockdown I was told we would need a remote solution for anyone working from home etc.

 

I looked around for what I quickly set-up and realised we could use the RAV3 (now Cisco AnyConnect) VPN included in our LGfL package, with hopefully minimal effort and the least amount of configuring.

 

Unfortunately as I was trying to get to grips with it, the Head called a meeting and sent everyone home.

 

I managed to push out the software though and do the most basic configuration on the LGfL side to allow access and it worked for the one or two people I managed to run it through with before they all quickly disappeared (didn't need telling twice)...

 

Now the Head has come back saying that as we are getting teachers/bubbles being sent home and self-isolating that this needs to be up and running, as to do the work they need access to shared drive at school etc. I have reminded him that we have the free educational version of GSuite, but although a big advocate of Google in general doesn't seem to want to put everything there (which I do understand)...

 

The basic set-up is done, but I have concerns about the way this works (as in a full on VPN) essentially opening the school network to the world (albeit via a teacher's laptop - because security isn't really on their radar). We all know that this could go badly wrong and I'd like to mitigate as much as possible without being seen as the maniacal sysadmin who won't let anyone have even the wi-fi password (I know, I know)...

 

There is an option to disallow file transfers, but denying this would mean that if they create a file on their laptop at home, then they can't move or save that to the shared drive at school (?) - so I can only presume this means that although the safest option, it might be a deal-breaker, but this should still allow them to open an existing file, work on it and then save it back.

 

I'm also concerned that they may well work out they can access the printers (we do not use follow me or anything - so I might just run a scheduled task to kill the spool and enable it in the morning) and things like SIMS from home and all the hassle that might bring...

 

Can anyone share their experience? What they allow and their justification for not allowing things.

Edited October 23, 2020 by Koldov

[Guest Guest]

We're soon going to rolling out a VPN to our school owned devices for the same reason. However, we won't be allowing personal devices onto the VPN.

 

We have remote desktop available externally via Remote desktop gateway for staff using their own devices

[mavhc]

If you're using a vpn and it's blocking shared drives, what's the point of the vpn at all?

 

As long as it's only from laptop you have admin rights to, should be fine. Rest is just policy, that's the Head's problem, point out they need to send a message: don't let anyone else use your laptop, or you'll be fired. Don't copy files off your laptop. Don't leave your computer unlocked, don't use it in public.

 

Do the laptops have TPM? Bitlocker?

[DavR]

I think you just have to be sure the Headteacher is aware that what they're asking for carries a risk, and secure it best you can. What more can you do.

 

I had to throw a VPN together at short notice for the first lockdown, and I made it very clear that it was to be for Admin and SLT only. The support overhead of trying to talk every member of staff through installing the client and accessing the shares would have been too much, so the majority worked via G Suite.

 

Using the LGfL RAv3 system, I restricted the staff VPN group to only having access to our two fileservers, and nothing else. I did this by only allowing those groups access the necessary two IP addresses in the range. I would have liked to have set up two factor authentication too, you can set each user up with a SoftOTP app on their phones, but sadly there just wasn't time, and again, the support overhead.

 

The ideal for me would have been to set up an RDP server, the new(ish) Freedom 2 Roam service provides a pretty decent web-based front end for an RDP server. Time and licensing costs put pay to that though. Our ultimate goal is to move to Office 365, so it's not the right time to invest in RDP.

 

SIMS can be run over VPN, I have seen it done in the past.... as I recall you just need to either make sure you can either resolve the SIMS server name from a remote client, or use the IP address. There are options to set up DNS so the remote client resolves against the school servers, but I could never get those to do what I wanted.

[DavR]

As an aside, we didn't have enough laptops to hand a school laptop to everyone, so we did permit access from personal devices. Thinking back, we probably should have given security advice (never leave unattended, make sure password protected, etc) but it was all done in such a rush. And let's face it, who would have listened.

 

Where we did provide laptops, these were always password and Bitlocker protected.

[mavhc]

No one listens to advice or follows policies, they just exist so you can blame people when it goes wrong, "well, we told you to do it"

[PaddyNewman]

Hello,

 

If you need a hand, happy for you to give me on a call on the normal support line, I start around 9am.

 

We can block SMB using your machines firewall or I can knock something up on your school firewall quite possibly.

 

Let me know! If you do come through to support, just tell them I asked you to call.

 

Paddy

[Face-Man]

If there are computers left on in school you could use freedom 2 roam to do a RDP session onto that set of computers then then you don't need to worry (as much) about any nasty stuff on the local teachers computers

[PaddyNewman]

As @Face-Man points out, you can do that, it would save you requiring a VPN every time you wanted to do something. You can enable/disable file transfers per bookmark too which helps with moving files and means they don't have to run SIMS from home, just from their school based machine.

 

If you had an RDGateway, we can sort that for you also.

 

If you need anything configured or advise, don't hesitate to give us a buzz