Python - VM or direct install?

[matt_slatter]

We’ve been running a Zorin VM on Virtual Box for a few years now to allow access to Python however I want to re-evaluate how we make it available for the students. 

 

Pros

• No Network Access so no risk of DOS attacks against most infrastructure.
• Gives CS students experience of another OS.

Cons

• Large File Size.
• Performance Impact on Host PC.
• Saving files through the Shared Folder can be confusing for some students.
• Still allows students to cause mischief in their homedrives / AppData folders via the shared folder (thankfully not seen any evidence of this though).

 

If I install Python locally, it appears that there are no networking modules installed by default that would allow much mischief and I can block installing modules by blocking Pip.exe using AppLocker. As a backup I can also block any network activity at the Windows Client Firewall, whilst still allowing users to save files.

 

Am I missing anything or would this essentially be as secure as using the Virtual Machine?

 

I know that a user can’t do anything using a script they aren’t already allowed to do and I am confident my security settings are appropriate but a layered security model always seems worthwhile to me.

It would be great to know how you currently manage this or if you have any suggestions if I should ditch the VM or not. I know some schools use an online Python editor but I'd prefer not to due to Exams.

 

Thanks for any advice.

[dhicks]

2 hours ago, matt_slatter said:

It would be great to know how you currently manage this or if you have any suggestions if I should ditch the VM or not. I know some schools use an online Python editor but I'd prefer not to due to Exams.

 

I'm currently working on a hosted development environment, we're planning to have the Year 10s be using it after half term (so next week). This is a Linux (Debian) VM running a Docker setup, with each user having their own container they can log in to. Access is web-based via VNC or SSH remote desktop (via Apache Guacamole), with some additional web-based services available as well. The environment mounts a folder from their Google Drive, letting them see their Google Drive files from the command line / Linux desktop file browser if they want. A "www" folder for each user gets published as a website, complete with basic CGI support, hopefully providing a nice self-contained environment that pupils can safely tinker in.

 

So far, I've added Python, PHP and Go as development tools, plus Microsoft's VS Code for the desktop environment. So far the VM has managed with 4GB of RAM and a 128GB harddrive, we'll see what sort of resources we need with the Y10s over the next week or so.

 

This is hosted on-site, on a local server, so filtering is provided by our on-site Smoothwall appliance as with any other device on our network. The Docker environment should be self-contained, with no network access outside the container environment. This is all behind a Pangolin reverse proxy, authenticating against Google's OAuth (should work with other OAuth / cloud storage providers).

 

This is all open source (Apache license), so you can install it yourself - the install script is as all-in-one as I could get it, mainly extending from the Pangolin install script by adding more containers and connecting code:

 

https://github.com/dhicks6345789/per-user-web-server