Student laptop connection to network

[RoyG]

Out of interest, what policy does your school have about kids hooking their own laptops into the school network?

 

And what about PSPs for Internet access in school?

 

RoyG

[alan-d]

we don't allow it at all. We have enough IT for them to use. Besides who is going to carry out PAT tests on every kids laptop?

[Joedetic]

As far as PSP goes the rules are NO games in school. I know a few kids use their PSP for transporting files...genuinely! so they have USB cables and do it that way.

 

Wifi to laptops has always been a tricky situation. When we got our new elearning centre a 2-3 years ago, there were about 2 students in upper sixth and myself in lower sixth that wanted laptops on the network.

 

The head of ICT put the wep key in and mapped some shared drives to our user areas etc. That was it along with proxy settings.

 

When it came to put my laptop on we were satisfied with the AV software. Norton 2004 Pro...fully up to date. It went on the network and within about a week of it being there 2 viruses origionating from my laptop were found on the network.

 

From then on the main rule has been that if you've got XP pro then we'll put it on with our own licensed AV software. (SOPHOS)

 

If it's a student loan laptop then it's already a member of the domain...go ahead.

 

Anything else then no.

 

But....certain other members of staff worked out what the wep keys and proxy settings were and added the settings to the students laptops and more people have been using t'internet. Very bad practice, but...that was the year that didnt have the opertunity to loan a laptop with all the software that was a member of the domain.

 

So hopefully we should be OK in future.

[Sylv3r]

Students can not use their own personal laptops on the network and will never be allowed to.

 

Although I am starting a student loan scheme for 6th form students in September, all of these laptops will be added to the network in their own VLAN with an ISA server and a censornet box for filtering.

[tosca925]

We dont let any student/member of staff use their own laptops on our network.

 

All our teachers and LSA's and various supprt staff have laptops so we dont get asked very often.

[tosca925]

We had a sixth former try it once, told all the staff he could log on the network and see allour wireless stuff. Teacher paniced and called us straight away.

 

All he could do was see the names of our wireles access points, and they are all set as bridges any how and mac lock downed.

[pmassingham]

No connection allowed by students. APs locked down with MAC filtering and WEP. Teachers can log on provided they sign the laptop agreement and we then add the MAC address to the filter and install the WEP key on their machines.

[Geoff]

MAC and WEP really don't work. Use 802.1x and WPA.

[sahmeepee]

MAC and WEP really don't work. Use 802.1x and WPA.

 

Agree completely. There's a wiki entry with one possible secure authentication method. If one of the smart cookies using PEAP in a completely vanilla Windows 2003 network could post their method in there too, I'm sure that would save a load of people time (not just me!)

[broc]

I have just been told that we may be getting 80 (approx) laptops to be given to students for home use under a 'laptops for students' pilot program. The inevitable question will arise, can they be connected to the school network too?

 

While all of my 'technical' instincts tell me this is a very very bad idea, I have a sinking feeling that we may have to accomodate this as it is undoubtedly a very good idea in extending the availability of ICT in our local community.

 

Does anyone do this successfully, maintaining a secure & stable environment with laptops used both in the 'wild' and attached to school networks?

 

Thanks

[Joedetic]

Dual boot them. Have one partition running the XP Home that comes with the laptop for use at home...and have the other partition running your volume licensed copy of XP Pro that you'd use for your on-site machines etc.

 

That way it's /sort/ of kept separate and you can have them hooked up to the network. There's not much point in offereing laptops for students if they cant use them onsite too when they cant get onto a workstation in the library etc IMHO.

[GrumbleDook]

oooh... ooohh ... me isr, me sir ....

 

Drop me a PM and we'll have a chat, or register a request via the ICT Register

[Geoff]

I have just been told that we may be getting 80 (approx) laptops to be given to students for home use under a 'laptops for students' pilot program.

 

Not withstanding the other reasons why this isn't a good idea. My favorite is when the kids get mugged on the way between home and school for their laptops.

[wesleyw]

I have to agree with Geoff but I would use WPA2 instead if at all possible it's been tweeked slightly to make it more secure. WEP is not a very good protection method even when locking down to MAC addresses (You can get MAC address spoofers).

 

I'm setting up wireless this term so I'll be inundated with pupils asking if their laptop is allowed on the network. I think if they are they have to agree to have their laptop modified by us AntiVirus et cetera and if and virus is caught eminating from their laptop then they will not be allowed to use the network again either that term or at all depending on the severity.

 

Any thoughts on this as a suggestion?

 

Wes

[GrumbleDook]

If you are allowing external laptops onto yur WLAN then you have a few options ...

 

The best seems to be to get a few VLANs going ... have a wireless access controller and 2 SSIDs (a published on and a hidden one). The hidden one is used by staff and school configured laptops .. the published one anyone can join but gets filtered into a DMZ ... or through a filtered box ...

 

Bluesocket and Vernier spring to mind.

 

Speak to you local Uni to see how they do things in halls of residence ...

[Joedetic]

I know that at staffordshire uni (where i've just started my BEng in Network engineering) they dont have WLAN acces in the hall of residence. The way the network access is done is by MAC filtering. You have to list your room number, student ID and mac addy of the one piece of equipment you're allowed to connect. And you're not allowed (/meant) to connect routers

 

Anyway, that's beside the point. What they do do with regards to WiFi is it's open and unsecured as far as the literature says, but the SSID isnt published.

 

http://www.staffs.ac.uk/airnet/ might give you some ideas as to how they manage the WLAN.

 

But this is purely for access to your homedrive (map it on the network) and internet...so it's not for domain logons (as far as i've seen) i KNOW there's another wifi network around the buildings but it's unsecured and it's got a published SSID. I'm assuming /that/s the one with the MAC filtering on it.

 

Anyway...

[Geoff]

Fun, I could probably crack that in 5mins. Hiding your SSID and using MAC filtering doesn't work people!

[Joedetic]

I've just had a more careful read and there's CA certs and stuff that you've got to do once you've opened your browser

 

Typical student...scanning the stuff and taking little or none of it in!

[kingswood]

Fun, I could probably crack that in 5mins. Hiding your SSID and using MAC filtering doesn't work people!

 

I had this conversation with someone in the past week..they thought that hiding the SSID helped. It doesn't. In fact Windows can be real funny if you hide the SSID.

 

[Roberto]

I have just been told that we may be getting 80 (approx) laptops to be given to students for home use under a 'laptops for students' pilot program. The inevitable question will arise, can they be connected to the school network too?

 

Let's clarify one thing.

You say "given to".

Does that mean that they will be the owners of these laptops?

Or do you mean they'll be the property of the school / LEA / whatever and will be issued to students?

 

If the latter, then just make them normal clients on your network, with whatever minimal compromises might be needed in order to allow users to work locally off the network. No need to make them admins, no need to set up dual boot or any other complex scenarios, no problem at all.

[Ric_]

We have 30 laptops on a trolly... I would suggest you decide whether your current staffing level.

 

I have a Bluesocket wireless network which will give all the functionality that this sort of set up needs out of the box but it isn't cheap. You should also decide what they will need access to on the network - if it's simply Internet access you can route them all to your proxy and nothing else. If they need complete network access you need to secure them like a normal machine, etc.

[plexer]

Looking at the Staffs page the cert you accept would only seem to be for their http portal.

 

Ben

[Joedetic]

The way the paper booklet i was given is worded, it would appear that you've got to go onto the webpage before you can use it...

 

 

I'm going to take my laptop to the library this evening and see what's what.

[jonbones]

We haved set up a separate Vlan to County broadband connection and installed a WAP in sixth form area. Students have to provide Mac address of wireless connection (mac filtering enabled) on their laptop in return they get wep key and guide on changing proxy settings to get internet via sixth form WAP. As this is on separate VLan no 'network' acess is possible. Taken very little effort to set up and at moent keeping all parties happy.

[Geoff]

MAC filtering and WEP really isn't sufficent these days. I think cleint certificate based WPA would be a better solution for that situation.