Students bringing in own laptops

[Rod_Mustard]

Just wondering what the policy is with you guys with 6th formers bringing in their own laptops?

 

personally, i think we shouldn't allow it (since there is no real way to prevent them from plugging their laptop into a normal outlet and being able to access the network). i know we could have separate access points for them on a separate vlan, but i don't think that really solves the security issue.

[simpsonj]

It is, however, the way things are headed at present. I have year 10 and 11 kids bringing in their own laptops, but thankfully not connecting to the network as yet.

 

We're planning on implementing a managed wireless solution, so that kids can connect to our (censored) internet without touching the main network at all. However, this is some ways off.

 

In the mean time, a whitelist of MAC addresses might be a way dealing with the issue, as long as kids don't get smart enough to spoof a MAC address...

 

Still leads to a potential problems down the line if students start asking for technical help, or even worse, schools start to lend laptops out to its students which you then have to build/fix/purchase.

[FN-GM]

Just wondering what the policy is with you guys with 6th formers bringing in their own laptops?

 

personally, i think we shouldn't allow it (since there is no real way to prevent them from plugging their laptop into a normal outlet and being able to access the network). i know we could have separate access points for them on a separate vlan, but i don't think that really solves the security issue.

 

You could set your switches to only allow trusted mac addresses. Also setup your firewall to only allow connections from your proxy. If you have setup permissions on folders there wont be anything they can do really.

[dhicks]

since there is no real way to prevent them from plugging their laptop into a normal outlet and being able to access the network

 

Is that the facility that RADIUS provides - stops people connecting random devices to your network? MAC addresses can be spoofed (just plug in a home broadband router, most of them will alow you to set the MAC address and/or copy another machine's MAC address) and you can create havoc (and examine network data) by setting the IP address of a machine to the same as that used by your gateway.

 

--

David Hicks

[Rod_Mustard]

You could set your switches to only allow trusted mac addresses. Also setup your firewall to only allow connections from your proxy. If you have setup permissions on folders there wont be anything they can do really.

 

We're quite a big school - over 1000 workstations and laptops - i think adding all those mac addresses to our switches would be unmanageable and indeed futile. as has been mentioned, it's easy to fake the mac address anyway, and even if i went down the route of a vlan and giving the pupils a separate 'untrusted' outlet and access point for their wireless there is nothing to stop them from unplugging one of our machines and launching a denial of service attack on one of our windows servers (for instance) from a 'trusted' network socket.

 

it's a difficult one, i say ban all outside laptops, but as you know, it's quite difficult to convince the upper echelons.

[Theblacksheep]

ait's easy to fake the mac address anyway, and even if i went down the route of a vlan and giving the pupils a separate 'untrusted' outlet and access point for their wireless there is nothing to stop them from unplugging one of our machines and launching a denial of service attack on one of our windows servers (for instance) from a 'trusted' network socket.

 

Doesnt a radius server prevent this?

 

i.e. unplugging your 'trusted' computer and plugging in an unknown/student laptop to a 'trusted' port would make the port automatically 'untrusted'?

[enjay]

We have a very clear - SLT-approved - policy preventing anyone attaching their own equipment to our network. No ifs, no buts, no exceptions (we have even pulled an SLT member up on it when they forgot about it). The risk posed by unmanaged laptops which could (probably don't, but could) contain any number of viruses, hacking tools, packet tracers etc is simply unacceptable.

 

Our Sixth Formers have a wireless point in their building which permits them Internet access and nothing more, they then use our remote access to connect back in for any files they need (that is MAC controlled, so only known laptops connect to it).

[russdev]

As said main thing if what ever we think we are all going to go that way.

 

So we need to look at options and get commitment from slt to spend money to invest in it.

 

So in terms think best option is vlaned wireless network for students with some kind of security layer that disables access unless it passes certain tests.

 

But like most things this costs money.

 

Russ

[AngryTechnician]

We already do this. Our entire network - wireless AND wired - is completely VLANed using 802.1x to authenticate. Domain workstations authenticate via EAP-TLS using their domain certificate that they receive through AD, and student's own machines authenticate via PEAP using their normal network username and password. The very few devices that don't support 802.1x (network printers, mostly) have 'tagged' network ports assigned to a particular VLAN that only allow access from a single MAC address, and connect to a restricted VLAN.

 

Which VLAN anything else connects to depends on what group they are joined to in the AD. All students connect to our 'Guest' VLAN which is heavily restricted.

 

We first implemented this 2 years ago, and there was some pain at first - XP SP2's implementation of 802.1x on wired connections was a bit hit and miss. Since Microsoft backported the Vista implementation in SP3, it's been much better. We haven't looked much at NAP yet, but it's certainly an option now we have everything else set up.

[Geoff]

We implement Network Access Control via Packetfence. It controls access and monitors machines connecting to our network. Providing the user operating the foreign machine can provide valid login credentials and the machine passes our policy checks (patched up to date, running AV, firewall, not a games console) it gets let on the net (DNS and HTTP/HTTPS only).

 

PacketFence: Home

[gibboap]

will read thru this all in a sec but would their laptops all not have to be PAT tested (well the power supply). which would give me the argument not to allow it as to be honest i hate PAT testing and cba test X amount of students equip when the establishment offers X amount of ICT equip

[cookie_monster]

@ Geoff - what ingrastructure do you use along with the Packetfence do you need to have a VLAN in place to put the notebook into untill it is approved?

[russdev]

will read thru this all in a sec but would their laptops all not have to be PAT tested (well the power supply). which would give me the argument not to allow it as to be honest i hate PAT testing and cba test X amount of students equip when the establishment offers X amount of ICT equip

 

No as long as students sign to say that they are liable etc aka you are acting like a wireless hotspot in a pub and they do not need to be pat tested.

 

I might get shot down for this but maybe we should be looking at how we can do it overcome any issues and not excuses not to do it.

 

Russ

[Rod_Mustard]

We already do this. Our entire network - wireless AND wired - is completely VLANed using 802.1x to authenticate. Domain workstations authenticate via EAP-TLS using their domain certificate that they receive through AD, and student's own machines authenticate via PEAP using their normal network username and password. The very few devices that don't support 802.1x (network printers, mostly) have 'tagged' network ports assigned to a particular VLAN that only allow access from a single MAC address, and connect to a restricted VLAN.

 

Which VLAN anything else connects to depends on what group they are joined to in the AD. All students connect to our 'Guest' VLAN which is heavily restricted.

 

We first implemented this 2 years ago, and there was some pain at first - XP SP2's implementation of 802.1x on wired connections was a bit hit and miss. Since Microsoft backported the Vista implementation in SP3, it's been much better. We haven't looked much at NAP yet, but it's certainly an option now we have everything else set up.

 

this seems like a good way forward- how difficult was this to implement?

[Geoff]

@ Geoff - what infrastructure do you use along with the Packetfence do you need to have a VLAN in place to put the notebook into untill it is approved?

 

You can do it one of three ways:

 

1) via DHCP, which requires Packetfence to operate as your DHCP server.

2) via ARP poisoning, which requires nothing special

3) via VLANs, which requires managed switches.

 

I use #2.

[keithu]

Geoff - what do you use for compliance checking (patchlevel, AV etc) with packetfence?

[srochford]

As said main thing if what ever we think we are all going to go that way.

 

So we need to look at options and get commitment from slt to spend money to invest in it.

 

But like most things this costs money.

 

Agreed.

 

I'm old enough to remember the days when everyone was dead set against the idea of people bringing their own calculators into school; no-one could see value in them, they were just a waste of time, money etc etc. Not sure that anyone takes that view any longer.

 

Users will need to use their own equipment in school. It will be difficult to do and it will cost money (but maybe not much) and I think anyone whose attitude is just a blanket "no" is going the wrong way.

 

As others have said, 802.1x will make it possible to trace who is connecting to your network and where. Windows Server Network Access Protection makes it possible to control which machines get access to what on the network.

[ssiruuk2]

I have port security enabled on our Cisco switches for nearly all network outlets.. so they can try and patch in an unauthorised laptop but the switch port will shut down.

 

On the wireless side creating a seperate vlan & ssid for untrusted machines will solve any security issues you have as you can (providing you have the switches to do it) just setup some ACLS permitting exactly what traffic is allowed to flow from the untrust vlan to the network.

 

I just allow:

 

dhcp, dns and tcp port 8080 ONLY going to the proxies ip address - everything else is dropped / denied.

[amfony]

Geoff - what do you use for compliance checking (patchlevel, AV etc) with packetfence?

 

 

I too am interested on this answer. PacketFence works well with Nessus, but that requires credentials to interogate the foreign system i believe.

 

Ive just had this same discussion but i could not find a solution that could provide compliance checking without some requirement for credntials (and rightly so).

[p858snake]

For people that are worried about viruses and such could you try something like Cisco CleanAgent (sorry i've never looked into it, so i can't think of other names, costs ect and just going by what i've read on forums and such) in which each laptop has a client installed and when you start up and want network access it checks against the server to see if you meet the requirements (eg: antivirus packages up to date, os patches ect installed) that you have set up as the rules and if you don't it won't let you access the net.

[enjay]

As others have said, 802.1x will make it possible to trace who is connecting to your network and where. Windows Server Network Access Protection makes it possible to control which machines get access to what on the network.

 

And what product would you recommend to ensure they're not launching DoS attacks and such like from their laptops?

 

Here's a thought, albeit an unlikely one - where would the school stand if students hacked MI5 or wherever from a personally-owned PC over the school-provided Internet connection?

 

As an aside, I trust all those of you who are allowing this are PAT testing the laptops first...

[AngryTechnician]

And what product would you recommend to ensure they're not launching DoS attacks and such like from their laptops?

 

I recommend the Mk.5 Headteacher product from NAHT Systems to instil discipline and suspend pupils who abuse their access privileges.

 

Sarcasm, moi? Perhaps, but not everything is best solved with technology. Sometimes explaining the rules and sanctions, and following through on them, is all you need. We have never had a problem with this and we have more than 200 students machines permitted to connect to our network. It probably helps that our student VLAN allows traffic on only a very select few ports and to very few servers. About all they could attack would be the proxy server and intranet web server on their HTTP ports, which would be tracked back to their computers extremely quickly.

 

On a serious note I would also be interested in what IDS systems people would recommend, specifically for detecting DoS, since I understand that is an area of a weakness with Snort.

[Geoff]

Geoff - what do you use for compliance checking (patchlevel, AV etc) with packetfence?

 

The first thing a correctly patched and functioning machine will attempt to do is check in with Windows Update/WSUS and it's AV vendors update website. You can catch this traffic with snort rules.

 

Additionally one can attempt obvious well known exploits with Nessus.

 

Finally if the machine is infected with something nasty, snort will likely see it trying to do whatever it does via it's standard rules.

 

Failing all of that, make sure your port security is set so the machine cannot communicate with other machines on the VLAN (much like you would do on a WiFi LAN) that way you can at least prevent an infection spreading (As the machine would only be able to talk to the default gateway, the proxy and the dns/dhcp servers, all of which you control and have kept patched!).

 

And what product would you recommend to ensure they're not launching DoS attacks and such like from their laptops?

 

Assuming you enable the rules in snort, packetfence will boot people off for doing stupidity like this.

[Theblacksheep]

Geoff,

 

Do you use packetfence-zen or std?

 

How does the supported switch element work? We only have HP switches, our router is an unsupported xl, and a 5400 is connected to the Vi3 hosts I would put the zen box on. Would it need to be a physical box plugged into a supported switch? (we have 2500s and 2600s scattered around the school).. we currently have manually vlans set up around the school all going back to the hp-xl.

[Geoff]

Standard.

 

I don't use the VLAN method as I'm in the same boat as you. I have some crummy old 3com swtiches that aren't supported.