Student Laptop Internet Access

[karldenton]

Hi,

We are looking at the idea in September of having a wifi hopsport area for the pupils.

Our proxy server is at the ISP (Redstone) and we don't have ISA.

At present I monitor pupils activity by running a logoff script that copies the history into a html file on the server - but this is on machines that are on the domain.

Is there a way to monitor there laptops when using the internet when they are on the domain. As they need to know Redstone's proxy, they will still get filtered internet access.

[plexer]

So you allow a students personal machine over which you have no control and no way of knowing if it has av, if it does have av if it's up to date, if windows is patched up to date and no idea what other spy ware or nastys may be installed to be plugged into your network or connected via wireless just so they can surf the net?

 

Ben

[FN-GM]

So you allow a students personal machine over which you have no control and no way of knowing if it has av, if it does have av if it's up to date, if windows is patched up to date and no idea what other spy ware or nastys may be installed to be plugged into your network or connected via wireless just so they can surf the net?

 

Ben

 

We do....

 

But they are on another VLAN and have no communication with the main network at all.

[ricki]

Hi

 

You are a very brave techie thinking of this. I have seen it done in a few places including colleges but it will need careful planning. They have had it on a demilitarized vlan with a transparent proxy server that will monitor activity. You will need all sorts of disclaimers to protect you establishment otherwise if someones machine gets infected or broken into you could be held responsible.

 

"Perfect planning makes perfect presentation" and "Watch the minefield" come to mind as phrases when I think about this.

 

Richard

[plexer]

We do....

 

But they are on another VLAN and have no communication with the main network at all.

 

Exactly. NAC is the way to go a as well I think.

 

Ben

[mac_shinobi]

Just as a free work around you can use Internet Junk Buster

 

The Internet Junkbuster Proxy on Windows

 

works on windows and linux and you can specify *.* to block all the internet and on the exceptions list only add websites which you want to give them access to including local intranet sites if any or you could just give them access and block sites as you need to and get AB Tutor ( pretty good pricing and monitor them that way )

[NikChillin]

We have a DMZ server and tow separate wirless networks to connect to, on is on the domain and the other is open access. We set the encryption on laptops for connecting to the domain so nobody knows the passphrase. There is no passphrase to the open access wireless and filtering is from County. (Primary level). Mac address filtering is set up on the server using Radius and all ports throughout the site is buttoned down by strict mac filtering too on the switches. The wireless access points we use are 3com and enable access with a, b and g connections.

All seems to work well.... I shouldn't have said that!