Accessing work from home.

[eejit]

Who has set up a system to allow pupils to access their work from home? I've recently followed a set of instructions on the uk.education.schools-it newsgroup about setting up a website with IIS to share webfolders. That does work, but I'm not sure about the security implications so I haven't set it up for the pupils yet.

 

Also, is there a way to save to those webfolders from home? It appears that you can just view them and then right-click and choose "save as" to work on them locally.

 

What are you guys doing? I know some boroughs are hosting VLEs, but ours doesn't

[MkII]

We have an email server in school directly accessible from the web [County have set up a reverse proxy to achieve this]. We're just about to have a production install [we were beta testing it] with a personal file area. We won't have shared file areas yet tho'.

I also intend instaling Moodle on the box which also has the facility for file uploads.

[russdev]

basicly we have got rm easynet which is what rm charge for there custom version of the methord in first post.

 

We have not rolled it out to anybody as of yet having the ability for about a year as not really happy about it and security aspect working on a solution i.e adding logging etc so we can roll out to staff in september.

 

Russ

[Geoff]

We're in the early stages of sorting this out. At the moment the LEA is trialing VPN access. I can use the VPN to get into the school servers and do work on them. Its a bit too technical for the kids/teachers though.

 

One solution that some other schools in the trials have used is to use a terminal server over the VPN. This seems to work a lot better than just basic VPN access.

 

We are also looking at hosting our VLE (Moodle) internally and using reverse proxying to get external access. If this works out ok I expect we'll be doing the same for personal files (using WebDAV) and email (Squirrelmail).

[eejit]

Yes, the big problem is that any solution has to be simple to use from home. If there's any setting up of connections etc., it's only going to end in tears. Parents who have crappy computers will blame the fact that "Alien Killer 8" no longer works on our instructions on how to connect to the school network. "It all worked fine until then" etc., etc.

[russdev]

The support issue is one of the reasons why we are very doubious on offering to kids also if they have home access can bypass our filtering and upload mp3,exe's etc...

 

I am going to give staff ability in september and see from there.

 

 

Russ

[browolf]

i had an idea about doing that but we havent got around to trying it yet.

basically a webpage that writes instructions into a folder on the website and an application on our network that watches the folder for instructions and uploads/downloads files accordingy.

You could allow people to download/upload files without them having direct access to their user area and keeping authentication. it wouldnt be very fast i expect but thats not necessarily a bad thing.

[MkII]

The support issue is one of the reasons why we are very doubious on offering to kids also if they have home access can bypass our filtering and upload mp3,exe's etc...

That's a very good point some sort of filtering would be neccessary - maybe a holding folder - and manually letting files through would be a pain.

[Geoff]

If your using reverse proxying with squid you can run everything through Dansguardian and scrub out the nasties just as you would a standard proxy server.

[Ric_]

I hope to use Citrix to give users access to their desktop from outside the School. The user will be able to access a web page and, following authentication, have access as though they are sat in the School - in theory they could just have a Wyse terminal dangling off a 56K dialup connection.

 

This would be expensive if the Citrix licenses were not already purchased but, since the licenses will already be in place, we will just be making our investment work harder

[tarquel]

The support issue is one of the reasons why we are very doubious on offering to kids also if they have home access can bypass our filtering and upload mp3,exe's etc...

That's a very good point some sort of filtering would be neccessary - maybe a holding folder - and manually letting files through would be a pain.

 

I believe theres a way of filtering what you can upload with one of those [browse] buttons and with php etc, tho dont ask me what it is ...yet lol

 

You could always have a filtering batch script on your file server to remove mp3, exe's, etc. each night lol

 

Anyone know what open source stuff/commercial stuff is best? Suggestions?

 

@mark: wonder whether we'd be able to do it with powys lol

 

Regards,

N.

[eejit]

If your using reverse proxying with squid you can run everything through Dansguardian and scrub out the nasties just as you would a standard proxy server.

 

I don't understand this. I've used Squid and Dansguardian in the past but don't know how you could use it to allow access to folders. Can you point me at some tutorials for this please.

Cheers.

[Dos_Box]

We are currently working on the MyLGfL system, which will basically tie in e-mail, calendars, RSS feeds and a host of other functions including on-line storage (we are currently costing a 12 TB SAN, but only sticking in 1TB this year to see what our actual demands are). For a high school there maybe up to 250MB per pupil available. It will be safe, secure and local admins will have full control over e-mail and storage areas via the service. We did have a demo site, but I can't find the link

[tarquel]

We are currently working on the MyLGfL system, which will basically tie in e-mail, calendars, RSS feeds and a host of other functions including on-line storage (we are currently costing a 12 TB SAN...

 

Is there something similar with Exchange 2k3? Obviously (to anyone thats used Outlook 2003), it has the email & calander side of things - and a whole lot more I believe - but can it be setup for this sort of thing?

 

If the pupils can log onto their email from home, if there is a feature or add-on to it to allow this, that would be awesome (if it works hehe)

 

Regards,

N.

[Geoff]

If your using reverse proxying with squid you can run everything through Dansguardian and scrub out the nasties just as you would a standard proxy server.

 

I don't understand this. I've used Squid and Dansguardian in the past but don't know how you could use it to allow access to folders. Can you point me at some tutorials for this please.

Cheers.

 

Its quite simple. You run squid as a transparent proxy and turn the http_access rules on their head. Basically you allow access to the proxy from anywhere (ie, the internet) but only allow connections back to your internal webserver. This is quite the reverse of a normal squid setup.

 

The internal webserver (presumably IIS or Apache) would use WebDAV to give full read write access to the folders you setup.

 

Once you've got that working you can slot in dansguardian and another instance of squid and you have full content filtering (using mime types) and virusscanning (there's an addon for that).

[Geoff]

Oh yes, in the squid config I forgot to mention you'll also need to configure 'visible_hostname' and the httpd_accel_* rules.

[MkII]

I believe theres a way of filtering what you can upload with one of those [browse] buttons and with php etc, tho dont ask me what it is ...yet lol

 

You could always have a filtering batch script on your file server to remove mp3, exe's, etc. each night lol

As with email attachments tho' couldn't you just re-name any file to a .txt extension for example. Most kids wouldn't be a problem but a few would know immediately and you know how that stuff spreads :?

[Geoff]

Use content filtering rather than relying on mime types then.

[t_guest]

hi

all pupils use a program called my learning space which they can save work

pictures.etc from home and then bring it into school and download it on to there home drive

the bad thing about this is that it comes with its own message system but we have had the message system disabled

my learning space

[djm968]

Three word……. Windows Terminal Server.

 

Ok I know you need to buy TS Cals @ £10.50 each, but the end result is a secure, familiar and consistent environment that will provide access to all resources and documents available on the school LAN and more importantly most of the applications staff and students use in school.

 

GPO’s can be used to lock the TS down as you would any workstation on the LAN and internet access via the TS can either be switch off or pushed through the existing filtering server.

 

You only need to open one port and provide a preconfigured RDP connection file for staff and student’s.

 

Q. Why are RM moving away from WebDAV to a terminal server based solution for remote access?

 

A. Extending teaching and learning opportunities beyond the physical boundaries of the school.

 

Windows Terminal services (and Citrix) provides the ideal platform to achieve this.

[enjay]

if they have home access can bypass our filtering and upload mp3,exe's etc...

True, they can upload them but they can't do anything with the files after that, as they will return to school and find the GPOs preventing them from running the EXE, so no harm no foul.

 

Also, unless you control attachments on your emails, block all web-based email sites and ban USB pen drives, then your students have been bypassing your filters for years...

 

We use RM Easylink too, and while it's a bit clumsy it does what we need - students can send work to and fro, and access homework sheets if they want. It's not perfect, but it is low cost :-)

[CyberNerd]

Three word……. Windows Terminal Server.

 

Ok I know you need to buy TS Cals @ £10.50 each,

 

you really don't want home computers eating up your TS Cals - get an external TS connector license for about £1400 and have a dedicated external access server.

 

For a more web based and cost effective access check http://www.alfresco.com/ for webdav/cifs/ftp and document conversion and versioning CMS

[Domino]

we use this http://www.netgear.com/Products/VPNandSSL/SSLVPNConcentrators/SSL312.aspx for staff access, works fine, very secure, connects to AD, etc. only 200 odd squid

 

Only allows 25 concurrent connections though, so probably no good for student access. I've had no gripes though

[djm968]

you really don't want home computers eating up your TS Cals - get an external TS connector license for about £1400 and have a dedicated external access server.

 

AFAIK, an external connector license is only required if you intend to offer remote access for external users who are not employed or affiliated to your organisation.

 

“An external user is a person who is not an employee, or similar personnel of the company or its affiliates, and is not someone to whom you provide hosted services using the server software.”

 

Source: http://www.microsoft.com/windowsserver2003/howtobuy/licensing/extconnector.mspx

 

You would therefore still require TS Cals to allow staff and students to connect remotely to a terminal server.

[maniac]

I run a piece of free software called SSL explorer here, which I've setup to allow access to students and staff home areas, and read only access to public areas. There's also a web VPN built into this which allows selected staff to connect to and use their machine as if they were in school. It works well, and is very easy to use, ad best of all it's free!

 

It uses the active directory database for user authentication, so nice and simple, and there's lots of customisations you can make from the admin console, so you can pretty much get it to do what you like. You can see the front login page at https://www.nbc.medway.sch.uk:49302

 

Cheers,

 

Mike.