Sheridan Posted May 23, 2012 Posted May 23, 2012 We're looking to install Python with the IDLE into some of our ICT suites so the students can do some programming. Sounds great but has anyone done this and if so what issues have you have with security policies etc? My concern is that Python will not obey ntfs permissions/group policies etc correctly and students could write scripts to access system files and so on, not being a Python programmer I've not had a lot to do with it! I'm all for getting the students programming but I'm conscious of the pitfalls.
Chris_Cook Posted May 23, 2012 Posted May 23, 2012 Python is like any other windows program. It has to obey ntfs permissions. The only problems are if the permissions arn't set properly, or when code is submitted to a teacher. If a teacher (or admin) runs a students program, then it will run with the teachers permissions. Practically I don't think there is much chance of this being a problem, but the risk is there. The best solution to that is if the member of staff reads the code before running it. most stuff should be obvious.
Sheridan Posted May 23, 2012 Author Posted May 23, 2012 Thats a good start anyway - I had intended to put a windows firewall rule in to block python.exe from any network access as they don't need to do it. I'm not being deliberately awkward, but we do need to pre-empt any problems that can causes issues. Teachers and students have broadly similar permissions on networked PCs anyway so that shouldn't be too much of an issue.
Oaktech Posted May 23, 2012 Posted May 23, 2012 I'm not being deliberately awkward Yeah you are... but that's your job I'm following this with interest as i'm doing some reading try to pre-empt the inevitable. The ICT guys are dabbling with KODU and scratch, but it's only a matter of time!
Sheridan Posted May 23, 2012 Author Posted May 23, 2012 We already have scratch in use and Kodu is being looked at (althought that seems pretty safe anyway) We also looked into the Pi's - but availability seems to be an issue!
Oaktech Posted May 23, 2012 Posted May 23, 2012 Indeed... I'm still waiting for my Pi, when it arrives we'll sit down and work out if we can create a scheme of work to use it.
Sheridan Posted May 23, 2012 Author Posted May 23, 2012 Actually if the python IDE does obey NTFS permissions, and I block python.exe from any network traffic that would probably secure it enough for most users. Not being a python programmer I haven't got the knowledge to test it, bit of a VB man myself!
Chris_Cook Posted May 23, 2012 Posted May 23, 2012 I doubt they would be able to do much damage with network stuff. I would be more concerned with running other programs, using the subprocess module or the os module. But this is common to most, if not all, other serious programming languages. It probably depends on your staff and students as to how much you need to secure it. In terms of security, python and vb have fairly similar security issues. I'm also waiting on my pi.
Sheridan Posted May 23, 2012 Author Posted May 23, 2012 Yes thats the bit I don't understand. Policy prevents them from running regedit (for example) but does that mean it could be started from python instead?
jonspurs Posted August 1, 2012 Posted August 1, 2012 Hey..just curious on the latest with this? We've been asked to roll out Python...but I'm looking for the security holes too... Cheers, Jon
SimpleSi Posted August 1, 2012 Posted August 1, 2012 Your probably not programmers so I'll explain If you give people a tool (such as sharp knives or Python) then what you need is for people to take responsibility for using them - trying to restrict their usage (such as anchoring the knives via a piece of chain to a table or restricting permissions on share access) negates the usefulness of the tool. What you need is social behaviour policies/rules/policing/sanctions not physical restrictions Simon 2
jonspurs Posted August 6, 2012 Posted August 6, 2012 Cheers SimpleSi...but in a school it is simplier said than done...
bede Posted October 10, 2012 Posted October 10, 2012 (edited) We are looking at rolling out python to some areas for same reasons. I acknowledge SimpleSi's principle and this will apply in 95+% cases at our school. However every so often we get someone who wants to 'experiment' (not a bad thing), but they may also be someone who knows less than they think they do and/or someone who is relatively immature in applying such principles (the nature of [some] school students). So - just wondering if people have now tried this, before we have a go and reinvent the wheel. Also if any particular distribution of python is better to deploy on a curriculum network than others ('vanilla', ActiveState, Portable etc) and any pitfalls to avoid .... [personally prefer PyScripter to IDLE] TIA Edited October 10, 2012 by bede
catchpolej Posted December 7, 2012 Posted December 7, 2012 Hi, "It's only a matter of time...I think you are right. I have asked our technicians (yes I'm a teacher - just ducking to avoid shrapnel now) to install Python (IDLE) and it is blocked by group policy for everyone except Admin. We were not sure why. Can anyone help us? Also I was not sure whether the Python IDLE runs an executable if you stay within the IDE. Up to know we have been doing all our "proper" programming using JAVA so this issue has been avoided. Any pointers appreciated.
Steve21 Posted December 7, 2012 Posted December 7, 2012 Hi, "It's only a matter of time...I think you are right. I have asked our technicians (yes I'm a teacher - just ducking to avoid shrapnel now) to install Python (IDLE) and it is blocked by group policy for everyone except Admin. We were not sure why. Can anyone help us? Also I was not sure whether the Python IDLE runs an executable if you stay within the IDE. Up to know we have been doing all our "proper" programming using JAVA so this issue has been avoided. Any pointers appreciated. I'm slightly confused as to what you're asking exactly... If it's being blocked by GPO it's blocked because it's set to block exe's. Unless the technicians have installed it somewhere that the GPOs aren't blocking, or give you a way to elevate your rights there isn't anything you can do. Think by default Python drops itself into C:\, which by default isn't a "safe" area for GPOs (Normally it's program files etc). The technicians need to change the settings. "Python IDLE" is an exe, so I'm not sure what you're asking in terms of does it run an exe if you stay within the IDE. It's just the python exe with a pretty GUI. A python script that is run within it won't spawn a secondary exe if that's what you mean? (Not like how a programming language will create an exe, scripting just interprets it) Steve 1
CyberNerd Posted December 7, 2012 Posted December 7, 2012 @catchpolej If your already programming in JAVA then chances are you are using Eclipse. There is a Python plugin for it here.. It works with Python, IronPython and Jython
catchpolej Posted December 9, 2012 Posted December 9, 2012 Thanks Steve. The GPO is set to block exe's. I will see if your advice about changing the settings of where Python installs itself work. "A python script that is run within it won't spawn a secondary exe if that's what you mean?" Yes that is what I meant by my question. Steve
catchpolej Posted December 9, 2012 Posted December 9, 2012 We are using Greenfoot and BlueJ for the moment for JAVA - less options to distract from the coding but thanks for the tip.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now