Access from home

[Badaz52]

Hi,

 

We are looking into installing a VPN so that staff can access their home directories, shared folders etc from home. I also want to factor in the ability to remote desktop to one of our terminal servers so they can use SIMS etc from home also.

 

I have used a product called SSL Explorer in the past which worked very well for this purpose and I think has now been bought by Barracuda networks.

 

Is there anything that is available that I can use for free to accomplish this? the budgets at this school are extremely tight and I was wondering if this is something which can be achieved without spending a ton of money.

 

Many thanks

[Achandler]

Why don't you just have them remote into your Remote Desktop Server directly?

 

I encourage this as it is easiest for our staff to understand.

 

Edit: I will give more details if this is something you want to try.

[edutech4schools]

I have just been testing lots of vpn systems

 

Home Access Plus+

 

pfSense Open Source Firewall Distribution - Home

 

Access Server Overview

 

OpenVPN ALS | Free software downloads at SourceForge.net (which is the same as SSL Explorer)

 

 

And a few others

 

I have decided to go with HAP

[twin--turbo]

Don't use a VPN.

 

Use a remote desktop solution.

 

Rob

[jamesfed]

Don't use a VPN.

 

Use a remote desktop solution.

 

Rob

 

Care to justify?

 

We have a VPN for our staff powered by Forefront TMG - nice stable and secure all staff do is double click on a shortcut on their desktop and boom its like they never left the school. Bearing in mind we issue a notebook PC to every member of teaching staff.

 

Currently looking at the updated Direct Access feature of Server 2012 - wasn't possible for us to implement it with 2008 R2 but 2012 is looking extremely promising

[MicrodigitUK]

Adito is free and was forked from SSL-Explorer so should be fermilier to you.

 

what_is_openvpn-als

[FN-GM]

Why don't you just have them remote into your Remote Desktop Server directly?

 

I encourage this as it is easiest for our staff to understand.

 

Edit: I will give more details if this is something you want to try.

 

This is not secure, you need something that will create a VPN solution then the RDP session.

[Achandler]

When I said more details, I was going to go on and suggest using a ts gateway.

 

He might have been intent on a full VPN so I didn't expand further.

[shadowx]

We use RDWeb Access here, as much as I hate microsoft it is the only part of our new windows backend that I actually think is good.

 

The staff can access it from any computer running internet explorer basically, they go to the URL (Or click the shortcut if using the school issued laptop) login with their AD details and they get presented with a webpage with an icon for every program that their user group is assigned, usually all the word processing stuff and SIMS. They just click what they want and wait 30 seconds and, for example, Word will open on their machine but it is actually a remote version of word. It isn't a remote desktop it is a remote App, so they get all the policies and settings that they get in school plus when they open/save they see their school drives but they are working on their home desktop.

 

We also put a remote desktop icon on the list of apps so if they want a full blown desktop they can click that and it will log them in to a full remote session.

 

Have a look at Windows remote App, it's actually pretty good. Works out of the box on windows 7, with xp you may need to manually download Remote Desktop Client 7 (I tell staff to google RDP7) and you're sorted.

 

The only requirements on the server side are to obviously have RD Web Access installed (which is a paid for product I believe) have the correct CALs and then put your remote box in the DMZ or port forward it correctly. To use SSL you will need a certificate which you can either purchase or distribute the relevant CA certificate on a disc/pre-install it on the laptops so you don't get security warnings.

 

No complaints so far! It also means that SIMS etc... doesn't have to be installed on the ICT workstations, when they do staff training they just log on to a student machine, open up the remote access page and click on SIMs which is nice! And if their laptop/home PC breaks they can use any windows machine in the world.

[FN-GM]

When I said more details, I was going to go on and suggest using a ts gateway.

 

He might have been intent on a full VPN so I didn't expand further.

 

Ah when you said directly, gave the impression of no VPN etc

[jmak]

I am keen to implement some kind of low cost remote access to files on our 2k8 r2 server, but so far foiled by the fact that we're instructed to only allow access to IL3 data if we use 2 factor authentication. Does anyone have any suggestions? I did wonder about a solution that only allows use access from the laptop we issue, rather than Internet, I.e. the 2nd factor is being in possession of the laptop.

 

I do keep making the point that remote access password protection is probably more secure than lots of unsecured USB drives floating around:doh:

[jamesfed]

I am keen to implement some kind of low cost remote access to files on our 2k8 r2 server, but so far foiled by the fact that we're instructed to only allow access to IL3 data if we use 2 factor authentication. Does anyone have any suggestions? I did wonder about a solution that only allows use access from the laptop we issue, rather than Internet, I.e. the 2nd factor is being in possession of the laptop.

 

I do keep making the point that remote access password protection is probably more secure than lots of unsecured USB drives floating around:doh:

 

You can use Certificate based autentication to do this

 

I belive thats included as part of Network Protection System in Server 2008+.

[Achandler]

You could also make it so that only certain users (from AD) that are logging in from certain laptops (again in AD) can actually login through Remote Access on an RDS server.

 

This was our initial setup.

[morganw]

I've not tried this, but it looks decent.

AjaXplorer

[jmak]

You can use Certificate based autentication to do this

 

I belive thats included as part of Network Protection System in Server 2008+.

 

Any idea if this complies with BECTA/NAACE advice (I won't be allowed to implement anything that doesn't.

 

Thanks

[ijk]

Bearing in mind we issue a notebook PC to every member of teaching staff.

 

Where this isn't possible and users connect using their home computers, what measures do you think should be in place to protect internal networks?

[GrumbleDook]

I believe the area you are looking for is Configure Network Level Authentication for Remote Desktop Services Connections

 

The device is authenticated as a valid device before a session is initiated, the user is then authenticated against the AD.

 

I would also set restrictions so that you cannot transfer files from the RDS to the accessing device (basically you lock out USB, access to locally shared printers, etc).

 

Also be aware that technology is not the only answer on this. You should have policies in place to tell staff that if they are doing this then they do not do it in a public place (where the screen is viewable by Joe Public), that they don't email themselves the data because you are restricting access to the local printers, USB sticks, etc ... and that the device (laptop) is not used by others (eg their family as a games machine).

 

The Becta advice (released before MS Server 2008 R2 was out) really looked at ideas such as Citrix and Oracle SGD (or Sun SGD as it used to be) but this can be really costly for many schools not already going down this line for thin clients. As a word of warning ... most folk I know who have tried to set it up have had serious issues doing it with XP SP3 or Vista (ie it has not turned on the security) so when authorising RDP access for Northants schools I will only do it if they are using Server 2008 R2 and Win7 clients.

[twin--turbo]

Care to justify?

 

We have a VPN for our staff powered by Forefront TMG - nice stable and secure all staff do is double click on a shortcut on their desktop and boom its like they never left the school. Bearing in mind we issue a notebook PC to every member of teaching staff.

 

Currently looking at the updated Direct Access feature of Server 2012 - wasn't possible for us to implement it with 2008 R2 but 2012 is looking extremely promising

 

If your providing devices, and have them locked down then it's a viable solution.

 

 

However...

If your letting teachers use their own ( or unsecure provided equipment ) who regularly visit MP3 & torrent download sites, let their kids play java games on the latest insecure site, click on the link that says "YOUR COMPUTER IS INFECTED CLEAN UP NOW", have kids who are hackers, send out their entire email address book to every virus writer in the world, ETC ( Add everything that seems to happen to "Unsuspecting" users..

 

Then allowing them direct VPN access to your network should be taken with great care, just the same as BYOD devices within school.

 

Rob

[GrumbleDook]

Where this isn't possible and users connect using their home computers, what measures do you think should be in place to protect internal networks?

 

To be honest, if you are starting to go down the route of using home devices to connect then you have to start coughing up some cash at the school end to protect yourself. At work (an LA) we use Citrix with 2-factor authentication and restrictions on access to local resources ... and a hefty AUP to go with it, backed into our contract of employment.

[ijk]

To be honest, if you are starting to go down the route of using home devices to connect then you have to start coughing up some cash at the school end to protect yourself. At work (an LA) we use Citrix with 2-factor authentication and restrictions on access to local resources ... and a hefty AUP to go with it, backed into our contract of employment.

 

Quite. We don't provide our teachers with a school issued computer and do not use a VPN. I outlined our approach in a similar thread earlier this evening and came across this thread later. I think it's an interesting area. Briefly, we allow remote desktop connections from users personal equipment through a SSH tunnel. It works okay for us and doesn't connect their equipment to the network. I don't know how it would scale - only a handful of users have access (through desire/need rather than a sense of privilege) and it's there for a specific purpose at the moment, that of reading/approving reports twice a year. The costs involved are RDS cals, cost of Bitvise SSH server and cost of Bitvise Tunnelier client for each user (edit: plus time of course).

Edited September 26, 2012 by ijk
pedantry

[ijk]

Also be aware that technology is not the only answer on this.

 

Sure, but this is a how do you do it thread. If someone is attempting to achieve a technical goal I believe it's important to focus on the technical aspects of that goal in a brain thread that is separated from the organisational aspects. If I work that way I find I get more done.

[jamesfed]

Any idea if this complies with BECTA/NAACE advice (I won't be allowed to implement anything that doesn't.

 

Thanks

 

BECTA no longer exists

[detjo]

Any idea if this complies with BECTA/NAACE advice ..

BECTA ?? Whozat? lol

 

Cisco firewall/vpn an option?

Edited September 26, 2012 by detjo

[jmak]

BECTA no longer exists

 

I have had a hard day, but that hadn't slipped my mind. Just giving credit to the folks who created the document, rather than the organisation currently hosting it:

 

http://cnp.naace.co.uk/system/files/data_protection_in_schools.pdf

 

It still says BECTA on the front.

[RTFM]

We have a sonicwall which we are going to offer a web based RDP client for staff which they can access from anywhere as long as they have a machine and the internet