ReBoot

Use "sudo su" or "sudo su -" Difference is explained below. sudo su Bash is called as interactive non-login shell. So bash only executes .bashrc. You can see that after switching to root you are still in the same directory: user@host:~$ sudo su root@host:/home/user# sudo su - This time it is a login shell, so /etc/profile, .profile and .bashrc are executed and you will find yourself in root's home directory with root's environment.

If you want a Linux/Samba solution I highly recommend the Linux Schools Project https://www.linuxschools.com/ I use it in a couple of primary schools and it does everything I need and is a pre-packaged solution for education. Supports zfs RAID which requires no hardware controller and is very intuitive to administer.

Agree with localzuk. If there are no active interfaces associated with this VLAN its probably not going to appear by default in the routing table. Having a quick look at the spec for the HP 5406zl there is no mention of it supporting VPNs there is just has some basic L3 features. I'm a bit unclear as to how VPN traffic is going to be presented to the switch.

A long shot but I have this enabled on all my Windows 10 machines using mandatory profiles. Not found a concise explanation as to exactly what it does yet. Hive HKEY_LOCAL_MACHINE Key path Software\Microsoft\Windows\CurrentVersion\Explorer Value name SpecialRoamingOverrideAllowed Value type REG_DWORD Value data 1 (or 0 to disable) Base Decimal

When you login are you getting a temporary profile which suggests you have a path set but the profile is missing or is the login normal which suggests the path is incorrect (for your mandatory profile). From memory the user will need the profile path set, you will need the profile extensions enabled (.V2, .V7 ...) via group policy, NTUSER.DAT will need renaming to NTUSER.MAN and there is also a group policy to control whether profiles are deleted on logoff. Sorry I can't remember all the details. Also I think the file permissions need to allow everyone read access to the profile. There is a Microsoft guide here https://docs.microsoft.com/en-us/windows/client-management/mandatory-user-profile which seems to cover everything.

Sounds like you need to manually enter the proxy configuration for apt as suggested by ADMaster. That should fix things. I currently run Ubuntu servers behind LA proxies and have not experienced any issues getting updates.

What happens if you do the following from a terminal ? (This just fetches the list of available updates so won't harm anything.) Is it hanging or can you see it downloading anything. sudo apt-get update

Well my approach was to keep the LA broadband for a transition period and evaluate the new services while keeping the LA as a fallback. You can then see get a real feel for how the two compare. A bit more expensive but with proper planning the additional cost shouldn't be too significant. Much depends on whether you are going to go for a managed package including data connection and filtering or buy in raw bandwidth and deploy an appliance of your choice separately. I prefer the latter as its generally cheaper and you will get more flexibility in contract terms. Many managed packages now seem to want a 3 year commitment up front which I think is excessive.

You can definitely boot from USB as I have done it with Clonezilla. However, your media needs to support secure boot as legacy boot seems to be the issue on these devices. I did ask previously what system you are trying to boot with as if this is not signed for secure boot its probably not going to work.

I have successfully booted Clonezilla from USB on these netbooks. I used a version of Clonezilla which supported UEFI secure boot (Ubuntu based) and it worked OK. I do seem to remember that it was difficult (if not impossible) to disable secure boot. What exactly are you trying to boot with ? We are thinking of buying a trolley full of these do you have any opinions/experience on their quality/usability. Cheers

To me the cost of moving from open source to a commercial appliance with the IWF list would be 1-2K annually. This is quite a significant premium for my ICT budget. (Given the amount of stick I get on these forums it may be a price worth paying !) It does appear that some people are under the potentially dangerous misapprehension that the IWF list is a significant first line of defense for protecting school children on the Internet. At best it is stopping a very small number of people, acting with intent, from viewing or distributing illegal content. Both the IWF list and the Shalla lists (which I use) are compiled from submissions from the public. The IWF does not engage in any proactive investigations to identify content and has a very narrow remit. As the IWF operate in secrecy its very difficult to judge the effectiveness or otherwise of their work (other than it's very limited scope of under 1000 URLs). My personal opinion is that the IWF list is not really intended as a first line of defense for schools seeking to block unintentional access to adult or other undesirable content. It has a different role and targets a very different group of users.

Don't disagree with any of this. My original point was that if you are connected to a UK ISP and using Google/Microsoft safe searches then not blocking the IWF list locally is an extremely low risk. I'm talking here about the risk of accidental exposure to the content rather than with deliberate or criminal intent. The content is already blocked at ISP level and we're talking about ~1000 URLs in a web of billions.

https://www.iwf.org.uk/become-a-member/services-for-members/url-list/url-blocking-faqs Look under what is the IWF URL List The IWF list contains specific web pages, or URLs. Every URL on the list depicts indecent images of children, advertisements for or links to such content, on a publically available website. The list typically contains 500 - 800 URLs at any one time and is updated twice a day to ensure all entries are still live. Any child sexual abuse content on a UK website is removed within hours so this content is not added to the list. Details of any child sexual abuse content hosted outside the UK are passed to Hotline in that country so they can investigate it within their own legislation and with their national law enforcement agencies. Whilst processes to have the content removed are instigated, the specific URLs are added to a list which we make available to service providers, under licence, so they can develop technical solutions to prevent their users being accidentally exposed to it. We have no plans to extend the type of content included on the list.

Don't confuse the IWF blocklist with the more general blacklists used in most filtering appliances. The IWF list is tiny and already blocked by the majority of ISPs and search providers. I wouldn't therefore see it as an essential resource but good if you can include it. The lists I use block around 1.8 million domains and URLs. The IWF list blocks 500-800. The IWF does come in for some criticism I suggest you read its Wikipedia entry. "In February 2009 a Yorkshire-based software developer lodged a formal complaint regarding the IWF status as a charity with the Charity Commission, in which he pointed out that "regulating the worst of the internet" was "not really a charitable purpose", and that the IWF existed mainly to serve the interests of ISPs subscribing to it rather than the public. An IWF spokesperson said that the IWF had attained charitable status in 2004 "in order to subject itself to more robust governance requirements and the higher levels of scrutiny and accountability which charity law, alongside company law, brings with it".[59] The IWF is listed by fakecharities.org, "a directory of those so-called charities that receive substantial funding from either the UK or EU governments".[60] It has also been termed a quango by critics, implying poor management and lack of accountability."

I would like to implement the blocklist but the IWF choose to operate in secrecy. The relative risk of not blocking this list locally is small as it is already blocked by 95% of UK ISPs and major search providers such as Microsoft and Google. The IWF list is around 500-800 URLs (not domains) - I currently block 800K adult domains and 50K adult URLs. The simple answer if deploying a solution such as I proposed is to go with an ISP who already block the IWF list. From a procurement perspective it does feel like there is a filtering cartel in operation who inflate prices and pass this on to schools who are already stretched financially. This looks like a move in the right direction. http://icalert.com/about/

Hi I've been doing what you're suggesting at a similar sized primary for around 3 years now. I'm using business FTTC (80/20) from Spitfire Internet (around £60/month inc. line rental). Would probably use Zen now. Router is a used Draytek 2830 (eBay £30) which has been rock solid and has enough performance for an 80mbps connection. I have a Gen7 HP Microserver upgraded to 8GB RAM, additional dual NIC, 40GB SSD for OS and 250GB cache disk for Squid. Running Ubuntu server (no GUI). Software includes: Shorewall Firewall Squid Proxy E2Guardian Webfilter Shalla Blacklists Filter updates automatically from Shalla weekly and confirms this to me via email. MITM SSL interception configured for pupils. I hold pre-configured spares for the router and Microserver. I use this as a test rig at home to evaluate changes and test any tricky filtering scenarios. Performance is good and it saves around £2K annually compared to a commercial provider. If you wanted to do something similar happy to help (can send you a disk which you plug into a Microserver and have a test system up and running in a few hours).

Agree on SSD size. 250GB is overkill and a waste of money if your workstations are redirecting folders to a server. I ran many Windows 7 machines using 40GB SSDs with no capacity issues. 64GB should do for most Windows 10 installations and if you want some extra headroom 80 or 120GB will do the job. Capacity makes a big difference to SSD pricing so install what you need and no more.

I'm running Windows 10 Education on OptiPlex 380s with Dual Core processors and 2GB RAM (no dedicated grahics card) and standard hard drives. No problem building software for Windows 10 and they perform well for most common applications. Obviously they may have limitations for more game oriented applications such as Kodu or Minecraft but they manage the basics well. What your technician is suggesting is quite a high (and expensive spec.). I don't believe there would be an issue running Windows 10 on your existing hardware. If the 380 is good for Windows 10 the later 390 shouldn't have a problem. First thing I would do is install Windows 10 on a reference machine to evaluate performance and check drivers are available. I would be 99% sure there would be no issues with Windows 10 on your hardware.

FTTC was not available to the school but FTTP was. The connection fee from Zen was £45.83 which covered a couple of spans of overhead fibre and installation of the CPE in the school (in some cases excess work can incur additional charges from Openreach but this was not case for us). I use the Draytek as its good enough for an 80Mbs connection and configurable for the proxy server which most bundled routers are not. Also very cheap on eBay I think I paid around £30. Yes you use the Ethernet WAN connection and PPoE for FTTC. Not many routers will support the necessary optical connection.

I have FTTP installed at one of the primary schools I support. We chose the 80/20 service from Zen Internet. Basically the price is the same as FTTC unless you go for the higher speed options which are still very competitive. We are paying around £38 + VAT a month. Very cost effective solution for a small primary - especially the higher speed options. Filtering is an HP Microserver running e2guardian and router a Draytek 2830.

School has bought a bunch of these. They are supplied with 2 physically different chargers. Both are rated at 45W and both reference the same HP replacement part 741727-001 Individual part #s are: 854054-001 854054-004 Looks like different revisions of the same part - nice to have two but a bit confused over why. Anyone seen anything similar when buying HP ? Cheers

Looking for similar myself. The ACER ASPIRE R3-131T range looks a possibility though you would need the hdd version as the max SSD size is 32GB.

I think it can take some time to get verification of educational status through but you can get things up and running without this and be up and running pretty much immediately. Domain verification should be less than 24 hours its educational status that can be the delay.

I work in a small primary and have setup GAFE accounts for staff which work fine. Also you can elect users who can approve videos for use across your domain. I've not come across any other solution and I suspect the time taken researching and implementing one (if it exists) will be more than using GAFE which is supported by Google and works.

If I create site applesapplesapples.co.uk and only host adult images no filter (mitm or not) could detect this and determine whether to block. Only if I add text to suggest the nature of the content would the filter be able to make a decision. SSL mitm helps but is not foolproof and nothing is 100% reliable at filtering.