Slashdot Mirror
P2P Programs on K-12 Networks?
deque_alpha asks: "I am a system administrator for a small K-12 public school district. I am taking over after a bunch of goofballs have really messed things up, the technology department is in utter disarray. I have near infinite problems, but the hairiest are with people sucking up what little bandwidth we have, introducing virii, downloading warez, and generally causing problems with P2P file sharing programs. I don't generally have a problem with these programs, but they are not an appropriate use of the limited bandwidth of a K-12 institution as they provide little in the way of an educational resource, not to mention the legal liability they potentially introduce. The rub lies in that these people are teachers, and I have virtually no policy to back me up if I come down on them, but shutting them down is neccesary to maintain harmony (and legality) on the network. I don't have the authority to pen new policies myself, and my supervisor cannot to be counted on to do it either. Have any of you been in this position before? How would you approach solving it without totally alienating your users? How do you broach the subject of introducing new policies with supervisors?"
Use a FreeBSD gateway machine with DUMMYNET. FreeBSD can be configured so that it: a) doesn't have to replace the existing firewall; and b) is invisible so it doesn't show up on traceroutes. This is so that clueful users are not tipped off in a way that lets them complain like pornhounds on a free NNTP service. DUMMYNET will let you set up bandwidth policies based on (groups of) IPs, ports, and more. Client subnets can have full bandwidth on port 80, but the gateway can shut them down to 28.8 on the P2P ports. The possibilities are really open in a situation like this, and any junk computer can be used.
When I was a kid, we only had one Darth.
As Manager of Technology for a K-12 school division, I can tell you how we do it. First of all, your system should have an Acceptable Use Policy (AUP). Students and parents should receive a copy of it each year during registration. Ours is included in the Parent/Student Handbook. All students who use the Internet must have a signed form from their parents granting privileges. Ours includes language that states that Internet access is for educational use only! Even though it isn't strictly enforced (we do allow entertainment sites for example), that language is there to back us up on content and P2P decisions.
Since students and teachers use the same network and computers, all are subject to the same policies and filters. We transparent proxy all requests to port 80 and 554 through iPrisms which filter and then pass the request on to a Squid proxy that generally runs at about a 40% hit ratio. All other Internet traffic passes through our Cisco firewall which performs NAT based on an access list. That access list denies NAT for all the popular instant messaging and P2P applications. Since all computer addresses are private, no NAT means no access. Instant messaging is blocked after an incident where a bomb threat came in that was untraceable according to AOL. P2P filtering is obvious due to copyright violations and bandwidth usage. It is interesting to watch the hits on our access lists from P2P apps that are denied. Kazaa seems to be the most popular, we block several million Kazaa packets each week.
That's how we do it, if you have any questions, let me know.
Jason
"FORMAT C:" - Kills bugs dead!
I hate firewalls, proxies, and that crap. They don't really stop anything.. they just funnel it all into 1 port. Instead.. I would suggest per user bandwidth/disk quotas. Also.. like lockers.. the systems are school property, not faculty or student. Thus, I don't think there's any right to privacy. Snoop, spy, sniff till your heart's content. As important as I think privacy is, I don't feel it is a right at school or at work. I feel it is a privaledge that can and often is abused. Legality aside, if you're doing something you don't want other people to know about, it's probably not too smart to do it at work or school. Faculty or students can probably look at the post-it note under your keyboard and violate your privacy just as easily as the administration. If you get caught doing something you shouldn't do, you have noone to blame but yourself.
Of course, I would not outlaw all recreational use. If some kids would like to play a spirited match of BZFlag during their lunch break, so be it. Turn students and faculty onto legal ways to enjoy computers. A policy of, "NO FUN 4 U!" will only succeed in turning teachers and students off of computers. There's tons of free fun crap on the net.