Slashdot Mirror
Handling User Grown Machines on a Large Network?
matth asks: "Recently with the outbreak of the MSBLASTER worm and the startup of the college semester here in the US we've been hit by a big problem here where I work. Many students are bringing in machines from home, often times infected. The infections are so bad that they bring the whole network to a crawl. Yes, you can install ACLs on edge routers and put a router between the dorms and the rest of your network, but it still brings the dorm to a crawl. You can make sure people install the patches, but what if someone re-installs Windows, or brings in another machine, and what about NEXT year? From the Slashdot community, how have sysadmins out there dealt with this? How can you manage each machine in a network such as a college, where people are bringing their own machines in from the outside? ACLs on routers... but what about for the segmented network?"
Force them to login to an Active Directory domain and hand out updates...
You talk better than you fool!
If you can track down where the traffic is coming from (which I believe you can with MSBLASTER, at least to the extent of IP address and from there, MAC address), block their port until they fix their machine. Once they've (a) patched up and (b) removed MSBLASTER, let them back on. Having an A4 sheet detailing where to get the patch and removal tool (possibly mirrored locally) would be a good idea too.
Here at my school, for the last week, starting about a day before freshman move in, they have had flyers *everyewhere* telling people not to hook up the network until they install this patch provided by the IT dept. Of course, there are still the bozo's that don't pay heed to the warnings....but there are lots of them in the world anyways.
Because I'm sure that they'd far rather spend sixty times the amount of support costs trying to get users acquainted with Linux, rather than have their network flooded with virii every now and then.
Now don't get me wrong--I'm just as much a die-hard Linux advocate as anyone, but it's just not feasible to tell every kid on a college campus to suddenly switch operating systems. They're going to need to figure out how, and you're going to be the ones to tell them. This is going to send your costs through the roof.
He's trying to solve problems for his university, not create new ones.
No comment.
Students go to university to learn and give back some knowledge, not to constantly maintain their tools.
This is so ridiculous that I'm still thinking you're joking. Either that or you haven't been in education for a long time.
I'm a CS student. We often have the choice of buying an outdated EUR 6 hardcopy of a lecture script (without TOC or index), printing some 200 pages (on a printer quota that's sufficient for 150) or viewing the constantly updated script on-screen with search functionality. This holds true for at least four courses per semester. Without PCs, we'd be royally screwed.
In most appartment buildings for students, the network is provided by the university over a 2MBit line with at least 10% packet loss, high lag and a 650MiB/month quota (traffic inside the uni network isn't counted). Bozos who don't get the rules get blocked at the inhouse switch.
If they'd try to ban PCs they'd get only one thing: open revolt. I mean the stuff with burning administration buildings. Literally. Plus it'd be mostly unenforceable in countries with things like individual freedom. Oh, there's also the need to at least quadruple the number of terminals across the campus.
Fight hunger. Filet a politician and send him to a 3rd world country of your choice.
I was with you until this part: "drop their connection via MAC address and refuse to give them another DHCP lease". Here's a better idea. CALL THEM! If they're running Windows, send them a Messenger Service Message before you cut their connection, telling them to call IT or something. Don't just shut them off, it's bad for your department's image and it's a bad policy when dealing with people.
- Sometimes you're the pidgeon, sometimes you're the statue.
You never played the lottery? Let me ask you another question.
Do you have any kind of insurance?
But surely you know that, like a lottery, insurance works because on average people pay more money into it than they receive from it. Lotteries and insurance are both gambles... except that in a lottery, you bet on good fortune. With insurance, you bet against bad fortune. In both cases, the expectancy value is less than 1, but in both cases you'll be damn glad you subscribed when your number's up.
I know I know, it's just a joke. Well, I just had to get this off my chest.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
At Carnegie Mellon, unregistered boxes are automatically routed to a web page that allows them to do temporary or permanent registration based based on MAC address. Once you register, your machine can access the network and DHCP. This allows for easy monitoring, notification, and disconnection of zombies.
It's called AuthBridge and runs on a Linux machine with ethernet bridging and real time packet filtering based on the MAC address. See the link for technical descriptions, diagrams, and further details.
Seems to work quite seamlessly as an end user, IMHO.