Slashdot Mirror
Restricting Wireless Access on Campus?
Diety_in_A_Minor asks: "How would one set up a wireless network on a campus such that restrictions can occur by classroom? My back of the napkin solution would be to relate MAC addresses to class schedules, and have the DHCP server allow access to student-registered MAC addresses only during specific times. Although possible, this solution requires tremendous maintenance. What other solutions are there? One class in a building will require restrictions, while both classrooms adjacent to it need open access."
Change the student password every hour. Have the teacher easily able to see what the password is.
Write the password on the blackboard at the start of the class. Possibly have several different passwords with different levels of access.
- Muggins the Mad
Asside from changing the password (or WEP key) constantly and having the professor tell the students what it is each class, you could shield the classroom so that the signal doesn't travel outside of it. This of course assumes that the access point is in the classroom and that the room is small enough to electromagnetically shield economically. Depending on the size of the room (big lecture halls) you might be able to just turn the signal strength of the AP down low enough so that it can't be reached outside of the room.
-----BEGIN GEEK CODE BLOCK----- Version: 3.12 GIT d? s: a-- C++++ UL++++ P++ L+++ E- W++ N o-- K- w--- O- M+ V PS+ P
Why not associate usernames with schedules and save yourself the hassle? Require a VPN logon for the wireless network, and deny access to specific users at the right times.
LOAD "SIG",8,1
I've been meaning to setup a system using NoCat
It creates a splash-screen authentication at first connection. Either that or mandatory VPN.
--- Kicking the Cheat since late 2002
... is room with metal walls, and screens (like you see on the front of a microwave) to pass air.
What kind of school is this? Is it a college or university? The students are paying their way, let them waste their money by ignoring the class. Is it a K-12 school? Send a note home to the parents or disable the account of those caught using the 'net when they shouldn't.
I can't say that I don't give a fuck. I've just run out of fuck to give.
What about using 802.1x with a RADIUS server that has time based access controls (like Radiator) ?
Or is it some old teacher that thinks that it'll somehow force people listen to their boring, pointless lectures, when the students will likely just find something else to entertain themselves with.
MAC Address Restriction wont help, people could just sniff over and masquerade as other clients. Time up on one MAC? Spoof another. Rinse and repeat until wifi wants are satisfied, since nobody is going to be on all of that time or all of that week. Rate limiting wont help if it's done this way, you're just going to get some people who will just hop from one to another MAC, and people wondering what happened to their time.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
Wireless is good for a lot of things, but it seems to me that this "solution" will require so much more time and effort that you might as well just use a wired solution. It shouldn't be too hard to have a router in each classroom that can be turned on or off as is appropriate. With a wireless solution you are pretty much relegated to turning off each individual students access based on their schedual, which is going to be much more difficult to impliment effectively.
Famous Last Words: "hmm...wikipedia says it's edible"
All your students should register their MAC address in order to get a working IP. Use whatever your vender provdes for making sure someone isn't getting on without that.
Make a policy stating that you can't do , then audit occasionally. When you find an invalid MAC, send them a warning letter.
Besides, it's impossible to enforce. If someone borrows a laptop, they suddenly get locked-out of the online lecture? What do you want them to do, whip out a cellphone in the back of the hall and call tech support?
Mind you, what do you expect from a country where you can buy a gun when you're 12 but you can't drink anywhere until you're 21?
I know 2 examples of universities that have WLAN on the entire (well, almost) campus.
:/
1) Register your MAC address electronically, print out a form stating you will abide to the terms of usage, sign it, hand it in, and your MAC addess will receive an IP from DHCP the next day. VPN required (with group passwords). Connections are filtered through a firewall.
2) No registration required, but you need to install a VPN client with a certificate which can be generated on a website which is only available from a computer with a campus-IP. Again, a firewall restricts connections, depending on the type of user (students have more restrictive filters than employees).
Of course each solution requires you to have an account at the university (LDAP check).
As we are also using PDAs, VPN is a bit of a burden, but so far the various devices (iPAQ & Palm 5xx) can handle it, more or less. A major annoyance is the fact that you tend to turn off the PDA to save power. This cuts the VPN connection, so you need to log in again and again and.....
My cats ate my karma. They also wrote this comment.
allot bandwidth according to classes- one hour per week per hour-long class
In most university situations it would be desirable to have accsess outwith the scheduled classes, but less desirable for use during classes (it is distracting and rude towards those taking the classes)
If it is necessary to restrict accsess (for exams etc) The easiest way is to dissalow any equipment not provided by the university. In exams I have had calcualtors provided.
Disclaimer: I'm guilty of rolling my own as much as anyone, but there is such a thing as using the right tool for the job and I have decided this is the way to go in regards to wireless.
Even if you do acces control by MAC address or VPN login as others have stated, students will just swap wireless cards or vpn logins with someone on a different schedule when they need to.
11*43+456^2
It's a bad idea, students will either hack it or switch to cellular modems. Just let the tight-assed professors deal with it and tell them to join us in the twenty-first century.
What you are doing shows a lack of respect to the students. If a student wants to waste their opportunity to be educated let em. The good students will voluntaraly go by the rules.
Belive me if you try to implement this system you are in for a world of hurt.
At my school (Berkeley) they're using something by Vernier, most likely this, to require login and password for WLAN access. It's pretty cool--anyone can get a DHCP lease but apparently the Vernier access manager maintains a dynamic routing table that drops all your traffic until you've authenticated. Since they've managed to link the access manager in with the strange Kerberos-ish auth mechanism our school uses ("CalNet") I've a feeling the system is quite flexible and could be easily integrated with class schedules to provide the solution you're looking for. (The literature says it supports all the usual suspects--Kerberos, LDAP, Radius, NT, etc. and those are flexible enough on their own to do it.)
I think there is a world market for maybe five personal web logs.
The problem with most of these mac address based solutions is they assume:
1) You don't have large numbers of people openly subverting the system
2) People don't have administrative access to their own boxes
Neither of which is true in a college environment. You can tell an ethernet card to change its effective mac address to anything and students will share with information with each other.
Security requires that:
a) the people with access want to protect the information from the people without access
b) The people with access cannot communicate to the people without access
You don't have either situation. Rather what you have is a 3rd party creating a security policy (which classrooms have access) which does not enjoy student support. I agree with the poster who commented on a wired solution, this seems 100x easier.
...but not with off-the-shelf solutions. See the research of Dan Wallach, Rice University (my alma mater). He's been doing some research on baysian methods of determining a wireless node's location based on its signal strength at multiple APs. Surprisingly robust, even in the face of people maliciously modulating their signal strength, et al. See his work here. Remeber, it's still in the research stage: but if you could implement it on a large scale, you'd make a pretty penny doing so!
and see how long before that I use something like Knoppix STD to change my MAC address and get my ass into the network.
Come on, if you're a University, then you've already got fat pipes, and probably let the kids in dorms and the library have unlimited access, so why treat your other students like crap just because they're in the wrong location.
And if you limit their internet access, what kind of education do you think that you're providing them with by limiting the information that they can access?
Hell, and even if you try to, odds are that anybody with half a brain will hack it, or the user with access is going to set up their system as an IP masquerading AP.
That being said, no mac filtering or proxy solutions are going too be fool proof (or, more accuratly, geek proof). It is easy enough to setup NAT on a laptop to give access to the next room, or spoof your MAC. As I see it, there are two possible solutions that would virtually gaurentee that you accieve what you are trying to accomplish:
Magneticly seal each classroom: difficult, expensive, effective.
Jam 2.4 GHz in classrooms that you don't want access in: Cheaper, but may cause unwanted interference. Leaves 802.11a wide open for repeaters. Questionable legality?
Best of all, both of these solutions have the added benifit of blocking those &*$#!@#%$*% cell phones!
and get a BlueSocket device. Truely, they are the best.
We'll never get anywhere by building fences. You've heard the Linux quote, "In a world without windows and gates, who needs walls and fences." My sipmle solution is to just let the people on the network, use a public/private hotspot, D-Link makes some nice ones. Simple, but effective.