A head scratcher...monitoring student internet access.

a simple way to do it, use a traffic logger on the gateway device, which will map exactly which room each ip is in, if you note the wiring correctly.

most of the student's computers, if not all, will be running with dhcp, so either they will have to be given an ip number, or else you will need a dhcp server in the system. it's easier to use the dhcp server, though by assigning ip numbers it makes monitoring for prohibited content easier.

The students will have a copy of the policy that says their online activities will be monitored for "objectionable" content?
[ a copy of it signed in the school records is good as well, signed by the student naturally. ]

Five years ago I worked in a secure gateway that supplied Internet for several government agencies and we had a piece of software that monitored all Internet access requests, it noted the user's ID and the site being visited, it also checked the incoming info for 'objectionable' material. Anything noted was placed in a report for the sys admin to review.

The software had black list and white list capability. Anything in the black was totally blocked and anything in the white was not checked.

Sadly I can not remember its name. However, a Google search lists many software solutions that will work. Some I found quickly are

http://www.softactivity.com

http://www.internetaccessmonitor.ru/eng/download/index.php

Do some homework.

Now you can buy devices that work as a proxy and actual open and scan all sites before passing them on. Thus checking for nasty code as well as objectionable material.

...that caught the rat...all in the house that jack built.

So I think it clicked now.

The MAC is our unique identifier for each PC.
Hostname can change, IP can change but the MAC for all intents and purposes is static.

From my log file I see that the IP address and MAC of the offender.

I go to my switch and look at the MAC address table and go "Ah ha! MAC 00:00:... is using port 6...[look at wiring map] and port 6 goes to jack 2A123."

To answer your questions:
1.Short answer: Yes, my bosses' boss (College President) and the board of directors want to get that specific. Long answer: If we can narrow it down to lets say 10 people who are on the south side of the top floor of a dorm building that's close enough for my boss to spin it to the higher ups, from there the detective work begins! The best way I can describe the reasoning is as follows: We have two problems: Technical, which simply blocking the site accomplishes. The other is Moral accountability for actions. Being religious college the second is actually the more important issue.
2.Yeah, they may want to. There are no current plans to have anything like this within the next two years. And I see where this is going: If we're going to have students login to things, then dangit I'm gonna have to administer 300 user accounts anyway, so what the heck, make them login to the network on their personal machine so we can track their 'net activity.

But this violates what I* (*I being the College board and prez ) really, really want to do, filter traffic back to a specific person while having ?plug and go? use. (Plug in network cable, boot, go on net w/o logging in.

I have a thought on this, and follow the logic. My content filter gives me the IP address, and MAC address of the computer that made the request, and the site it visited. If I get switches that keep a MAC table and which port that MAC is connected to, that might work.

So the PC with MAC 00:00:...:00 accesses the bad site. I go to my switches and look for MAC 00:00:...:00 I can see which port it used. Since the ports are correctly mapped from the switch, to the panel, to the room I know where MAC 00:00:...:00 is.

3.That basically is my (and my consultants') plan. GATEWAY be 172.0.1.X ADMIN will be 172.0.10.X DORM (s) are 172.0.20.X and 172.0.30.X switches are programmed to put everything into the gateway, but keep out the other subnet traffic (DORM can't go to ADMIN). The gateway contains the web/ftp/mail servers, content filter and what not.

Here is a couple of hardware options that do what you ask.

http://www.impulse.com/
http://www.bradfordnetworks.com/

Both of these are supposed to allow you to know who did what and kepp a log. You can also block access to anyone from a centralized location.

You should stick with AD and, if budget permits, try the 15 day version of Websense. It can get pricy, but it's a solid product and you can lock down many, many filters per group - sort of like AD in a sense. I have utilized it in the past with really good results. Users WILL need to join domain though. Sorry I couldn't be more helpful.

George Boyce
LIS Support
Stony Brook University Hospital
Stony Brook, NY

I am Network Admin in a Christian School. We had pretty basic internet filtering but eventually decided the best solution was a GetBusi proxy server.

It updates its users from AD every night, allows you to map AD user groups to proxy server groups, set poliies for each group, filters about 12 different types of undesirable content by reference to an externally maintained data base, allows you to add your own black and white lists, can filter file types, allocate quotas and bandwidth, print reports of attempted abuse, block offenders for set periods. A brilliant package.

Why would you ever want to not use AD as your base for identifying users. If they are accessing internet via your network, you are responsible to be able to identify them. So why not do so by allocating username and passwords in AD

whatever you decide to do/use/employ, run it past your legal department first, before doing anything.

I only point this out for one main reason. Here in the UK, I could not bring someone up on disciplinary action unless there was proof positive that the infractor was that specific person.

Under our laws, to bring a disciplinary action or to go to industrial/employment tribunal or bring criminal proceedings, I must first provide evidence not only to the piece of equipment used in the infraction, but [b] definitively [/b] the user. This can only be done with log on evidence. You may want to check with your legal deparment in case their is an equivalent law where you are.

Other points:

Have you defined "questionable/unacceptable/objectionable content" to your users? I ask because having done IS Investigations for eight years, it is noticable that what is questionable for one person may be totally hilarious to another. They need a definition specified within the IS policy that they can use as a "rule of thumb" if you will. I have even gone so far as to give a definition of pornography which is used throughout my workplace as to what we will and will not allow, both in text, image or any other descriptive format. They need to know the limit so they can stay within it.

If I were you, I'd also get that definition laminated and posted up in the dorm rooms, too, so they have a constant reminder. Not only that there is a limit, but it will also remind them that they are being monitored.

If this is a new roll out, you may also want to write an acceptable use policy with regard to both internet access and email, so they understand what acceptable use is - that way you can define whether they can download music, files etc. while defining unacceptable use (visiting virus/kiddyscript sites etc.) You can also use the roll out of the acceptable use policy to make them sign an acceptance form, which can be appended to their personal school files.

Password policy - what do you mean by simple? Do you have one now? Do they adhere to it? If not, why not? Is it too easy to bypass, or too complicated to comply with? If you're letting them on the internet from dorm rooms, the same legal questions apply - therefore under no circumstances should they be sharing passwords and/or log ons.

Finally, and sorry for "soap-boxing" all this, if you do have an infraction of policy or an internet security event, do you have people in place to investigate? Are they trained? Do they know how to collect and maintain the chain of digital evidence? All this is needed if you want/need to invoke other procedures, such as disciplinary action/criminal proceeding etc.

Sorry to prattle on, but you're heading into a minefield and you need all the info you can get, as well as all the ways to CYA!

GG

Edited: typo

I think point C in your list is unrealistic; what happens if student "A" lends his/her PC to student "B"? Or if student "C" brings in daddy's laptop and plugs it in? Or someone replaces their network card and doesn't tell you? Get yourself a Proxy Server that requires you to authenticate first, then you can track usage without any worries.

Back this up with a clearly written policy that states User ID's MUST NOT be divulged and that any activity conducted with a User ID will be the responsibility of the person who is the custodian of it (This sort of policy tends to focus the mind!)

We use Symantec Web Security here - you can subscribe to lists and block varying categories; you can create your own too. It has the further luxury of creating various groups with differing levels of access; for instance you can allow certain people to access banking sites and conduct on-line shopping, but not others. You don't have to integrate it with AD - you can create local users in the application. You can also get it to email you content violations, so you don't need to actively produce reports day in day out; just see who generates a lot of content violation emails and then perform some reporting on that user.

Well, many have stated that you should use AD, and while they
all have great points I am going to stick with your desire of no
AD.

As has been mentioned, the MAC is the key here. Just like a
Cable ISP does, simple require signup fpr internet. The signup
process requires a signed Internet Usage Policy and a MAC
Address. Then using the MAC you setup a DHCP reservation. No
ip's go out other than through reservation. Now from the logs
you can tell instantly which ip which is directly tied to which
computer. No Muss, No Fuss. Someone violates the policy and
the reservation is pulled.

OK, Now the down side. These are college students. They will
setup a consumer router using NAT, spoof a valid mac and get
an ip. Then they will setup multiple hosts, xboxes etc running
behind the router. Now that router could be moved room to
room or worse be wireless and the whole floor could be going
through the same ip. So, routers must be mentioned in the
policy and you must check for them using wireless scans etc.

First off, I'd say you have two conflicting requirements:
1) Positive Identification.
2) Annonymous (No login) Access.
These are mutually exclusive. If the intent is to be able to Absolutely (legally) identify an abuser, then you MUST lock down access to positively identified users. Userids and passwords. If a user shares their password, then it's upon their head if the userid is involved with abuse.
Keep in mind that this information may be used to discipline or possibly expel a student, so you'd better have more information than "Someone in the room turned on a computer and used it."
I'm afraid you're stuck with maintaining userids and passwords, no two ways about it. A student's innocence or guilt depends upon it.
The userid belongs to the user, regardless of what hardware or what location.
Unless you want biometric access requirements! :-)

... to the wireless network that runs in the dorms, set up a student OU, enforce a strong password policy (they change every quarter, semester, whatever) and use restrictive group policies.

Set up websense or some such with really tight permissions (let the kids who need to research breast cancer awareness ASK for permission, for instance).

Shut off ALL P-2-P with group policy. use MAC filtering to keep the rogue router off the network.

That will do for a start. Review at winter break to see what tune-ups you need.

Tracing back inappropriate connections to individuals is all well and good, but step back a little here and address the real concern of the college: To prevent their students from accessing inappropriate sites, and to know that they are being monitored for violations of that policy.

A signed pledge acknowledging monitoring and stating the student will not visit such sites is next to worthless, but it does provide a legalistic pretext for whatever disciplinary measures the college decides to mete out. Obviously they don't want to just expel the miscreant, as this would reduce the college's revenue.

Aside from tracing DHCP connections to MAC addresses, keyloggers on all student machines would be an excellent way to preserve a record of any and all transgressions, present as well as future, and allow the administration to track and deal with suspected violators with a degree of certainty other solutions do not provide.

This solution could also be used in conjunction with a codicil in the student Internet access agreement -- secret, of course -- that would require any student caught in violation to provide the college with the names of other students known to be violating the policy. This could serve as a check on the internal networking of students visiting forbidden sites, as well as provide the college with its own counter-network of student contacts with a vested interest in preventing others from visiting illicit sites. Or at least exposing others who do.

Alternatively, the student could be publicly identified as being in violation, or required to spend a certain number of hours in Internet re-education classes witnessing to other students in possible danger of violation of the consequences of their unauthorized visits. Combined with group confession and prayer, these non-technical adjuncts to monitoring could have the desired effect of enjoining compliance to the college's policy without any additional expenditure by the college.

Your administration, I think, would welcome the use of non-technical counterincentives to visiting unauthorized sites, especially as they lay the groundwork for a lifetime of self-monitoring and careful exclusion of information that is morally, politically, or religiously questionable. Which is, I think, the ultimate aim of your institution overall.

Your college will welcome the opportunity to embrace the future by means of self-censorship and mutual monitoring in addition to actual tracing of connections and identification of the inappropriate viewer. These procedures already work well for the Chinese.

Use RADIUS and RADIUS accounting, using PPPOE. This way, all the students will have a login without resorting to AD, and the RADIUS accounting will track which IP address the login get's assigned, so even when the DHCP changes, all is good. Or you can use a 100% PPPOE solution, still using RADIUS, so they don't even get an IP Address until they have authenticated, nice way to prevent bypassing. Then, use MonoWall, SmoothWall, Squid, or any other nice GNU tool to track IP Traffic, so even if they try to spoof the port, it will still get caught, or just do a packet-level trace on the HTTP requests and even if they go through an outside proxy, the origional domain name will sstill be intact. There's soo many ways of doing it, jsut depends on budget, and how much of a "Big Brother" you want to be.

Cheers

Remember, a tech-savy user may be able to change their MAC address, either through Windows or a 3rd Party utility.

Just a word of caution, it can easily be done.

You are soon going to join a war that many of us have been fighting for years. Eight years ago I was charged with a task very similar to years in scope (two hundred dorm ports the first year plus labs and library, all the old dorms the second year) also for a small Bible college. Most of what has been talked about above has happen here at one time or another. A study of evengelicals has shown that nearly 30 percent of active pastors have a problem with internet porn (the numbers have not changed in twenty years, a survey in the mid 1980's reported similar numbers with printed porn). I mention this only to show that you should expect a similar number of your faculty, administration and students to have a problem. Yes, faculty - proven, administrator - suspected, not proven because he refused to turn over equipment for inspection and was in a position to get by with this. There for you should expect that you will have preditors in the dorms looking for computers that are left on and logged in (all you can do is nag nag nag turn off your pc turn off your pc log off log off password protect your start up dont't give out your password LOG OFF and TURN IT OFF). Guys able to prove they were at work by their time sheet yet the PC was in use.

I started out telling everyone we were going to log everyplace they went. Some didn't care. Ten percent of the private PC's on campus were used to view porn the first year. We installed surfcontrol and tried their pass by filter and found that under heavy use it would allow first contact to get through. This was exploited. We now use a barracude box to do spyware and content filtering and use the surfcontrol to do pass by filtering. Why two? Together they are good. By themselves too much gets by (I like the Surf Control filter for quality, it identifies what the Barricuda misses). Then along blogs. Neither filters blog content well unless you block all blogs. Administration runs their own blogs so they like the idea of blogs and want them open. We have even had people do searches and go to the filter web site to test search returns to see if they will be blocked.

Now we are becoming a wireless campus and that opens a whole new can of worms, spyware and wiruses. Response here is Blue Socket ldaped to Novell EDir for ID and passwords (If you have ever used Edir for user management you will know why I didn't say AD). Don't forget guests and users of Mac's.

And every year you must update your user agreement for new treats and software that students will use to tear out your bandwidth. One student with P2P can hog your whole bandwith. ESPN motion downloading while they are in class and the Admin can't access their favorite comic strip will sure bring the heat. No money for band width so we must do something creative like by a packateer off of ebay and try to control that precious bandwidth. At the fire wall declare all avi, mp3, mpeg, flv as viruses and shut them down.

But none of this will do a bit of good if they bring 300 gig if video files and photos onto campus the first day of registration, or after Christmas break or Thanksgiving or from the local coffee house down town or the neighbor who's boosted unsecure wireless leakes into the boys dorm.

It's the middle of summer and this soldier is tired (I Corp, Republic of Vietnam 68-69). But we shall not quit, we are victorious and we will not leave anyone behind.

It is the goal of this institution to train servants of the living God. We must filter. We must log. We must check machines (who at your college is going to do that? Will logs be sufficient or must the temp files on the PC be checked to verify activity that by passed the filter {don't forget the students also know how to use secure proxies to by pass your filter}). In the past any machine that was suspected of containg porn was verified by physical review. We have even had students try to recover files we deleted so we went had to start using eraser programs.

Our student handbook declares inapropriate computer use is a major offense which in all other cases leades to dismissal from school. But in seven years the worst punishment was to close their port.

We have kept everything silent and behind the dean's doors. I wonder if the suggestion above "to be more public" might produce more repentance.

You will find the problem exists with followers, leaders, and the withdrawn (by the way if you ever find a student has built a cave around his PC or placed it in a place that her {yes! her, amuch lower percentage but still a concern more for chat and date rooms but occasionaly visual stimulation} be diligent and keep an eye on that one.

What to do? Have good policies, good documentation, good usage agreements, good hardware, good filters, good plans, and an administration that wants more than to just hide a problem. You also need dedicated people who will fight the evil that wants to destroy your students. This is a good fight, rejoice and stick by your post.

Ok, so I've had several arguments for using logins, and I can see this will be required. This really was the plan all along, I wanted to see if anyone could figure out a way that would be easy, and meet my so called requirements in my first post. By giving you all a challenge, I succeeded in proving that there is no good way it can be done.

Now then, how about ideas other than AD that allow this to work. The dorms are wired. That is set in stone. No Wifi (yet). Also since the Admin side of the network is safe (VLAN'd) from the Student side of the network, I don't really care if they want to play their silly network computer games (In fact I'll join them!)

**URGH!*** Update. That's right my dang $6000 iPrisim uses AD logins to track stuff...Ok so how can I use AD and do something as described in Steve's post "My College Experience"

Steve describes in his post "My College Experience" that his college used a simple login the first time he used the computer on the network. (Go read that post)

Now we don't have plans to provide our students with email addresses at this point, but I would like a system similar to this. Let's have more posts on this sort of option.

Plug in the computer/laptop, login once and *boom!* network connectivity.

Traffic bound for the outside world is going to run through a St. Bernard software iPrisim device, which allows for the filtering of web content and other junk like p2p.

Our policy is already going to ban students from using their own routers, especially WiFi equipment.

**URGH!*** Update. That's right my dang $6000 iPrisim uses AD logins to track stuff...Ok so how can I use AD and do something as described in Steve's post "My College Experience"

Your magical solution would be to have them log into an outgoing firewall that will keep their login name, mac address, and IP address in the log as well as where they go and what they do.

Of course, this would mean that you are perceiving a problem and are attempting censorship. One of the other problems that you are going to face in a college setting is that they are there to learn. What happens if someone is doing a study of pornography on college students for their doctorate? It may be that what you are attempting to do is to block certiain P2P sharing networks like Limewire or something of that nature, but you wind up driving the college student to the bookstore.

They had an interestin garticle in a paper about that, with schools anyway.

First of all they suggest that even though YOU teach our kid safe internet useage, you also need to see that the schools do too.

There are two options when working with kids and computers.

1) ALWAYS ALWAYS ALWAYS supervise every kids use without relying on keyloggers, trackers etc. YOU need to sit and ework wit hthem to ensure they are getting someonething out of it.

2) Use child proof portals, such as those Kid Zones type browsers and apps you can utilize. And EVEN THEN, sit with the kid and turn surfing into a creative experience where the child can learn and gain from computing, even if in a chat room format.

Anything short of that is irresponsibly allowing kids to use the internet unsupervised. Most kids are nto allowed to go to movies alone aymore, or go out to the mall after dinner. But when it comes to computing, the most dangerous place for kids to be, nobody spends any time monitoring kids and they expect software babysitters indstead.

Since this thread was sort of deticated to a single idea, that of getting proof that the idea of tracking computers by only using a MAC address was incredibly hard and stupid, and not really what I wanted in the first place, I've started a new thread with more information.

Please see the new thread.

...just use a different NIC. If you require your users to register their MACs and then restrict access to that list, they're out of luck. But if you get that restrictive you have already headed down the path to the dark side. Might as well tag and release your users at that point.
I was in a similar situation at my last position. I was a sysadmin for a Christian high school. My approach: we had an internet-nazi librarian who covertly called me every time the students got worked up while on the computers. I'd remotely connect and view what was going on. Then I'd come down, talk to them, and then take away their gold star. Little perverted punks... =)