Internet Access at your Local Libaries? 35
gettingOnline asks: "I work for a library that will soon offer public access to our network. You come in with your network ready portable computer, change your config to use DHCP, plug in, and you have T1 access to the net. Other libraries are offering this service already, and there's no doubt we will offer it, no matter what the security issues are. What I want to know from all of the network gurus out there is what we can do, short of creating a separate network, to minimize risk without limiting internet access."
you need accountability (Score:1)
Accountability will protect you from all kinds of legal hassle.
Re:you need accountability (Score:1)
The next day, 8am, the Secret Service showed up. They knew exactly which computer, what time, and which student.
. So much for anonymous connections.
Create a seperate network (Score:4, Interesting)
Any solution short of creating a seperate network is really asknig for trouble. It's notmuch trouble or money to segment your network into a "private" ethernet for the librarians' servers and workstations, and a "public" ethernet for random laptops. Fence it up with an OpenBSD or Linux router/firewall box with a few ethernet cards in it and you're done (Linux is more multi-purpose and easier for most - OpenBSD is considerably more rock-solid-secure for a firewall-only box, IMHO).
Re:Create a seperate network (Score:2)
i can hear the kiddies whining about privacy now. i know, i know. but come on fFolks. it's a public access point. You sort of expect to give up some privacy in that case. If you want anonymity, buy it yourself.
Lan Parties? (Score:4, Interesting)
Personally I would define the 'internet' as too broad to give access to, you would be better off running a proxy for limited 'www access', and creating logins for everyone based on their library card info/etc..
Re:Lan Parties? (Score:2)
Of course, with the new cybersnooping laws looming everywhere in response to the massive armies of terrorist/cracker/Taliban that failed to appear, perhaps that's too much to ask for.
Re:Lan Parties? (Score:2)
oh, not at fFirst. when the system is new, and the ports are bright and shiny, they will stand out in the middle of the room with a proud librarian hovering over them.
but at some point, the new will wear off. and "that kid who comes in fFor a while" will become "a couple kids who waste the whole afternoon here." and the ports will get moved to a corner, thus encouraging the kids to spend the whole dern day there, while the librarian stews at the desk.
ok, i got a little carried away.
but like, what such a system really needs is a method of checks and balances. time limits fFor example. just as a book may be checked out, use of a port would be checked out on a library card.
additionally, a set of clear rules would need to be installed. fFor example, NO PORN (you mooks). i know, covering this becomes very tricky. like what if the librarian decides any gay content is akin to porn? and we all know babysitter software doesnt work.
Re:Lan Parties? (Score:1)
I'm making a joke, right? Been to a big downtown library lately?
Responsible Users (Score:1)
of course it's not too hard to forge a library card. so i guess their s.o.l.
Re:Responsible Users (Score:1)
limit risk ... of what? (Score:2)
What do you want to limit the risk of, exactly?
Re:limit risk ... of what? (Score:2)
when you allow someone onto your network, it's like letting them lounge in your living room. they could very easily take paperweights and drop things on the carpet. or to be a bit more precise in this case at hand, a person may be inclined to alter official library records. this is something which could be done easy enough anyway, but with a person bringing their own laptop to the location, fFilled with whatever may be held therein, you are really opening the door fFor viruses and crackers.
Re:limit risk ... of what? (Score:2)
In fact, I believe the newer linksys routers can actually be enabled so that they check new systems to make sure they have zonealarm installed... maybe you could use that.
start with your library cards? (Score:5, Insightful)
I've seen systems that when you try your first connection using DHCP, you need to input a username and password... often used in new highrise apt complexes that come with broadband.
make the user put in their library card name and number. hell, it's very little information for providing them with broadband access, right?
but I think this might also help when budget time rolls around and the state/county/etc asks you to justify your cost. you then show them usage stats and show how it is a desired service.
I also see lots of other marketing benefits, but it'll take too long to go into them.
Policy first, technology second (Score:4, Interesting)
Some potential problems:
Unlimited and unlogged access?? What a great place for spammers, crackers and such to get net access.
Everyone on the same subnet (w/o router restrictions)?? Everyone with open Windoze shares will be vulnerable while logged in.
Log all access?? You may run afoul of privacy concerns and laws.
If you only intend to provide http(s) and ftp you might consider putting users behing a Squid proxy to improve speed and help limit access (not a substitute for firewalling, though).
I would in any case make sure that the IP (or even entire connection) you use is separate from your administrative connection so if something bad happens (you provided full access and got blacklisted for spam for instance), your administrative functions will not be impaired.
Install a ... (Score:1)
Accountability (Score:1)
A) Johnny (a minor) and his parents sign an user agreement saying he will do what he is supposed to, etc, etc. He accesses his favorite BSDM site from the library. His parents sue the library. Case is voided, bc Johnny, ergo his parents, violated the library's EULA.
B) Johnny walks in and uses the Wayback machine to get past the firewall that was set up. Johnny's parents sure bc Johnny used the library to 'harm himself' the library then has to pay Johnnies parents, etc.
Accountability is not the answer. PERCIEVED accountability is. Don't monitor anyone, but if they are found to be doing something innapropriate for their age, or illegal, then they lose their right to use the network. Defining innapropriate is a chore, but we gotta love that phrase: "contemporary community standards"
Re:Accountability (Score:2)
BSDM? Berkeley Software Distribution Masochist?
Uh (Score:1, Informative)
Your firewall should also only allow outbound port 80, 443, and maybe 22, unless you want people to be able to send mail, in which case you'll also be allowing them to send spam, and you'll be risking having your libary's IPs blackholed. Personally for this type of setup I wouldn't allow port 25. If they really need to check mail they can use hotmail or one of the other myriad webmail systems. Web, SSH, and https are really the only reasonably safe services to allow.
Make them "kind of" separate (Score:1)
What you need is a firewall with multiple interfaces. You could go commercial and buy something like a Watchguard Firebox [watchguard.com] or set up a cheap linux box and use a pre-packaged linux firewall like IPCop [ipcop.org] or SmoothWall [smoothwall.org] where you just boot off a cd and install/configure a Linux firewall.
What you end up setting up is a DMZ. You would have a "Trusted" interface that could be your private library network, a DMZ interface that could be your public access network, and an external interface that is your connection to the Internet.
You could set up the IPs as 192.168.0.0/24 for the trusted, 192.168.100/24 for the DMZ, and use your external ip segment for the external. You still can use all of the same network hardware that you have in place.
Hope this helps.
My opinion (Score:3, Informative)
Whether or not you'd consider this a 'separate network' is really up to you. However, it may be that you can't do this, for technical or political (or economical) reasons. Having worked as a network admin for a small library, I understand that there a well-considered hesitance to embrace yet another chunk of technology that only one employee (and, at that,a highly mobile and long-term-unpredictable one) understands. Essentially, you want something that's drop-dead stupid to administer, so that (if, for any reason, you leave) some poor high-school schmuck who just happens to be the kid of one of the librarians stands at least even odds of being able to get it going again.
So instead, you could do something like only assign IPs within a certain 'redlisted' range, such that the important computers on the network can run some cheap-ass firewall freeware to block from those IPs. Such a solution doesn't protect everyone, but it's really fast and easy.
Alternately, you could always buy one of those $60 firewall/routers between the rest of the library's computers and the Internet, and then put the newcomers outside said firewall. Such boxes are easy to administer, and come with nice glossy manuals. Set it up like this:
[T1]
|
|
[Hub for Anonymous Users]
|
[Firewall/Router]
|
{all the other computers}
However, in this scenario, you'll need to make sure that the firewall appliance is (a) able to handle a simple 100BaseTX connection (not just, say, PPPoE) and has sufficiently full NAT support that dhcpd could still be heard from behind it. (Either this last, or ensure that dhcpd is upstream, near (or on) the T1 gateway).
This option also has the downside of forcing NAT upon all the rest of the library's computers, which (depending on how things are set up) could be a big pain in the ass, or break your network altogether. Caveat Emptor.
Re:My opinion (Score:1)
Comment removed (Score:3, Interesting)
ACK! NO! (Score:1)
ACK! NO!
ICMP is a _required_ part of the TCP/IP stack. At a bare minimum, it's used to let the clients know that a remote service or network is unavailable, instead of making them wait for a timeout. Blocking inbound "Fragmentation needed but DF set" packets will also cause an admin nothing but headaches when the path MTU gets smaller than what's set in the client.
Maybe (MAYBE) you disable inbound ICMP Echo_request (to stop some script kiddies from portscanning you) or redirects from non-local addresses, but stopping inbound ICMP is a sure way to cause yourself headaches. It won't "make your router look dead to the world," but it will cause problems for legitimate users.
Proxies, firewalls, pron, oh, my! (Score:1)
To all the slashdotters who keep talking about proxies and firewalls:
This person wants to give out unfettered internet access without endangering the libraries local network. They obviously don't care about whether little johnny looks at pron or somebody uses it for spam or whatnot. It is not the duty of the library to protect people from the internet or vice-versa. That is all.
Put a linux box in there (Score:1)
Have it give ONLY port 80 traffic. Put the box between the internet connection and the public switch/hub
OR, just get a little firewall/internet appliance.
If you do it the linux way, you can get your company to buy the latest boxed 'pro' linux distro for you, along with a book
PPPoE (Score:1)
Use a linux box running PPPoE(PPP over Ehternet) that way you can track who was using what ip at what time. www.roaringpenguin.com [roaringpenguin.com] has a commerial solution if you want to go that way, but you can do all the stuff your self.
Re:PPPoE (Score:2)
That seems like a pretty user-hostile approach. Most of the people (those not running OSX or XP) would have to install big bad software just to talk to the network. Who wants to do that, and who wants to put people through it, when there are so many other better solutions available?
VLANs, DHCP, and Router... Oh My (Score:1)
A single Catalyst 2924XL with say half its ports tosed into a different VLAN than your regular network , and your router understanding the new addresses is all you need.
For DHCP, just set the Catalyst to relay the DHCP request to the server. You will have to add an apropriet range to serve of course.
Very simple, and in most cases do not have to spend any additional money as most places will already have either Cisco or Nortel switches that are capable of running a VLAN.
If you need to purchase one, Cisco Catalyst 2924XL switches can be had for at most $2000 which is inside most libraries budgets.
Acceptable Use Policy (Score:2)
There are all sorts of Internet throttling software solutions out there you might want to check into. With some you can put weighted percentages/priorities on certain types of traffic.
Be sure to segment the network properly. Put everything important on a separate subnet. In fact, even better if you can PHYSICALLY segment it completely! Maybe buy a separate DSL line to be used for these library visitors (something I'd really push for). Then create a separate LAN that is not connected to anything important on the other side.
If you are really paranoid... (Score:1)
FreeBSD can do this, you can find it here [bsdshell.net]. It's part of the high uptime project.
Futhermore, I would suggest a firewall setup which blocks about anything but HTTP and possibly FTP. A proxy server may be your best option for this.
Good luck!