DAMN MY LIFE writes "I'm going to Central Michigan University in the fall. Upon examination of their poorly organized networkusagepolicies, I'm worried that using their internet service will expose my web browsing habits, emails, and most importantly, passwords. Another concern I have is the 'Client Security Agent' that students are required to install and leave on their systems to use the network. Through this application, the IT department scans everyone's computer for what they claim are network security purposes. Of course, scanning a person's hard drive can turn up all kinds of things that are personal. Do all colleges have such extreme measures in place? Is there any way that I can avoid this? There are no wireless broadband providers available in the area, I already checked."
by Anonymous Coward
on Saturday June 06, @02:15PM (#28235349)
Set up a VPN server using OpenVPN on a remote site and then run the OpenVPN client on your PC. All traffic will then be encrypted on the college network.
Using a virtual machine and TrueCrypt can also save you from additional headaches.
This assumes that you at least have sufficient rights on the client PC.
Or just give them a full-blown VM with an installation of XP and nothing else. Set up the physical network interface so that only the VM uses it, and use virtual interfaces to route from the host OS to the VM and then out to the network. You can run a NAT firewall (XP's connection sharing might be good enough) on the VM.
If you are feeling ultra-paranoid you could install typical applications in there too, like MS Office, etc. So if they look at everything on the VM it will look like a regular college-kid computer, but unless they are really smart they will never know that the "real" computer is just using the VM to NAT out to their network.
1. Find out what ports they connect to the program on.
2. Have a NAT from a simply wireless swtich or whatever... install dd-wrt if you like.
3. Set up Your machine, and install vmware player, virtualbox, whatever.
4. Have the VM running windows 98 (or whatever) that's lightweight, and just has their program.
5. Have the NAT port forward connections on the trojan's ports to the VM machine.
6. You get to surf clean, they get to see a clean VM you run.
I'd also recommend you using lots of SSL;)
Also... you could ask that a waiver be possible for other operating systems... considering that there is no option for them, it seems unreasonable that no other OS is allowed on the network... but I would ask the dean about that, and not go straight to the IT people... they are probably morons.
Government: "Here are subsidies for schools, and for student loans!"
College A: "Hmm, look, money! We could build some spiffy new facilities that'll look good on the tour, and attract a slightly richer set of people!"
College B: "Hmm, look, money! Good thing, too, because otherwise we couldn't keep up with College A and C. We need nicer stuff to attract the same students. And besides, what university administration doesn't like spiffy-looking new facilities?"
People: "College is still soo expensive!!"
Throwing money at colleges in the US may produce a variety of desirable effects. However, "cheaper college education for all" is not necessarily among them. Universities are experts at price discrimination (the art of charging someone as much as you can get away with). They even have you fill out forms ("financial aid") so they can figure out exactly how much to charge you!
Perhaps something a little less extreme would be helpful, such as move off campus. The college can only dictate what you must install while you use their networks on campus.
I work in the IT department of a college. We started implementing more network security after blaster and welchia on student machines brought down the entire campus network. We segregated the dorm to a different physical network from the academic network. We bought antivirus for every student so they would no longer have a reason not to have it. Turned off cross talk between ports on the student side so they wouldn't infect each other over the network. On the Academic side we do require Cisco Clean Access agent to use the campus wireless to access intranet resources. It checks to see if Antivirus is installed and relatively up to date. It also checks for OS security patches. If you don't want to install the Clean Access agent, you don't have to. We provide guest access for those that don't. They however have access to no intranet resources and are limited to 256k. We don't scan for files, we don't do key logging. The only way I see illegal filesharing is when they are on the same subnet as me and I happen to have Itunes open. Limewire, Frostwire and several other leet virus vectors that students run use multicast dns (bon jour) to broadcast "susie jo's limewire tunes" which shows up under shared in Itunes. Only when an idiot insists upon broadcasting and sticking this in my face do I open a multicast dns browser to get the IP. I then go into the Cisco Clean Access Manager to see who has that ip address (Cisco is tied into our directory services.) I then go to their Facebook profile which is always wide open and call the cell number they have posted there publicly and politely request they discontinue the activity pursuant to the campus network policy as published in the student handbook. In the very rare circumstance they actually were smart enough to not leave Facebook open to the world I send them a polite email.
Run Linux. That's the answer. The silly Windows agent won't run on it, and your files can even be protected through filesystem encryption, and safe from magically being shared with spyware writers, botnet managers, and spam sources.
Yep and you could run windows in a virtual machine with NAT setup and the client installed. That way, they'd get to scan "your machine" but wouldn't be able to access anything on the Linux side.
x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.
We all know Theo de Raadt is an ass. While what he says is factually correct, it also completely misses the nature of most security situations. 99% of the security out there is of a casual nature. Most of us are not working for the NSA or DoD, so we are not likely to be specifically targeted. If you are a target singled out, yes, Theo's point is valid: a determined attacker will find a way through because the second and third layers are not any better built than the first. That's not the security situation most of us face, though. For the most part we only need to make our information a degree more difficult to get at than everyone else's. A virtual machine will do that. So will running Linux. As would running OSX, though to a lesser degree. Now, if everyone were running virtual machines, he'd have a valid point because the low hanging fruit would be the virtual machine. But since VMs are a novelty to most, they're unlikely to be targeted, which makes Theo's rant just more of his usual hot gas.
Or you could do the exact same thing with Windows if you don't run programs willy nilly and use a more secure (or at least, minority market share) browser.
And you could use filesystem encryption and run the Client Security Agent under a low-privilege account, which you could make not capable of seeing certain folders on your hard drive. Just make it able to scan a couple token Program Files folders, its own folder in %appdata%, and %windir% and you'll probably be fine.
Dealing with idiotic, forced software is a pain no matter what your OS is.
Last time I experienced this sort of stupidity, the program was a proxy/filter, and the solution to Linux was 'Windows/Macs only on campus.' Best of luck.
My university(Ohio State), tried implementing similar policies last year. They rolled it out to some portion of the student population and said at the forefront that anyone running Mac or Linux was exempt.
Turns out, a couple weeks in and they completely dropped the policy.
On a related note: Some how, when you connect to the residential network, they can detect some botnet signatures on your machine and will deny you access. Your mac address is blacklisted until you reformat. It runs some utility to make sure you actually have reinstalled before they restore your access.
My university(Ohio State), tried implementing similar policies last year. They rolled it out to some portion of the student population and said at the forefront that anyone running Mac or Linux was exempt.
As an IT employee at Ohio State, I can assure you that there is more of this in the pipeline since it's mandated by the Board of Trustees.
I can't see comparing what is going on at OSU with what the OP reports at CMU -- Ohio State's efforts to lock down the network and restricted data are quite comprehensive [osu.edu] and IT staff, like you, are concerned that it's done properly. Mac/Linux support is on the way -- most vendors do not support it so it's quite difficult for the University to support it. The scanners they run on your computer are not there to look at your personal files, track down copyright infringement, or anything else you might be worried about -- they simply look for OS/software patches and run an anti-virus/malware scan. If you don't run the scan with the agent, you will not have any network access. If you take some of the suggestions here and bypass the security agent, you are violating the AUP [osu.edu] and, if caught, could face academic misconduct charges.
I can assure you that the University's IT office is underfunded enough that even if they wanted to go out of their way to scan your computer for anything else (they do not), they would not be able to.
On a related note: Some how, when you connect to the residential network, they can detect some botnet signatures on your machine and will deny you access. Your mac address is blacklisted until you reformat. It runs some utility to make sure you actually have reinstalled before they restore your access.
This isn't magic -- they run typical network vulnerability scanners [nessus.org] and block you if a virus or bot responds from your IP. DHCP and switch info tells them your mac address.
by Anonymous Coward
on Saturday June 06, @01:36PM (#28234887)
If they want you to install the client security agent, fine - install it in a VM under VMWare or VirtualBox. Either that, or make sure you have a firewall running and explicitly deny any traffic out from it.
Do all colleges have such extreme measures in place?
No, mine doesn't. Technically we just have to have antivirus software installed, and keep up with MS's security patches, and they really don't ever even check for those.
One of my college roommates was responsible for the dorm networks; they definitely had policies that pissed people off (usually the people who were abusing the network the most), but it was done so that the limited resources were usable by everybody. Among them:
P2P traffic was capped at 50% of total bandwidth.
There was a rolling monthly bandwidth cap. Exceed it, and you were capped at 56k modem speeds for about a week until you were under the cap again. (On-campus traffic was not counted, and not limited; many large downloads such as linux distros were mirrored on-campus.)
If you picked up a virus, you were isolated from the network. The only thing you could get to was windowsupdate.com, until you removed the virus and called the helpdesk to promise you had an antivirus installed.
My college doesn't require us to install anything to access the network. Of course that's mainly for two reasons:
1. If you're going to Harvey Mudd, you probably have mastered the basics and possibly several of the upper reaches of computer and internet security and those who haven't usually learn fast from their peers that do.
2. Honor Code. This is actually one of the basic tenets of Mudd, not just of computer usage, and it basically means "Use common sense and when that fails report yourself." It sounds crazy I know. You'd think it'd cause a breakdown of justice and total anarchy because no one would obey the rules which might very well happen on many larger campuses. But when you consider the kind of people that attend Mudd and its small size, it actually works darn well. Hell, it's worked for over 50 years and Mudd still turns out incredibly bright students either in spite of or because of the Honor Code depending on your view point. People actually do report themselves when they cause problems and there is a student run judiciary board for those who don't which runs quite efficiently. All in all, the policy causes less stress and anxiety for both the administration and the students than invasive strategies like the one described in the article.
Dude, I don't know what to say, that's insane. The only suggestion I have is to either not use the Internet on your personal computer or find another university to go to. sigh... Looks like along with all the other stuff that determines what school a kid goes to, we're going to have to add "how screwed up is your Internet access policy?" to the list.
Stupid question, what if your machine is a Mac or Linux box? This "Client Security Agent" seems to be a Windows-only beast. Whatever it is, it would be a cold day in hell before I let a university that I'm paying money to dictate that I have to have their software on my machine to use the Internet access that my tuition and fees are paying for!
Looks to me like a clear-cut case of some overzealous IT goob forgotting who is paying whose salary. I'm not saying that you're the Chairman of the Board, but you most certainly should expect to have the right to have full access to this academic resource without this kind of burden.
As a practical matter, you could just call up their IT department and tell them that you have a Linux box, even if you have Windows, and that your machine doesn't run their "Client Security Agent." Whatever they tell you to do to get on the network, just do that on your Windows machine and be done with it. If they tell you that it can't be done, seriously. Go somewhere else. If this university is that stupid, you shouldn't particularly want a diploma from there anyway.
If you do call them up and ask about Macs and Linux machines, let us know what they say.
I'm a tech support (ResNet, CMU has it too) at a different university that has a similar "Client Security Agent." I'm not sure who provides their CSA, but ours only checks for antivirus, antivirus updates, windows updates, and common P2P programs (usually limewire). If anyone fails these, they are instructed to uninstall limewire, update anti-virus, whatever, and rescan. We don't prosecute based off of any data, but it's more of a prevention system to avoid any DMCA notices.
That being said, this is for windows only. Mac and Linux are only single time scans (for what, I do not know), and after that your MAC is white listed with your ID. The beauty is that once registered, it's MAC specific, not OS. I should note that our provider is promising a Client Security Agent for Mac soon, but I doubt a Linux one is coming.
Poor decision. Once you register as windows, it'll check every 2 weeks for a CSA scan. If you install windows, register, then switch OS's, in two weeks it'll go "Hey! You're a windows box, where is your CSA?" and drop you off the network.
by Anonymous Coward
on Saturday June 06, @02:34PM (#28235567)
That's the polite reason they give for shitlisting Limewire.
The real reason tends to be that a number of the students manage to get themselves royally fucked with a wall of infections, not once, not twice, but over and over again until someone takes the computer from them, sets it up themselves, and put Limewire in a big ol' shitlist to keep them away from it again, usually.
This is one I'm not pulling out of my ass: When colleges take up classes, usually the first two weeks of that, I get calls from students who were doing things on Limewire, and have screwed up their systems. Two weeks before finals, I get another wave of Limewire-wielding students who have infected themselves. I recognize some of the students as ones I helped. Others, I see a track history of this on by looking at their cases. Granted, this trend is slowing down as they start catching on, having lost papers needed for finals a few times, but it still is there.
On an aside, I'm fairly sure most of these schools have an AUP for connecting to their network that you agreed to when you signed up. If they put it there, and you didn't like it... then why would you be there?
You seem to be confused. You are paying the school money for the ability to attend their classes. You are paying the school for the ability to use their network.
In no way do you have merit to dictate those terms. If you don't like it, then don't attend or try to convince them to change those terms. Either way, "Adults" should understand this is a contract, and you have very little negotiating power.
by Anonymous Coward
on Saturday June 06, @02:52PM (#28235745)
But again, it is my machine, and it is my money that is paying for that Internet connection. Accessing it is not a privilege that the university has graciously given to me for free, it is a paid-for service, and you'd better have a damn good reason for taking my money and then denying it to me. "You might get infected or break copyright law" is not a valid excuse.
Dude, your money only pays for a very small part of the school's network. Do you think they should let you piss in the university president's office because it is your penis, and it is your money that pays for that office? These measures are designed to prevent the school from getting sued and to prevent network users from spreading viruses to other users. It is their network, and they can require you to meet some basic security requirements if you want to use the network.
I'm not sure who provides their CSA, but ours only checks for antivirus, antivirus updates, windows updates, and common P2P programs (usually limewire).
So? I don't care if it makes your dorm room smell like a fresh spring breeze. If I don't want it, then you have no right to demand that I have it.
Actually...they do. Most Universities (like the one I work for) have an acceptable use policy. Agreement to the acceptable use policy is part of the school giving you permission to use THEIR network resources. You may have paid tuition, but the school's network does not belong to you. It belongs to the school, and if the school's policy says that you have to have a screensaver featuring fluffy bunnies in order to access their network then tough shit if you don't like fluffy bunnies.
If you were a private company, then maybe I can understand, it's your network, you have the right to set the rules.
Ok.
Even if you're a private university, though, I most certainly do not understand, because again, MY tuition and fees pay for that network, and Internet access is pretty much required to complete just about any degree these days. Deny it, and you might as well tell a student that he can't have any textbooks.
If you don't like it they can admit someone else.
Not to mention that it sounds like you've fallen into the same trap that the RIAA/MPAA has fallen into. "Because some people use Limewire for illegal purposes, since you have it installed, you must be using it for illegal purposes." Sorry bub, but the whole "guilty until proven innocent" thing doesn't fly very well with me.
I do agree with you here. At the university I'm at we don't do the "guilty until proven innocent" thing. We got a little more proactive and setup a layer 7 firewall on our network that blocks all P2P traffic. Of course there are ways around it via VPNs and proxies, but the installation of that firewall resulted in about a 60% reduction in our network resources and an overall speed increase for the entire campus (we have about 3000 employees and 25000 students).
If you have some reasonable suspicion based on tangible evidence that my machine is spewing out malware or otherwise violating policies designed to protect the university or its network, then by all means, shut off it's connection, show me what you've got, and we'll deal with it like adults.
We do this in addition to the Security agent scans checking for current anti-virus and Windows updates (Mac, Linux, and wi-fi based cell phones are automatically exempt).
I wouldn't want my machine, if infected, to convey malware any more than you do. If you want to make such a "Client Security Agent" available for me to use, then thanks, I'll consider it.
But again, it is my machine, and it is my money that is paying for that Internet connection.
Yep, and thank you for your money. It is being used to pay for OUR network and OUR Internet connection. If YOU want to use YOUR machine on OUR wireless network (that we have graciously provided you with - we don't have to give you an Internet connection) you'd damn well better install the security agent or you can wait in line to use a computer lab where some idiot making $9.00/hour from your tuition (thank you again) can watch everything you're doing on that computer.
Accessing it is not a privilege that the university has graciously given to me for free, it is a paid-for service, and you'd better have a damn good reason for taking my money and then denying it to me. "You might get infected or break copyright law" is not a valid excuse.
Actually it is a privilege you've been given for free even though you paid tuition and student fees. I can only speak for the institution where I am em
At least at my university (about 45K students), they get around the privilege vs. requirement thing by providing ample labs that anyone can use with all of the software that is necessary for your classes. As a result, access to a network connection from your dorm room IS considered a privilege and it CAN be revoked at any time since the university is still providing you with all of the resources you need in order to complete your classes. Granted, they may not be nearly as convenient, but they're what you need.
So, I would argue that they do, in fact, have every right to require it of you. You're using their network in a way that they don't have explicit control over, when they are providing you otherwise with the necessary resources for your classes. Sounds like a privilege to me, and if you want to use it, you need to play by their rules. Not that I personally like that idea, of course, but it's what I see as being the reality of the situation.
Also, at least at my school, the CSA came into place very shortly after one of those major worm outbreaks in 2002 or 2003. I remember hearing that around 95% of the network traffic was being generated by the worm, and that the entire university was basically suffering the effects of a DoS attack for the better part of a month since very few of the students' PCs were protected by proper AV and anti-malware software at that time. From then on, practicality alone dictated that they forced the students to install AV software and that they routinely ensure that it's still there.
Lying about your OS might not work. My university used a similar system and it definitely used OS fingerprinting techniques. I basically was dual-booting Windows and the BeOS and used Linux in a VM. In exact, one week intervals I'd be forced to log in (all outbound traffic blocked, DNS resolved everything to their internal HTTPS server, all HTTP was redirected to a captive portal page, screwing up caching of SSL certificates and DNS in the process of course). The page used the User Agent string to determine whether to show a log-in form or to merely insist you download "Cisco Clean Access". But, changing one's User Agent still didn't allow logging in, that's where the OS fingerprinting came into play.
That was the only part that used fingerprinting though. I found that I could log in from the BeOS or from Linux in a VM, so that's what I always did. Assuming the programmers behind that system are competent, I'd think they've patched that hole by now. People using Cisco Clean Access never saw that page, so I doubt they always got downloads and online games disconnected on weekly intervals. Anyway, I was using a heavily nLited and tweaked version of XP, so I knew it was secured (yes, I double checked with antivirus scans and blackhat tools every now and then), but Cisco Clean Access didn't (it apparently couldn't determine the patch status of some windows component I'd removed). I could log in with another OS and simply reboot to use Windows though. CCA was kinda a pain for normal users as well. My roommate came in with a decently updated Vista machine and basic computer usage skills (he could download and install software easily enough). I timed him, it took him six hours to clear all of CCA's requirements.
Oh, amusingly enough I complained about the system before it was fully implemented, asking about how they expected game consoles to log in, or how dual-boot users like myself would be affected. The IT person I talked to had no idea about dual-booters, but stated that game consoles weren't allowed on the network because they can't run an antivirus. After I pointed out that it's almost unheard of for such devices to be infected (and a few reasons why), he replied that he'd seen it happen in his personal experience, and provided a link of "such a case" (it was to a security bulletin for law enforcement saying that modded Xboxes might contain hacking tools). I kinda chuckled when I saw the system-wide e-mail a week after implementation saying that policy had been reversed, and that IT would whitelist game console MAC addresses upon request.
Build one of those "linux on a thumb drive" things and do your private stuff on that.
You might be able to get away with a dual boot system; their app on the windows partition and privacy on the linux partition.
We were required to have a "Cisco Clean Access Agent" installed on our machines. There were two options available for me, and I ended up going with the second.
1) The clean access agent only actually requires that you "authenticate" as clean to the network about once every two weeks. I installed a copy of Windows on a small partition at the end of my drive, put the clean access agent on it and authenticated myself. Whenever I was "cut off" from the network, I would reboot into the other (isolated) Windows partition (make sure your actual in-use partitions aren't mounted), do a scan to regain access and then reboot again. Worked reasonably well.
2) Because our network was so slow, I eventually decided that it wasn't worth the trouble. In the residence I was in the phones were provided by the local phone company and the cable was provided by the local cable company. It was a bit of a grey area regarding the policies in place in the residence, but I was able to have cable internet installed directly into my room. Perhaps you can do the same?
When I was at the University of SC in 2004, they required you to install the Cisco Clean Access software which checked to make sure you were running the school provided AV and had all your windows updates among other things. I hated the school AV (mcafee) because it constantly had false positives on items on my computer and would delete without prompting. It gave no option to quarantine, ignore, etc...just delete. I noticed that if you didn't have the Cisco Clean Access software installed and tried to browse, you were given a web portal login for your school network credentials, very similar to the actual Cisco Win32 software. After logging in you were prompted to download the Cisco software via the web portal along with McAfee and whatever else. I noticed in the school policy that Mac's and Linux clients were exempt. I booted OpenSuse, was greeted by the same web portal, but when I logged in, it told me I had a 7 day lease rather than telling me to download the Cisco crap. I went back to XP, downloaded User Agent Switcher for Firefox and faked my user agent to linux when logging into the web portal. It told me I had a 7 day lease and I was able to switch back my default FF user agent until I was prompted to login 7 days later. User Agent Switcher lets you save presets in a menu so switching is easy. I don't know if your school is setup the same way but you might want to try it. I was really surprised that with all the money and manpower that my school put into implementing all these policies that it was defeated by a first year student with a simple Firefox extension. Good luck, I really do feel your pain.
I happen to do a little work for a local in a town that some of us are familiar with [annarbor.org]. She happens to be involved with the local university [umich.edu] who also uses McAfee as their supported antivirus solution. I got called in a panic by this person because her system was crazy infected. It turned out that the infection disabled the McAfee framework service (which can't be started in safe mode) and totally owned her laptop.
The reason? The updates stopped working [umich.edu]. I opted to put AVG free on there asked her to try it out, and if she wanted to we could look into purchasing the more complete suite if she wanted.
Point of the story? I'm rather upset that CMU, or other schools would *force* a particular AV solution. I'm more upset that they force down one that has, IMHO, a critical flaw in design. Namely, you can't update, install, or uninstall the scanner in safe mode (yes, safe mode with networking). It just sets up too easily for a massive infection. Fortunately, the policy of the University I mentioned earlier did not have restrictions on AV, so this was still acceptable.
I don't know what deal McAfee has with pretty much everyone that provides AV to "non-commercial" users... but I find it terrible, resource intensive, and just too easy to knock out.
The contents of all storage media associated with OIT facilities may be considered property of CMU unless the contents are licensed software, licensed databases (e.g., InfoShare), intellectual property owned by others, or protected by CMU's Intellectual Property Rights Policy. The university has the right of access to the contents at any time for any legitimate purpose including moving or deleting files to preserve system security and performance, or examining files when there is a legitimate "need to know."
"If you use our network, we own what's on your hard drives. Thanks!"
All your steps are quite unnecessary. He is an "other" and he owns his intellecual property through operation of copyright law.
In any case, I don't see that they are making any claims to anything on his machine: just to what's on theirs (not that such a blanket assignment would work under US law anyway).
by Anonymous Coward
on Saturday June 06, @01:45PM (#28235011)
I'm one of the evil characters involved with running a college campus network. Let me assure you that I couldn't give a rat's ass about what files you have or what's in your email or anything about you, really. All I care about is keeping the network free enough from malware that it can still function. It's always a matter of playing the percentages - if more than about 5% of the machines on the net are infected and misbehaving, the resulting traffic makes the network become essentially unusable for everyone. Students scream. Faculty scream. Then the university president screams at me.
So all I want is to make sure *enough* people are clean. If you're clever enough, you can get around the restrictions. But there aren't *that* many clever people, and those people usually aren't getting infected with stuff anyway, so I don't care about the outliers.
You're not a person to me. You're a data point. Don't be an interesting one and we'll all get along just fine.
That's a good point. I recall my senior year in college the IT department installed traffic shaping hardware on the network. Basically killing the performance of P2P apps. in order to make the network useful for more general use applications
At that time, most of the file sharing was being done directly via file shares and often times there'd be virus infected files. From what you're saying, it's probably not that much different than when antivirus software would delete files on r/w enabled shares.
But to be honest, the terms kind of scare me, just because you're a professional doesn't mean the nitwits running that network are, and it's a blatant violation of copyright law to declare ownership over files in that manner.
by Anonymous Coward
on Saturday June 06, @02:22PM (#28235449)
Yep. Just because you personally don't care what he has on his computer, he shouldn't worry that there might be a bad egg in the IT department who will drain his bank accounts and post child pornography on his facebook page.
Yes sir mister IT guy, we'll let you have all of our data and trust you not to do anything bad with it, whatever you say.
You're at college. Get involved. Stop referring to IT/IS as "them" and instead make it "us". Participate with the student computer club, or the professional IT/IS department, and then you'll have a voice in campus policies, and after you pick up some credibility, you'll get the access you need to do your own stuff.
Look, I'm a fan of net freedom just like you. But let's be honest here. It is the university's network, even if you are semi-footing the bill, and they get to decide network policy rules. It's mostly for prevention, if their students are constantly getting DMCA notices, the university might get into trouble. So of course they block limewire, not like it has a legitimate use anyways. If there's a massive outbreak of viruses on their network, their tech supports (people like me) have to clean up, so of course we force students to have up to date antivirus software, and up to date operating systems, its the method of prevention available.
Simply put, their network, their rules. When you're paying, you can decide the rules you follow, and deal with the consequences if you break some other major rules (laws). If you don't like their rules, complain to them, or go elsewhere. Not like you're forced to stay. Attempting to side-step the rules (especially publicly on slashdot, you know someone in the IT department at your university reads this site) is a very bad plan. Unless if you happen to be a random genius at network security (and if you're asking us, you aren't), you will not outsmart your school's IT department. This isn't high school anymore, where renaming forbidden.exe's, or simple.bat scripts would bypass the network policies.
This is a popular new trend in university network "security." It will be hard to find a school which is not at least considering this.
I have been at a university (UC Irvine) where a system like this (Cisco Clean Access) was put into effect by the housing department despite people in the computer science department and central computing services pointing out that the aging network infrastructure could not support it. When the network went down immediately after activation, they did not admit any mistake and blamed the outage on malicious users. Students who were found using or advertising workarounds (using a virtual machine, user agent spoofing) were disconnected from the network and threatened with criminal lawsuits. Good times were had by all.
My suggestions are: -live off campus, no matter what school you're at (it took UCI 3 months to go from first suggesting such a system to ruining their network) -when you need to use the internet, get a connection through a research lab, not a student lab or general network (if research labs have to have this system, leave the school, all the good faculty have already left)
The real problem with this is that the University is asking the student to download and run software without properly identifying what it does. That's called "badware" by StopBadware [stopbadware.org], run by the Harvard Law School, Consumers Union, etc. Phrases like "exceeds authorized access" apply. And remember, this is a state school; they face the legal constraints on state actors. For example, the rule that "Most political advocacy is unacceptable" [cmich.edu] is a blatant First Amendment violation as applied to students. Report that to EULA Watch and the ACLU. The ACLU is already dealing with some other suppression of free speech by the CMU administration [aclu.org], so this probably won't surprise them.
It's not even clear whose Client Security Agent [cmich.edu] they're talking about. There's one from Cisco, one from Bradford, and one from Microsoft. The description mentions that it turns on Microsoft's automated updating. That means all the latest Microsoft security holes (like the one that makes Firefox execute Microsoft.NET content) are opened up.
Someone compared this to working for a company. It's not. As a student, you're the customer, not an employee. Also, in a corporate setting, if Central IT messes up your desktop machine, Central IT has to fix your desktop machine.
When I was in the dorms at my school, a guy maintained an InstallVise installer, which contained the proper registry keys to change window's MTU, and
a greasemoney script which spoofed firefox's user agent and platform, so windows machines looked to be running linux.
After seeing someone with a similar solution get kicked out of another school, being published on slashdot, and knowledge that my school's IT dept was searching
for the maintainer, he stopped.
Clean Access now uses a java jar, for the linux platform. If your school's client has something similar in place for linux users, I suggest that you find a Computer Science student,
and ask them to decompile the jar, using the DJ Java Decompiler, and create a greasemoney script that uses a similar method of generating a session key. You'd also probably need
the special registry keys, which can be found in the source code for sec_cloak.c, which you should be able to find on google.
Solution For College's Bad Network Policy? (Score:5, Insightful)
A different college.
Re:Solution For College's Bad Network Policy? (Score:5, Insightful)
Set up a VPN server using OpenVPN on a remote site and then run the OpenVPN client on your PC. All traffic will then be encrypted on the college network.
Using a virtual machine and TrueCrypt can also save you from additional headaches.
This assumes that you at least have sufficient rights on the client PC.
Parent
Re:Solution For College's Bad Network Policy? (Score:5, Interesting)
Run their trojan in WINE, in an account that can't do anything?
Parent
Re:Solution For College's Bad Network Policy? (Score:5, Informative)
Maybe VMware Thinapp in Sandbox mode?
Or just give them a full-blown VM with an installation of XP and nothing else.
Set up the physical network interface so that only the VM uses it, and use virtual interfaces to route from the host OS to the VM and then out to the network.
You can run a NAT firewall (XP's connection sharing might be good enough) on the VM.
If you are feeling ultra-paranoid you could install typical applications in there too, like MS Office, etc. So if they look at everything on the VM it will look like a regular college-kid computer, but unless they are really smart they will never know that the "real" computer is just using the VM to NAT out to their network.
Parent
Re:Solution For College's Bad Network Policy? (Score:5, Informative)
1. Find out what ports they connect to the program on.
2. Have a NAT from a simply wireless swtich or whatever... install dd-wrt if you like.
3. Set up Your machine, and install vmware player, virtualbox, whatever.
4. Have the VM running windows 98 (or whatever) that's lightweight, and just has their program.
5. Have the NAT port forward connections on the trojan's ports to the VM machine.
6. You get to surf clean, they get to see a clean VM you run.
I'd also recommend you using lots of SSL
Also... you could ask that a waiver be possible for other operating systems... considering that there is no option for them, it seems unreasonable that no other OS is allowed on the network... but I would ask the dean about that, and not go straight to the IT people... they are probably morons.
Parent
Re:Solution For College's Bad Network Policy? (Score:5, Insightful)
It works like this.
People: "College is soo expensive!"
Government: "Here are subsidies for schools, and for student loans!"
College A: "Hmm, look, money! We could build some spiffy new facilities that'll look good on the tour, and attract a slightly richer set of people!"
College B: "Hmm, look, money! Good thing, too, because otherwise we couldn't keep up with College A and C. We need nicer stuff to attract the same students. And besides, what university administration doesn't like spiffy-looking new facilities?"
People: "College is still soo expensive!!"
Throwing money at colleges in the US may produce a variety of desirable effects. However, "cheaper college education for all" is not necessarily among them. Universities are experts at price discrimination (the art of charging someone as much as you can get away with). They even have you fill out forms ("financial aid") so they can figure out exactly how much to charge you!
Parent
Re:Solution For College's Bad Network Policy? (Score:4, Insightful)
Parent
Re:Solution For College's Bad Network Policy? (Score:5, Interesting)
Parent
Linux (Score:5, Interesting)
Just tell them you use Linux, even if you don't. They'll probably be able to add you to a white list.
Mod Parent Up Please! :) (Score:5, Informative)
E
Parent
Re:Mod Parent Up Please! :) (Score:5, Informative)
Yep and you could run windows in a virtual machine with NAT setup and the client installed. That way, they'd get to scan "your machine" but wouldn't be able to access anything on the Linux side.
Parent
Re:Mod Parent Up Please! :) (Score:5, Insightful)
x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.
-- Theo de Raadt
Parent
Re:Mod Parent Up Please! :) (Score:5, Insightful)
Parent
Re:Mod Parent Up Please! :) (Score:5, Insightful)
Or you could do the exact same thing with Windows if you don't run programs willy nilly and use a more secure (or at least, minority market share) browser.
And you could use filesystem encryption and run the Client Security Agent under a low-privilege account, which you could make not capable of seeing certain folders on your hard drive. Just make it able to scan a couple token Program Files folders, its own folder in %appdata%, and %windir% and you'll probably be fine.
Dealing with idiotic, forced software is a pain no matter what your OS is.
Parent
Re:Mod Parent Up Please! :) (Score:5, Informative)
Parent
Re:Linux (Score:4, Insightful)
Or they will deny you access.
Parent
Re:Linux (Score:5, Informative)
My university(Ohio State), tried implementing similar policies last year. They rolled it out to some portion of the student population and said at the forefront that anyone running Mac or Linux was exempt.
Turns out, a couple weeks in and they completely dropped the policy.
On a related note: Some how, when you connect to the residential network, they can detect some botnet signatures on your machine and will deny you access. Your mac address is blacklisted until you reformat. It runs some utility to make sure you actually have reinstalled before they restore your access.
Parent
Re:Linux (Score:5, Informative)
My university(Ohio State), tried implementing similar policies last year. They rolled it out to some portion of the student population and said at the forefront that anyone running Mac or Linux was exempt.
As an IT employee at Ohio State, I can assure you that there is more of this in the pipeline since it's mandated by the Board of Trustees.
I can't see comparing what is going on at OSU with what the OP reports at CMU -- Ohio State's efforts to lock down the network and restricted data are quite comprehensive [osu.edu] and IT staff, like you, are concerned that it's done properly. Mac/Linux support is on the way -- most vendors do not support it so it's quite difficult for the University to support it. The scanners they run on your computer are not there to look at your personal files, track down copyright infringement, or anything else you might be worried about -- they simply look for OS/software patches and run an anti-virus/malware scan. If you don't run the scan with the agent, you will not have any network access. If you take some of the suggestions here and bypass the security agent, you are violating the AUP [osu.edu] and, if caught, could face academic misconduct charges.
I can assure you that the University's IT office is underfunded enough that even if they wanted to go out of their way to scan your computer for anything else (they do not), they would not be able to.
On a related note: Some how, when you connect to the residential network, they can detect some botnet signatures on your machine and will deny you access. Your mac address is blacklisted until you reformat. It runs some utility to make sure you actually have reinstalled before they restore your access.
This isn't magic -- they run typical network vulnerability scanners [nessus.org] and block you if a virus or bot responds from your IP. DHCP and switch info tells them your mac address.
Parent
Computer science major (Score:5, Interesting)
Odds are they'll simply tell him that linux is not supported under their network.
Disallowing operating systems other than Windows might make certain parts of CMU's computer science program [cmich.edu] more difficult for students.
Parent
Use a VM (Score:5, Interesting)
If they want you to install the client security agent, fine - install it in a VM under VMWare or VirtualBox. Either that, or make sure you have a firewall running and explicitly deny any traffic out from it.
Re:Use a VM (Score:4, Informative)
That may not work if the network authenticates against your MAC address.
Parent
No. (Score:4, Informative)
Do all colleges have such extreme measures in place?
No, mine doesn't. Technically we just have to have antivirus software installed, and keep up with MS's security patches, and they really don't ever even check for those.
Re:No. (Score:5, Interesting)
One of my college roommates was responsible for the dorm networks; they definitely had policies that pissed people off (usually the people who were abusing the network the most), but it was done so that the limited resources were usable by everybody. Among them:
P2P traffic was capped at 50% of total bandwidth.
There was a rolling monthly bandwidth cap. Exceed it, and you were capped at 56k modem speeds for about a week until you were under the cap again. (On-campus traffic was not counted, and not limited; many large downloads such as linux distros were mirrored on-campus.)
If you picked up a virus, you were isolated from the network. The only thing you could get to was windowsupdate.com, until you removed the virus and called the helpdesk to promise you had an antivirus installed.
Parent
Re:No. (Score:5, Interesting)
Parent
That's insane. (Score:5, Informative)
Dude, I don't know what to say, that's insane. The only suggestion I have is to either not use the Internet on your personal computer or find another university to go to. sigh... Looks like along with all the other stuff that determines what school a kid goes to, we're going to have to add "how screwed up is your Internet access policy?" to the list.
Stupid question, what if your machine is a Mac or Linux box? This "Client Security Agent" seems to be a Windows-only beast. Whatever it is, it would be a cold day in hell before I let a university that I'm paying money to dictate that I have to have their software on my machine to use the Internet access that my tuition and fees are paying for!
Looks to me like a clear-cut case of some overzealous IT goob forgotting who is paying whose salary. I'm not saying that you're the Chairman of the Board, but you most certainly should expect to have the right to have full access to this academic resource without this kind of burden.
As a practical matter, you could just call up their IT department and tell them that you have a Linux box, even if you have Windows, and that your machine doesn't run their "Client Security Agent." Whatever they tell you to do to get on the network, just do that on your Windows machine and be done with it. If they tell you that it can't be done, seriously. Go somewhere else. If this university is that stupid, you shouldn't particularly want a diploma from there anyway.
If you do call them up and ask about Macs and Linux machines, let us know what they say.
Re:That's insane. (Score:5, Informative)
That being said, this is for windows only. Mac and Linux are only single time scans (for what, I do not know), and after that your MAC is white listed with your ID. The beauty is that once registered, it's MAC specific, not OS. I should note that our provider is promising a Client Security Agent for Mac soon, but I doubt a Linux one is coming.
Parent
Re:That's insane. (Score:5, Informative)
Parent
Re:That's STILL insane. (Score:4, Interesting)
That's the polite reason they give for shitlisting Limewire.
The real reason tends to be that a number of the students manage to get themselves royally fucked with a wall of infections, not once, not twice, but over and over again until someone takes the computer from them, sets it up themselves, and put Limewire in a big ol' shitlist to keep them away from it again, usually.
This is one I'm not pulling out of my ass: When colleges take up classes, usually the first two weeks of that, I get calls from students who were doing things on Limewire, and have screwed up their systems. Two weeks before finals, I get another wave of Limewire-wielding students who have infected themselves. I recognize some of the students as ones I helped. Others, I see a track history of this on by looking at their cases.
Granted, this trend is slowing down as they start catching on, having lost papers needed for finals a few times, but it still is there.
On an aside, I'm fairly sure most of these schools have an AUP for connecting to their network that you agreed to when you signed up. If they put it there, and you didn't like it... then why would you be there?
Parent
Re:That's STILL insane. (Score:5, Insightful)
You seem to be confused. You are paying the school money for the ability to attend their classes. You are paying the school for the ability to use their network.
In no way do you have merit to dictate those terms. If you don't like it, then don't attend or try to convince them to change those terms. Either way, "Adults" should understand this is a contract, and you have very little negotiating power.
Parent
Re:That's STILL insane. (Score:5, Insightful)
But again, it is my machine, and it is my money that is paying for that Internet connection. Accessing it is not a privilege that the university has graciously given to me for free, it is a paid-for service, and you'd better have a damn good reason for taking my money and then denying it to me. "You might get infected or break copyright law" is not a valid excuse.
Dude, your money only pays for a very small part of the school's network. Do you think they should let you piss in the university president's office because it is your penis, and it is your money that pays for that office? These measures are designed to prevent the school from getting sued and to prevent network users from spreading viruses to other users. It is their network, and they can require you to meet some basic security requirements if you want to use the network.
Parent
Re:That's STILL insane. (Score:5, Insightful)
So? I don't care if it makes your dorm room smell like a fresh spring breeze. If I don't want it, then you have no right to demand that I have it.
Actually...they do. Most Universities (like the one I work for) have an acceptable use policy. Agreement to the acceptable use policy is part of the school giving you permission to use THEIR network resources. You may have paid tuition, but the school's network does not belong to you. It belongs to the school, and if the school's policy says that you have to have a screensaver featuring fluffy bunnies in order to access their network then tough shit if you don't like fluffy bunnies.
If you were a private company, then maybe I can understand, it's your network, you have the right to set the rules.
Ok.
Even if you're a private university, though, I most certainly do not understand, because again, MY tuition and fees pay for that network, and Internet access is pretty much required to complete just about any degree these days. Deny it, and you might as well tell a student that he can't have any textbooks.
If you don't like it they can admit someone else.
Not to mention that it sounds like you've fallen into the same trap that the RIAA/MPAA has fallen into. "Because some people use Limewire for illegal purposes, since you have it installed, you must be using it for illegal purposes." Sorry bub, but the whole "guilty until proven innocent" thing doesn't fly very well with me.
I do agree with you here. At the university I'm at we don't do the "guilty until proven innocent" thing. We got a little more proactive and setup a layer 7 firewall on our network that blocks all P2P traffic. Of course there are ways around it via VPNs and proxies, but the installation of that firewall resulted in about a 60% reduction in our network resources and an overall speed increase for the entire campus (we have about 3000 employees and 25000 students).
If you have some reasonable suspicion based on tangible evidence that my machine is spewing out malware or otherwise violating policies designed to protect the university or its network, then by all means, shut off it's connection, show me what you've got, and we'll deal with it like adults.
We do this in addition to the Security agent scans checking for current anti-virus and Windows updates (Mac, Linux, and wi-fi based cell phones are automatically exempt).
I wouldn't want my machine, if infected, to convey malware any more than you do. If you want to make such a "Client Security Agent" available for me to use, then thanks, I'll consider it.
But again, it is my machine, and it is my money that is paying for that Internet connection.
Yep, and thank you for your money. It is being used to pay for OUR network and OUR Internet connection. If YOU want to use YOUR machine on OUR wireless network (that we have graciously provided you with - we don't have to give you an Internet connection) you'd damn well better install the security agent or you can wait in line to use a computer lab where some idiot making $9.00/hour from your tuition (thank you again) can watch everything you're doing on that computer.
Accessing it is not a privilege that the university has graciously given to me for free, it is a paid-for service, and you'd better have a damn good reason for taking my money and then denying it to me. "You might get infected or break copyright law" is not a valid excuse.
Actually it is a privilege you've been given for free even though you paid tuition and student fees. I can only speak for the institution where I am em
Parent
Re:That's STILL insane. (Score:4, Informative)
So, I would argue that they do, in fact, have every right to require it of you. You're using their network in a way that they don't have explicit control over, when they are providing you otherwise with the necessary resources for your classes. Sounds like a privilege to me, and if you want to use it, you need to play by their rules. Not that I personally like that idea, of course, but it's what I see as being the reality of the situation.
Also, at least at my school, the CSA came into place very shortly after one of those major worm outbreaks in 2002 or 2003. I remember hearing that around 95% of the network traffic was being generated by the worm, and that the entire university was basically suffering the effects of a DoS attack for the better part of a month since very few of the students' PCs were protected by proper AV and anti-malware software at that time. From then on, practicality alone dictated that they forced the students to install AV software and that they routinely ensure that it's still there.
Parent
Re:That's insane. (Score:5, Interesting)
Lying about your OS might not work. My university used a similar system and it definitely used OS fingerprinting techniques. I basically was dual-booting Windows and the BeOS and used Linux in a VM. In exact, one week intervals I'd be forced to log in (all outbound traffic blocked, DNS resolved everything to their internal HTTPS server, all HTTP was redirected to a captive portal page, screwing up caching of SSL certificates and DNS in the process of course). The page used the User Agent string to determine whether to show a log-in form or to merely insist you download "Cisco Clean Access". But, changing one's User Agent still didn't allow logging in, that's where the OS fingerprinting came into play.
That was the only part that used fingerprinting though. I found that I could log in from the BeOS or from Linux in a VM, so that's what I always did. Assuming the programmers behind that system are competent, I'd think they've patched that hole by now. People using Cisco Clean Access never saw that page, so I doubt they always got downloads and online games disconnected on weekly intervals. Anyway, I was using a heavily nLited and tweaked version of XP, so I knew it was secured (yes, I double checked with antivirus scans and blackhat tools every now and then), but Cisco Clean Access didn't (it apparently couldn't determine the patch status of some windows component I'd removed). I could log in with another OS and simply reboot to use Windows though. CCA was kinda a pain for normal users as well. My roommate came in with a decently updated Vista machine and basic computer usage skills (he could download and install software easily enough). I timed him, it took him six hours to clear all of CCA's requirements.
Oh, amusingly enough I complained about the system before it was fully implemented, asking about how they expected game consoles to log in, or how dual-boot users like myself would be affected. The IT person I talked to had no idea about dual-booters, but stated that game consoles weren't allowed on the network because they can't run an antivirus. After I pointed out that it's almost unheard of for such devices to be infected (and a few reasons why), he replied that he'd seen it happen in his personal experience, and provided a link of "such a case" (it was to a security bulletin for law enforcement saying that modded Xboxes might contain hacking tools). I kinda chuckled when I saw the system-wide e-mail a week after implementation saying that policy had been reversed, and that IT would whitelist game console MAC addresses upon request.
Parent
thumb drive linux (Score:4, Interesting)
I had the same problem (Score:5, Informative)
1) The clean access agent only actually requires that you "authenticate" as clean to the network about once every two weeks. I installed a copy of Windows on a small partition at the end of my drive, put the clean access agent on it and authenticated myself. Whenever I was "cut off" from the network, I would reboot into the other (isolated) Windows partition (make sure your actual in-use partitions aren't mounted), do a scan to regain access and then reboot again. Worked reasonably well.
2) Because our network was so slow, I eventually decided that it wasn't worth the trouble. In the residence I was in the phones were provided by the local phone company and the cable was provided by the local cable company. It was a bit of a grey area regarding the policies in place in the residence, but I was able to have cable internet installed directly into my room. Perhaps you can do the same?
My Solution (Score:5, Interesting)
Re:My Solution (Score:5, Informative)
McAfee? Wow.
I happen to do a little work for a local in a town that some of us are familiar with [annarbor.org]. She happens to be involved with the local university [umich.edu] who also uses McAfee as their supported antivirus solution. I got called in a panic by this person because her system was crazy infected. It turned out that the infection disabled the McAfee framework service (which can't be started in safe mode) and totally owned her laptop.
The reason? The updates stopped working [umich.edu]. I opted to put AVG free on there asked her to try it out, and if she wanted to we could look into purchasing the more complete suite if she wanted.
Point of the story? I'm rather upset that CMU, or other schools would *force* a particular AV solution. I'm more upset that they force down one that has, IMHO, a critical flaw in design. Namely, you can't update, install, or uninstall the scanner in safe mode (yes, safe mode with networking). It just sets up too easily for a massive infection. Fortunately, the policy of the University I mentioned earlier did not have restrictions on AV, so this was still acceptable.
I don't know what deal McAfee has with pretty much everyone that provides AV to "non-commercial" users... but I find it terrible, resource intensive, and just too easy to knock out.
Parent
entrepreneur (Score:5, Interesting)
"There are no wireless broadband providers available in the area, I already checked."
Start one. Given what you've told us, there should be plenty of demand.
Whoa what? (Score:5, Insightful)
From the first link:
"If you use our network, we own what's on your hard drives. Thanks!"
There's a get out (Score:4, Insightful)
Parent
Re:There's a get out (Score:4, Informative)
Parent
You're not as interesting as you think you are (Score:5, Interesting)
I'm one of the evil characters involved with running a college campus network. Let me assure you that I couldn't give a rat's ass about what files you have or what's in your email or anything about you, really. All I care about is keeping the network free enough from malware that it can still function. It's always a matter of playing the percentages - if more than about 5% of the machines on the net are infected and misbehaving, the resulting traffic makes the network become essentially unusable for everyone. Students scream. Faculty scream. Then the university president screams at me.
So all I want is to make sure *enough* people are clean. If you're clever enough, you can get around the restrictions. But there aren't *that* many clever people, and those people usually aren't getting infected with stuff anyway, so I don't care about the outliers.
You're not a person to me. You're a data point. Don't be an interesting one and we'll all get along just fine.
Re:You're not as interesting as you think you are (Score:4, Insightful)
At that time, most of the file sharing was being done directly via file shares and often times there'd be virus infected files. From what you're saying, it's probably not that much different than when antivirus software would delete files on r/w enabled shares.
But to be honest, the terms kind of scare me, just because you're a professional doesn't mean the nitwits running that network are, and it's a blatant violation of copyright law to declare ownership over files in that manner.
Parent
Re:You're not as interesting as you think you are (Score:4, Insightful)
Yep. Just because you personally don't care what he has on his computer, he shouldn't worry that there might be a bad egg in the IT department who will drain his bank accounts and post child pornography on his facebook page.
Yes sir mister IT guy, we'll let you have all of our data and trust you not to do anything bad with it, whatever you say.
Parent
join the computer club (Score:5, Insightful)
You're at college. Get involved. Stop referring to IT/IS as "them" and instead make it "us". Participate with the student computer club, or the professional IT/IS department, and then you'll have a voice in campus policies, and after you pick up some credibility, you'll get the access you need to do your own stuff.
This is the point of being at college, after all.
Waaah. (Score:5, Informative)
Simply put, their network, their rules. When you're paying, you can decide the rules you follow, and deal with the consequences if you break some other major rules (laws). If you don't like their rules, complain to them, or go elsewhere. Not like you're forced to stay. Attempting to side-step the rules (especially publicly on slashdot, you know someone in the IT department at your university reads this site) is a very bad plan. Unless if you happen to be a random genius at network security (and if you're asking us, you aren't), you will not outsmart your school's IT department. This isn't high school anymore, where renaming forbidden
common, not good (Score:5, Interesting)
This is a popular new trend in university network "security." It will be hard to find a school which is not at least considering this.
I have been at a university (UC Irvine) where a system like this (Cisco Clean Access) was put into effect by the housing department despite people in the computer science department and central computing services pointing out that the aging network infrastructure could not support it. When the network went down immediately after activation, they did not admit any mistake and blamed the outage on malicious users. Students who were found using or advertising workarounds (using a virtual machine, user agent spoofing) were disconnected from the network and threatened with criminal lawsuits. Good times were had by all.
My suggestions are:
-live off campus, no matter what school you're at (it took UCI 3 months to go from first suggesting such a system to ruining their network)
-when you need to use the internet, get a connection through a research lab, not a student lab or general network (if research labs have to have this system, leave the school, all the good faculty have already left)
Inadequate disclosure (Score:5, Interesting)
The real problem with this is that the University is asking the student to download and run software without properly identifying what it does. That's called "badware" by StopBadware [stopbadware.org], run by the Harvard Law School, Consumers Union, etc. Phrases like "exceeds authorized access" apply. And remember, this is a state school; they face the legal constraints on state actors. For example, the rule that "Most political advocacy is unacceptable" [cmich.edu] is a blatant First Amendment violation as applied to students. Report that to EULA Watch and the ACLU. The ACLU is already dealing with some other suppression of free speech by the CMU administration [aclu.org], so this probably won't surprise them.
It's not even clear whose Client Security Agent [cmich.edu] they're talking about. There's one from Cisco, one from Bradford, and one from Microsoft. The description mentions that it turns on Microsoft's automated updating. That means all the latest Microsoft security holes (like the one that makes Firefox execute Microsoft .NET content) are opened up.
Someone compared this to working for a company. It's not. As a student, you're the customer, not an employee. Also, in a corporate setting, if Central IT messes up your desktop machine, Central IT has to fix your desktop machine.
Re:Don't use their network? (Score:5, Informative)
When I was in the dorms at my school, a guy maintained an InstallVise installer, which contained the proper registry keys to change window's MTU, and
a greasemoney script which spoofed firefox's user agent and platform, so windows machines looked to be running linux.
After seeing someone with a similar solution get kicked out of another school, being published on slashdot, and knowledge that my school's IT dept was searching
for the maintainer, he stopped.
Clean Access now uses a java jar, for the linux platform. If your school's client has something similar in place for linux users, I suggest that you find a Computer Science student,
and ask them to decompile the jar, using the DJ Java Decompiler, and create a greasemoney script that uses a similar method of generating a session key. You'd also probably need
the special registry keys, which can be found in the source code for sec_cloak.c, which you should be able to find on google.
Hope I could help.
Parent
Re:Can't tether there. (Score:5, Funny)
You mean Central Michigan University? It's in Southern Beijing, as the fucking name implies.
Parent