Forgot your password?
typodupeerror
Education Networking Security Your Rights Online

Solution For College's Bad Network Policy? 699

Posted by timothy
from the must-be-monoculture-compatible dept.
DAMN MY LIFE writes "I'm going to Central Michigan University in the fall. Upon examination of their poorly organized network usage policies, I'm worried that using their internet service will expose my web browsing habits, emails, and most importantly, passwords. Another concern I have is the 'Client Security Agent' that students are required to install and leave on their systems to use the network. Through this application, the IT department scans everyone's computer for what they claim are network security purposes. Of course, scanning a person's hard drive can turn up all kinds of things that are personal. Do all colleges have such extreme measures in place? Is there any way that I can avoid this? There are no wireless broadband providers available in the area, I already checked."
This discussion has been archived. No new comments can be posted.

Solution For College's Bad Network Policy?

Comments Filter:
  • by John Hasler (414242) on Saturday June 06, 2009 @02:34PM (#28234869) Homepage

    A different college.

    • by Anonymous Coward on Saturday June 06, 2009 @03:15PM (#28235349)

      Set up a VPN server using OpenVPN on a remote site and then run the OpenVPN client on your PC. All traffic will then be encrypted on the college network.

      Using a virtual machine and TrueCrypt can also save you from additional headaches.

      This assumes that you at least have sufficient rights on the client PC.

      • Re: (Score:3, Informative)

        by hazem (472289)

        A technical solution that "gets around" it will most likely get you suspended; it's happened before:
        http://it.slashdot.org/article.pl?sid=07/04/27/203232 [slashdot.org]

        (and a good friend of mine who was a professor also was denied tenure over this incident). Sadly IT at universities tends to be a little kingdom of people who think they are more important than everything else going on - in fact, this isn't just at universities...

        The best thing you can do is go to the dean of the school you're planning to attend and say, "

    • by rouge86 (608370) on Saturday June 06, 2009 @03:30PM (#28235523)
      Perhaps something a little less extreme would be helpful, such as move off campus. The college can only dictate what you must install while you use their networks on campus.
    • Re: (Score:3, Informative)

      by silvakow (91320)

      You probably think that's funny, but I appled to and got accepted to Central Michigan University in 2001 and decided not to attend because of a bad conversation with a sysadmin where he told me students should not have the ability to host any type of content. I went to (relatively) neighboring Grand Vallley State University (gvsu.edu) instead, and I'm glad I did.

  • Linux (Score:5, Interesting)

    by Timmmm (636430) on Saturday June 06, 2009 @02:36PM (#28234883)

    Just tell them you use Linux, even if you don't. They'll probably be able to add you to a white list.

    • by gavron (1300111) on Saturday June 06, 2009 @02:38PM (#28234917)
      Run Linux. That's the answer. The silly Windows agent won't run on it, and your files can even be protected through filesystem encryption, and safe from magically being shared with spyware writers, botnet managers, and spam sources.

      E

      • by binarylarry (1338699) on Saturday June 06, 2009 @02:44PM (#28234999)

        Yep and you could run windows in a virtual machine with NAT setup and the client installed. That way, they'd get to scan "your machine" but wouldn't be able to access anything on the Linux side.

        • by Jurily (900488) <jurily@noSpAM.gmail.com> on Saturday June 06, 2009 @03:04PM (#28235239)

          x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.

          -- Theo de Raadt

          • by Dun Malg (230075) on Saturday June 06, 2009 @05:17PM (#28236521) Homepage
            We all know Theo de Raadt is an ass. While what he says is factually correct, it also completely misses the nature of most security situations. 99% of the security out there is of a casual nature. Most of us are not working for the NSA or DoD, so we are not likely to be specifically targeted. If you are a target singled out, yes, Theo's point is valid: a determined attacker will find a way through because the second and third layers are not any better built than the first. That's not the security situation most of us face, though. For the most part we only need to make our information a degree more difficult to get at than everyone else's. A virtual machine will do that. So will running Linux. As would running OSX, though to a lesser degree. Now, if everyone were running virtual machines, he'd have a valid point because the low hanging fruit would be the virtual machine. But since VMs are a novelty to most, they're unlikely to be targeted, which makes Theo's rant just more of his usual hot gas.
      • Re: (Score:3, Informative)

        by artor3 (1344997)

        Of course, other silly Windows programs, like SolidWorks, PSpice, Photoshop won't run either. Might make certain classes difficult depending on your major, though I'm sure it can be worked around. In the worst case, you could keep a Windows partition specifically for essential programs.

      • Re: (Score:3, Informative)

        You could run the agent in a wine environment without access to your real file system.
      • by Anpheus (908711) on Saturday June 06, 2009 @02:59PM (#28235169)

        Or you could do the exact same thing with Windows if you don't run programs willy nilly and use a more secure (or at least, minority market share) browser.

        And you could use filesystem encryption and run the Client Security Agent under a low-privilege account, which you could make not capable of seeing certain folders on your hard drive. Just make it able to scan a couple token Program Files folders, its own folder in %appdata%, and %windir% and you'll probably be fine.

        Dealing with idiotic, forced software is a pain no matter what your OS is.

      • by solafide (845228) on Saturday June 06, 2009 @03:36PM (#28235595) Homepage
        Last time I experienced this sort of stupidity, the program was a proxy/filter, and the solution to Linux was 'Windows/Macs only on campus.' Best of luck.
        • Re: (Score:3, Informative)

          by Cassini2 (956052)

          At my university, they explicitly exempt Macs and Linux from having to use Cisco Clean Access. They port scan the Linux / Mac box, and use network level checks to make sure your computer is secure (or at least appears secure.)

          The big problems are with Windows. With a campus as big as ours, all Windows boxes must run an up to date virus scanner. This policy must be enforced. To do otherwise is just stupid. Every computer, even Linux machines, are continuously being probed looking for vulnerable ports.

    • Re:Linux (Score:4, Insightful)

      by nurb432 (527695) on Saturday June 06, 2009 @02:45PM (#28235019) Homepage Journal

      Or they will deny you access.

    • Re:Linux (Score:5, Informative)

      by prestomation (583502) on Saturday June 06, 2009 @03:23PM (#28235453)

      My university(Ohio State), tried implementing similar policies last year. They rolled it out to some portion of the student population and said at the forefront that anyone running Mac or Linux was exempt.

      Turns out, a couple weeks in and they completely dropped the policy.

      On a related note: Some how, when you connect to the residential network, they can detect some botnet signatures on your machine and will deny you access. Your mac address is blacklisted until you reformat. It runs some utility to make sure you actually have reinstalled before they restore your access.

      • Re:Linux (Score:5, Informative)

        by wstrucke (876891) on Saturday June 06, 2009 @04:44PM (#28236237)

        My university(Ohio State), tried implementing similar policies last year. They rolled it out to some portion of the student population and said at the forefront that anyone running Mac or Linux was exempt.

        As an IT employee at Ohio State, I can assure you that there is more of this in the pipeline since it's mandated by the Board of Trustees.

        I can't see comparing what is going on at OSU with what the OP reports at CMU -- Ohio State's efforts to lock down the network and restricted data are quite comprehensive [osu.edu] and IT staff, like you, are concerned that it's done properly. Mac/Linux support is on the way -- most vendors do not support it so it's quite difficult for the University to support it. The scanners they run on your computer are not there to look at your personal files, track down copyright infringement, or anything else you might be worried about -- they simply look for OS/software patches and run an anti-virus/malware scan. If you don't run the scan with the agent, you will not have any network access. If you take some of the suggestions here and bypass the security agent, you are violating the AUP [osu.edu] and, if caught, could face academic misconduct charges.

        I can assure you that the University's IT office is underfunded enough that even if they wanted to go out of their way to scan your computer for anything else (they do not), they would not be able to.

        On a related note: Some how, when you connect to the residential network, they can detect some botnet signatures on your machine and will deny you access. Your mac address is blacklisted until you reformat. It runs some utility to make sure you actually have reinstalled before they restore your access.

        This isn't magic -- they run typical network vulnerability scanners [nessus.org] and block you if a virus or bot responds from your IP. DHCP and switch info tells them your mac address.

        • Bullshit (Score:4, Insightful)

          by Weezul (52464) on Saturday June 06, 2009 @07:14PM (#28237281)

          There are always operating systems that don't support your trojans. Do you have an iPhone version? Symbian? BSD? What about simply plugging two machines into the same NATed router? You scanners probably won't detect any machine behind its own firewall either.

          I'm guessing you don't know much about academic institutions beyond your little world. Academic misconduct rarely if ever extends to resource misuse cases, especially such minor ones. Imagine a student ran bittorrent seeds for pirated pornography on school servers, well they'd get a warning. If they repeated the infraction, they'd have all access terminated. If they circumvented that, they'd surely be expelled, and maybe face intrusion charges. But even then it's not clear their transcript would read "academic misconduct". In particular, there would be no "F (academic misconduct)" on their transcript because they haven't cheated in any classes.

          Sadly, residential networks create a perfect environment for windows worms. But viruses that support Mac & Linux usually do so passively by wrapping their executable within non-executable formates, like office or PDF. So IT should ask Mac & Linux users to scan for viruses as a courtesy to their windows using fellow students, but compelling scans using closed source software will only discourage compliance.

          I concur with the other posts that say running Linux will grant you an exception most anyplace. If that doesn't work, then share your roommate's connection using a NATed router.

        • Re: (Score:3, Insightful)

          by ejtttje (673126)
          What happened to personal responsibility? As in, people are responsible for their own machines. If they get infected, then kick them off the network. You admit you already have tools for scanning vulnerabilities remotely, use those. That's a reasonable policy.

          Requiring the use of a specific piece of spyware smacks of corruption to me. I'm sure someone's getting paid for that. What if a student wants to run a different scanner? They have to run two scanners? What if they want to change the configur
  • Use a VM (Score:5, Interesting)

    by Anonymous Coward on Saturday June 06, 2009 @02:36PM (#28234887)

    If they want you to install the client security agent, fine - install it in a VM under VMWare or VirtualBox. Either that, or make sure you have a firewall running and explicitly deny any traffic out from it.

  • No. (Score:4, Informative)

    by ChinggisK (1133009) on Saturday June 06, 2009 @02:36PM (#28234891)

    Do all colleges have such extreme measures in place?

    No, mine doesn't. Technically we just have to have antivirus software installed, and keep up with MS's security patches, and they really don't ever even check for those.

    • Re:No. (Score:5, Interesting)

      by Macman408 (1308925) on Saturday June 06, 2009 @03:15PM (#28235353)

      One of my college roommates was responsible for the dorm networks; they definitely had policies that pissed people off (usually the people who were abusing the network the most), but it was done so that the limited resources were usable by everybody. Among them:

      P2P traffic was capped at 50% of total bandwidth.

      There was a rolling monthly bandwidth cap. Exceed it, and you were capped at 56k modem speeds for about a week until you were under the cap again. (On-campus traffic was not counted, and not limited; many large downloads such as linux distros were mirrored on-campus.)

      If you picked up a virus, you were isolated from the network. The only thing you could get to was windowsupdate.com, until you removed the virus and called the helpdesk to promise you had an antivirus installed.

    • Re:No. (Score:5, Interesting)

      by finalfrog (1379051) on Saturday June 06, 2009 @03:17PM (#28235371)
      My college doesn't require us to install anything to access the network. Of course that's mainly for two reasons: 1. If you're going to Harvey Mudd, you probably have mastered the basics and possibly several of the upper reaches of computer and internet security and those who haven't usually learn fast from their peers that do. 2. Honor Code. This is actually one of the basic tenets of Mudd, not just of computer usage, and it basically means "Use common sense and when that fails report yourself." It sounds crazy I know. You'd think it'd cause a breakdown of justice and total anarchy because no one would obey the rules which might very well happen on many larger campuses. But when you consider the kind of people that attend Mudd and its small size, it actually works darn well. Hell, it's worked for over 50 years and Mudd still turns out incredibly bright students either in spite of or because of the Honor Code depending on your view point. People actually do report themselves when they cause problems and there is a student run judiciary board for those who don't which runs quite efficiently. All in all, the policy causes less stress and anxiety for both the administration and the students than invasive strategies like the one described in the article.
      • Re: (Score:3, Interesting)

        by moosesocks (264553)

        Every honor code I've ever heard of has been used as a tool for a college to rid itself of students that it deems undesirable. In my experience, enforcement of these codes varies enormously. Recently, the University of Virginia came under fire for using its honor code to expel students for seemingly trivial offenses.

        Honor codes are great in theory, although the ones I've seen put far too much power in the hands of far too few.

    • Re: (Score:3, Insightful)

      by Tacvek (948259)

      Mine does not even require antivirus software, although they deliberately design the system into tricking students into installing it, and some other crap. However, if you machine is rooted, and begins disrupting the network, they reserve the right to ban your computer from the network.

  • Question (Score:3, Insightful)

    by Vinegar Joe (998110) on Saturday June 06, 2009 @02:37PM (#28234911)

    Are you required to run Windows? If not, don't.

  • That's insane. (Score:5, Informative)

    by KingSkippus (799657) * on Saturday June 06, 2009 @02:38PM (#28234915) Homepage Journal

    Dude, I don't know what to say, that's insane. The only suggestion I have is to either not use the Internet on your personal computer or find another university to go to. sigh... Looks like along with all the other stuff that determines what school a kid goes to, we're going to have to add "how screwed up is your Internet access policy?" to the list.

    Stupid question, what if your machine is a Mac or Linux box? This "Client Security Agent" seems to be a Windows-only beast. Whatever it is, it would be a cold day in hell before I let a university that I'm paying money to dictate that I have to have their software on my machine to use the Internet access that my tuition and fees are paying for!

    Looks to me like a clear-cut case of some overzealous IT goob forgotting who is paying whose salary. I'm not saying that you're the Chairman of the Board, but you most certainly should expect to have the right to have full access to this academic resource without this kind of burden.

    As a practical matter, you could just call up their IT department and tell them that you have a Linux box, even if you have Windows, and that your machine doesn't run their "Client Security Agent." Whatever they tell you to do to get on the network, just do that on your Windows machine and be done with it. If they tell you that it can't be done, seriously. Go somewhere else. If this university is that stupid, you shouldn't particularly want a diploma from there anyway.

    If you do call them up and ask about Macs and Linux machines, let us know what they say.

    • Re:That's insane. (Score:5, Informative)

      by Idiot with a gun (1081749) on Saturday June 06, 2009 @02:59PM (#28235175)
      I'm a tech support (ResNet, CMU has it too) at a different university that has a similar "Client Security Agent." I'm not sure who provides their CSA, but ours only checks for antivirus, antivirus updates, windows updates, and common P2P programs (usually limewire). If anyone fails these, they are instructed to uninstall limewire, update anti-virus, whatever, and rescan. We don't prosecute based off of any data, but it's more of a prevention system to avoid any DMCA notices.

      That being said, this is for windows only. Mac and Linux are only single time scans (for what, I do not know), and after that your MAC is white listed with your ID. The beauty is that once registered, it's MAC specific, not OS. I should note that our provider is promising a Client Security Agent for Mac soon, but I doubt a Linux one is coming.
    • Re:That's insane. (Score:5, Interesting)

      by izomiac (815208) on Saturday June 06, 2009 @03:51PM (#28235739) Homepage

      Lying about your OS might not work. My university used a similar system and it definitely used OS fingerprinting techniques. I basically was dual-booting Windows and the BeOS and used Linux in a VM. In exact, one week intervals I'd be forced to log in (all outbound traffic blocked, DNS resolved everything to their internal HTTPS server, all HTTP was redirected to a captive portal page, screwing up caching of SSL certificates and DNS in the process of course). The page used the User Agent string to determine whether to show a log-in form or to merely insist you download "Cisco Clean Access". But, changing one's User Agent still didn't allow logging in, that's where the OS fingerprinting came into play.

      That was the only part that used fingerprinting though. I found that I could log in from the BeOS or from Linux in a VM, so that's what I always did. Assuming the programmers behind that system are competent, I'd think they've patched that hole by now. People using Cisco Clean Access never saw that page, so I doubt they always got downloads and online games disconnected on weekly intervals. Anyway, I was using a heavily nLited and tweaked version of XP, so I knew it was secured (yes, I double checked with antivirus scans and blackhat tools every now and then), but Cisco Clean Access didn't (it apparently couldn't determine the patch status of some windows component I'd removed). I could log in with another OS and simply reboot to use Windows though. CCA was kinda a pain for normal users as well. My roommate came in with a decently updated Vista machine and basic computer usage skills (he could download and install software easily enough). I timed him, it took him six hours to clear all of CCA's requirements.

      Oh, amusingly enough I complained about the system before it was fully implemented, asking about how they expected game consoles to log in, or how dual-boot users like myself would be affected. The IT person I talked to had no idea about dual-booters, but stated that game consoles weren't allowed on the network because they can't run an antivirus. After I pointed out that it's almost unheard of for such devices to be infected (and a few reasons why), he replied that he'd seen it happen in his personal experience, and provided a link of "such a case" (it was to a security bulletin for law enforcement saying that modded Xboxes might contain hacking tools). I kinda chuckled when I saw the system-wide e-mail a week after implementation saying that policy had been reversed, and that IT would whitelist game console MAC addresses upon request.

  • by reeeh2000 (1328037) on Saturday June 06, 2009 @02:39PM (#28234923) Homepage
    What I found to be the best solution is to run Linux. My campus required Cisco clean access agent and service pack 2 to use windows on the network. I wasn't required to as Linux is allowed to connect without these. As for other concerns I would suggest setting up a encrypted proxy server at home then connecting through it. This will also allow for torrenting and PvP file sharing as this is often blocked on campus.
  • thumb drive linux (Score:4, Interesting)

    by elwinc (663074) on Saturday June 06, 2009 @02:39PM (#28234929)
    Build one of those "linux on a thumb drive" things and do your private stuff on that. You might be able to get away with a dual boot system; their app on the windows partition and privacy on the linux partition.
  • by Xocet_00 (635069) on Saturday June 06, 2009 @02:40PM (#28234937)
    We were required to have a "Cisco Clean Access Agent" installed on our machines. There were two options available for me, and I ended up going with the second.

    1) The clean access agent only actually requires that you "authenticate" as clean to the network about once every two weeks. I installed a copy of Windows on a small partition at the end of my drive, put the clean access agent on it and authenticated myself. Whenever I was "cut off" from the network, I would reboot into the other (isolated) Windows partition (make sure your actual in-use partitions aren't mounted), do a scan to regain access and then reboot again. Worked reasonably well.

    2) Because our network was so slow, I eventually decided that it wasn't worth the trouble. In the residence I was in the phones were provided by the local phone company and the cable was provided by the local cable company. It was a bit of a grey area regarding the policies in place in the residence, but I was able to have cable internet installed directly into my room. Perhaps you can do the same?
    • Re: (Score:3, Informative)

      by Urza9814 (883915)

      Yea, in response to number 2:

      My university (Penn State) has free telephone to every room, and the copper goes straight to the phone company. They actually tell you at the orientation stuff that you can go ahead and get DSL to your dorm if you don't like their network setup. Some people do, though not many. Though their network policy isn't bad...just a 4GB weekly bandwidth limit.

  • My Solution (Score:5, Interesting)

    by Adam Zweimiller (710977) on Saturday June 06, 2009 @02:43PM (#28234973) Homepage
    When I was at the University of SC in 2004, they required you to install the Cisco Clean Access software which checked to make sure you were running the school provided AV and had all your windows updates among other things. I hated the school AV (mcafee) because it constantly had false positives on items on my computer and would delete without prompting. It gave no option to quarantine, ignore, etc...just delete. I noticed that if you didn't have the Cisco Clean Access software installed and tried to browse, you were given a web portal login for your school network credentials, very similar to the actual Cisco Win32 software. After logging in you were prompted to download the Cisco software via the web portal along with McAfee and whatever else. I noticed in the school policy that Mac's and Linux clients were exempt. I booted OpenSuse, was greeted by the same web portal, but when I logged in, it told me I had a 7 day lease rather than telling me to download the Cisco crap. I went back to XP, downloaded User Agent Switcher for Firefox and faked my user agent to linux when logging into the web portal. It told me I had a 7 day lease and I was able to switch back my default FF user agent until I was prompted to login 7 days later. User Agent Switcher lets you save presets in a menu so switching is easy. I don't know if your school is setup the same way but you might want to try it. I was really surprised that with all the money and manpower that my school put into implementing all these policies that it was defeated by a first year student with a simple Firefox extension. Good luck, I really do feel your pain.
    • Re:My Solution (Score:5, Informative)

      by lorenlal (164133) on Saturday June 06, 2009 @03:16PM (#28235369)

      McAfee? Wow.

      I happen to do a little work for a local in a town that some of us are familiar with [annarbor.org]. She happens to be involved with the local university [umich.edu] who also uses McAfee as their supported antivirus solution. I got called in a panic by this person because her system was crazy infected. It turned out that the infection disabled the McAfee framework service (which can't be started in safe mode) and totally owned her laptop.

      The reason? The updates stopped working [umich.edu]. I opted to put AVG free on there asked her to try it out, and if she wanted to we could look into purchasing the more complete suite if she wanted.

      Point of the story? I'm rather upset that CMU, or other schools would *force* a particular AV solution. I'm more upset that they force down one that has, IMHO, a critical flaw in design. Namely, you can't update, install, or uninstall the scanner in safe mode (yes, safe mode with networking). It just sets up too easily for a massive infection. Fortunately, the policy of the University I mentioned earlier did not have restrictions on AV, so this was still acceptable.

      I don't know what deal McAfee has with pretty much everyone that provides AV to "non-commercial" users... but I find it terrible, resource intensive, and just too easy to knock out.

      • Re: (Score:3, Insightful)

        by Z34107 (925136)

        I second everything that you say about McAfee.

        I work help desk at a McAfee campus and am also responsible for doing repairs on student and faculty computers.

        You have to register your computer using a special utility that records your MAC address and whether or not you have McAfee installed. In the mean time, you'll get an IP address from the "unregistered" block and the firewall won't let any of your traffic leave the LAN.

        (Yes, this can be spoofed by wireshark-ing a registered person's MAC address, or even

  • entrepreneur (Score:5, Interesting)

    by TheSHAD0W (258774) on Saturday June 06, 2009 @02:44PM (#28234995) Homepage

    "There are no wireless broadband providers available in the area, I already checked."

    Start one. Given what you've told us, there should be plenty of demand.

  • Whoa what? (Score:5, Insightful)

    by IICV (652597) on Saturday June 06, 2009 @02:45PM (#28235005)

    From the first link:

    The contents of all storage media associated with OIT facilities may be considered property of CMU unless the contents are licensed software, licensed databases (e.g., InfoShare), intellectual property owned by others, or protected by CMU's Intellectual Property Rights Policy. The university has the right of access to the contents at any time for any legitimate purpose including moving or deleting files to preserve system security and performance, or examining files when there is a legitimate "need to know."

    "If you use our network, we own what's on your hard drives. Thanks!"

  • by Anonymous Coward on Saturday June 06, 2009 @02:45PM (#28235011)

    I'm one of the evil characters involved with running a college campus network. Let me assure you that I couldn't give a rat's ass about what files you have or what's in your email or anything about you, really. All I care about is keeping the network free enough from malware that it can still function. It's always a matter of playing the percentages - if more than about 5% of the machines on the net are infected and misbehaving, the resulting traffic makes the network become essentially unusable for everyone. Students scream. Faculty scream. Then the university president screams at me.

    So all I want is to make sure *enough* people are clean. If you're clever enough, you can get around the restrictions. But there aren't *that* many clever people, and those people usually aren't getting infected with stuff anyway, so I don't care about the outliers.

    You're not a person to me. You're a data point. Don't be an interesting one and we'll all get along just fine.

    • by hedwards (940851) on Saturday June 06, 2009 @03:04PM (#28235229)
      That's a good point. I recall my senior year in college the IT department installed traffic shaping hardware on the network. Basically killing the performance of P2P apps. in order to make the network useful for more general use applications

      At that time, most of the file sharing was being done directly via file shares and often times there'd be virus infected files. From what you're saying, it's probably not that much different than when antivirus software would delete files on r/w enabled shares.

      But to be honest, the terms kind of scare me, just because you're a professional doesn't mean the nitwits running that network are, and it's a blatant violation of copyright law to declare ownership over files in that manner.
    • by Anonymous Coward on Saturday June 06, 2009 @03:22PM (#28235449)

      Yep. Just because you personally don't care what he has on his computer, he shouldn't worry that there might be a bad egg in the IT department who will drain his bank accounts and post child pornography on his facebook page.

      Yes sir mister IT guy, we'll let you have all of our data and trust you not to do anything bad with it, whatever you say.

  • Both CYA & BS (Score:3, Informative)

    by indytx (825419) on Saturday June 06, 2009 @03:09PM (#28235281)

    I am assuming that you will be living in the dorm, otherwise the CMU website gives a list of ISPs. http://www.oit.cmich.edu/it/it_isps.asp [cmich.edu] The list includes mobile broadband cards from Sprint, etc., so I'm not sure what you mean by no wireless broadband providers, though this would be a huge downgrade from the internet speed you can probably get on campus.

    The Acceptable Use Policy looks to be general CYA boilerplate B.S. which lets you know that you have some expectations of privacy, but don't hold your breath if there's a subpoena or other legal action trying to get the data. As to the CSA, this appears to be an overreaction to the perceived security risks of Windows systems. On the other hand, bandwidth is expensive, and the IT department may have decided that this is a good way to prevent the spread of viruses and bots on the campus network. All of this is probably academic as it doesn't look like it's Windows only. http://www.oit.cmich.edu/faq/faq_network_dialup.asp#get [cmich.edu] Mac or Linux should probably work.

  • by snsh (968808) on Saturday June 06, 2009 @03:12PM (#28235313)

    You're at college. Get involved. Stop referring to IT/IS as "them" and instead make it "us". Participate with the student computer club, or the professional IT/IS department, and then you'll have a voice in campus policies, and after you pick up some credibility, you'll get the access you need to do your own stuff.

    This is the point of being at college, after all.

  • Waaah. (Score:5, Informative)

    by Idiot with a gun (1081749) on Saturday June 06, 2009 @03:18PM (#28235393)
    Look, I'm a fan of net freedom just like you. But let's be honest here. It is the university's network, even if you are semi-footing the bill, and they get to decide network policy rules. It's mostly for prevention, if their students are constantly getting DMCA notices, the university might get into trouble. So of course they block limewire, not like it has a legitimate use anyways. If there's a massive outbreak of viruses on their network, their tech supports (people like me) have to clean up, so of course we force students to have up to date antivirus software, and up to date operating systems, its the method of prevention available.

    Simply put, their network, their rules. When you're paying, you can decide the rules you follow, and deal with the consequences if you break some other major rules (laws). If you don't like their rules, complain to them, or go elsewhere. Not like you're forced to stay. Attempting to side-step the rules (especially publicly on slashdot, you know someone in the IT department at your university reads this site) is a very bad plan. Unless if you happen to be a random genius at network security (and if you're asking us, you aren't), you will not outsmart your school's IT department. This isn't high school anymore, where renaming forbidden .exe's, or simple .bat scripts would bypass the network policies.
  • common, not good (Score:5, Interesting)

    by Goldsmith (561202) on Saturday June 06, 2009 @03:24PM (#28235473)

    This is a popular new trend in university network "security." It will be hard to find a school which is not at least considering this.

    I have been at a university (UC Irvine) where a system like this (Cisco Clean Access) was put into effect by the housing department despite people in the computer science department and central computing services pointing out that the aging network infrastructure could not support it. When the network went down immediately after activation, they did not admit any mistake and blamed the outage on malicious users. Students who were found using or advertising workarounds (using a virtual machine, user agent spoofing) were disconnected from the network and threatened with criminal lawsuits. Good times were had by all.

    My suggestions are:
    -live off campus, no matter what school you're at (it took UCI 3 months to go from first suggesting such a system to ruining their network)
    -when you need to use the internet, get a connection through a research lab, not a student lab or general network (if research labs have to have this system, leave the school, all the good faculty have already left)

  • It's so simple (Score:3, Informative)

    by buss_error (142273) on Saturday June 06, 2009 @03:45PM (#28235679) Homepage Journal

    Let me see if I have this right...

    You want us to tell you how to hack around the network/security/TOS of your university?
    How about this observation from someone that also runs a network for students:

    Comply with the policy when you use their infrastructure.

    Now, how to go about that without invading your privacy? Easy - dual boot with encrypted file systems on the second partition. Keep pablum on the system you use to access their infrastructure. Keep your other stuff on a system you don't bring up using their infrastructure. Simple. If you don't want your browsing habits known (which I don't believe for a second they give a fart about), then go to a cyber cafe or something when you want to do things you don't want known.

    Their network = their rules.

    And for those that want to pick holes in their policies/make fun of how incompentent they are:

    1. Not everytime do I tell my management team better ways to do what they want to do. Sometimes I think management is full of it. Now, if they ASK me, I have to tell them. But I don't have to open my big fat yap - and I don't, when I think they are being silly.

    2. Not every "bone headed move" is all that bone headed. You need to be in the room to see why some direction was chosen. Sometimes it's stupidity, sometimes it a comprimise between time, money, resources, and what you really need to do. The old web blocking software wasn't very good at blocking http proxies. We simply didn't have the money or time to cobble up something better. All the people that knew this thought we were incompentent because it was so easy to get around the blocking software. The new software is very good at blocking that and a lot of other tricks. Our network = our rules. You're free to visit sites we don't like - on your own time, on your own network infrastructure, using your own computer. (Not that I agree with the policy, but it IS their network funded with tax dollars and subject to state law which requires web blocking software. Grow up and deal with it, change state law, or use your own stuff to do what they don't like.)

    3. Get used to someone looking over your shoulder vis-a-vi computing. Employers are increasingly doing it, public institutions are required to do it, and others do it simply because they can. Failing to learn how to keep your stuff private is an invatation to these jerks to invade your privacy - so learn to make it difficult for them to do so. The first step in this process is to know that when you use someone else's network, computers, or infrastructure, they have a say in how that gets used. When you're on your own network, own computer, and own internet connection, THEN you can expect some privacy... if you're smart and use care.

  • Gotta love Slashdot (Score:3, Interesting)

    by Idiot with a gun (1081749) on Saturday June 06, 2009 @03:54PM (#28235767)
    Look, I'm a ResCon at ResNet, granted at a different university though. We're nice people, and we'll try to accomodate you as best as possible. Want to register Linux? Sure, you won't need to install a CSA. Same for Macs, phones, consoles, printers, routers, etc. The CSA is mostly just to reduce the number of windows machines getting viruses.

    But, if you walk into my office bitching about our "draconian network policices," I'm going to get annoyed with you, but I'll kindly explain why they're in place (and how I'm not the one that made them). If you grab a PS3 and declare that "You can't install your Nazi CSA program on this!" I'm going to ask you to leave, and contact my boss. If you work with the IT people, and are nice to them, it's easy to maintain your decent level of freedom and privacy (except for piracy, sorry) while at your university. If you make every attempt to side step it, abuse the network, and generally come across as a jerk, it's a fast way to get your internet usage permanently rescinded.
  • by Animats (122034) on Saturday June 06, 2009 @05:25PM (#28236581) Homepage

    The real problem with this is that the University is asking the student to download and run software without properly identifying what it does. That's called "badware" by StopBadware [stopbadware.org], run by the Harvard Law School, Consumers Union, etc. Phrases like "exceeds authorized access" apply. And remember, this is a state school; they face the legal constraints on state actors. For example, the rule that "Most political advocacy is unacceptable" [cmich.edu] is a blatant First Amendment violation as applied to students. Report that to EULA Watch and the ACLU. The ACLU is already dealing with some other suppression of free speech by the CMU administration [aclu.org], so this probably won't surprise them.

    It's not even clear whose Client Security Agent [cmich.edu] they're talking about. There's one from Cisco, one from Bradford, and one from Microsoft. The description mentions that it turns on Microsoft's automated updating. That means all the latest Microsoft security holes (like the one that makes Firefox execute Microsoft .NET content) are opened up.

    Someone compared this to working for a company. It's not. As a student, you're the customer, not an employee. Also, in a corporate setting, if Central IT messes up your desktop machine, Central IT has to fix your desktop machine.

    • Re: (Score:3, Insightful)

      by Deathlizard (115856)

      from the URL, It looks like Bradford Campus Manager. [bradfordnetworks.com]

      It's what we use for remediation at the college where I work, and that URL, Particulary the Remediation part, is the same area that Bradford puts their CSA.

      I can only say how we use the system, so I can't vouch for cmich or other school networks, but we pretty much use BCM for these purposes.

      1) Check for patches on a system.
      2) Check for the university supplied Virus scanner and how up to date it is.
      3) Send messages to users. Specificially as part of our em

  • by nathana (2525) * <nathan@anderson-net.com> on Saturday June 06, 2009 @05:52PM (#28236761) Homepage

    Okay, so it's not ideal, but here's what you can do that doesn't require running a virtual machine on your primary PC, or a dual-boot-into-Windows to run the scanner/authenticator software every once in a while scenario:

    Get yourself a cheap-ass PC. Throw two ethernet NICs in it. Install a new copy of Windows XP, and any software that your campus IT staff require to be installed on there. Then run Windows XP Internet Connection Sharing (ICS) on the unused ethernet adapter. (ICS is a small DHCP server + NAT engine built into Windows.) Plug that into a switch along with your main computer or computers, and use the XP box running ICS as your router.

    Then from the university's perspective, you have a single Windows XP box hooked up which is clean and conforms to their standards for network access. Unless the software that you need to install prohibits ICS from functioning, and there is no way around the artificial restriction, they won't know about the PC or PCs you have running behind the ICS machine.

    • Re: (Score:3, Informative)

      by jonwil (467024)

      Except that the link in TFA for the CSA clearly says "Remove Network Bridging" which would include Internet Connection Sharing.

  • So what? (Score:3, Insightful)

    by Zaphod-AVA (471116) on Saturday June 06, 2009 @07:08PM (#28237235)

    You are all getting your knickers in a twist over nothing.

    The client (assuming it's similar to the Cisco Clean Access Client I'm familiar with) simply checks that Windows machines are patched and running up-to-date antivirus. Remember Blaster? That thing ate college networks. Since then network policies have gotten a bit stricter. If you read them, they are trying to protect you, and cover their own ass.

    The short version of the policy: Don't do anything illegal. Run this stuff so we can make sure the network stays virus free. Don't be a jerk. If you break these, we can kick you off our network.

    If you are seriously concerned about it you are paranoid. Paranoid people should grab a cheap netbook and use that on the school network, and keep your precious personal data on a different machine. Any of that Nat/VM/router shenanigans others have suggested is violating their policies, and risking problems on their network that those policies are crafted to avoid.

  • by starfishsystems (834319) on Saturday June 06, 2009 @07:49PM (#28237475) Homepage
    Okay, as the person who wrote the first implementation of my university's longstanding Accepable Use Policy, let me ask a fundamental question:

    In what manner are student's personal systems permitted to access the Central Michigan University network that is different from how a hundred million ISP customers access the Internet?

    If there is no difference, then the university doesn't have a better case for control over theses personal systems than any ISP does. Yes, in order to fairly deliver the network service to its customers, the ISP or the university may control bandwidth or cap usage or perform other kinds of traffic shaping. Yes, it may monitor traffic for this purpose. There is no reasonable expectation of privacy when exposing such traffic on the network. There is also no reasonable expectation for these personal systems to be trusted. An appropriate policy would grant access to the network under these terms. Many universities do this, and treat this part of the network in every respect as an extension of the Internet. This is an effective policy.

    If on the other hand these personal systems are being granted some degree of trust or privilege merely by virtue of their presence on the university network, then we clearly see a misdesigned network and a corresponding misapplication of policy. There are parts of any organizational network that people don't get to just plug random equipment into. So don't sell access to these networks to the student population. Duh. If a research group wants to attach its supercomputer cluster to the Teragrid infrastructure, for example, it should be subject to a restrictive usage policy. That's the kind of scenario that most universities, including mine, envisioned when we drafted our usage policy. The same for an outside consultant who needs connectivity to the administrative servers in order to perform software integration. But this sort of policy would be completely inappropriate for a student who is simply getting an Internet connection through university facilities.

    So how about the following proposal for the university to consider? How about you don't give every student a bomb and you don't then require them to submit to random strip searches because of the increased security risk that you brought upon yourself? It's easy to avoid the whole problem in the first place.

  • Other solutions? (Score:3, Interesting)

    by mu51c10rd (187182) on Saturday June 06, 2009 @11:07PM (#28238677)

    Considering the many posts saying the CSA is a bad idea, it raises a question. The fact that students get their Windows machines infected with every virus, trojan, and rootkit imaginable, how else shouls IT departments handle it? In the corporate world, it seems easier. However, a network of user-controller machines sounds like an administrative nightmare. For those who think the CSA is a bad idea, what are your alternatives?

  • by PizzaFace (593587) on Saturday June 06, 2009 @11:42PM (#28238861)

    A private university might get away with this, but a public institution is constrained by the Constitution. I'd say that scanning your hard drive is an unconstitutional search, because there are less invasive means of keeping their network safe.

    I can't write your brief for you, but talk to the ACLU and the EFF.

  • by Craig Ringer (302899) on Sunday June 07, 2009 @12:49AM (#28239149) Homepage Journal

    It'd be nice to just run the agent in a VM and isolate your real system that way, but it wouldn't work because they'll almost certainly be filtering by MAC address.

    What you _CAN_ do is run the agent on the physical host with a minimal OS install, and then put everything else in a VM. Have the VM connect through the real host using NAT, so it has the same MAC address as the real host. The network won't know the difference.

If you think nobody cares if you're alive, try missing a couple of car payments. -- Earl Wilson

Working...