Sage Server with no internet access, need a creative solution

[wazkaren]

I could use some creative ideas from the Sage Wizards out there. This weekend I dropped my daughter off at college. I put together a Sage Server on an old desktop box for her (running Windows XP). It has no monitor and I was planning on running SageClient from her laptop to watch TV. But I discovered the college limits only one device at a time per ethernet port (and no switches or hubs allowed). Since she needs that port for her laptop the Sage Server can't update it's guide data. I guess I should have checked out the college rules before I invested all the money in the Sage server.

So rather than try to get around the college network rules and do this legally does anyone have any ideas on how to solve this?

My current thought is:
-When she's watching TV direct connect her laptop enet cable directly to the sage server PC. When not watching TV she connects the laptop back to the internet as usual.
-The problem is I still need someway to get guide data to the Sage Server. My thinking is for the LapTop to grab guide data when connected to the internet and save it. When direct connected to the Sage Server then Sage can import the guide data from the laptop (using XMLTV Importer maybe?).

As you can see I have a lot of holes I need to patch in my half-a**ed solution.

Does anyone else have any creative ideas? Can the Sage Server be run in a network recording configuration that takes it's recording schedule from the laptop when it's directed connected maybe? Other thoughts?

Thanks,
Greg

[elaw]

Greg,

How devious are you?

You could put a second network card in the Sage server, connect the laptop to it, and use internet connection sharing on the server.

Not the best solution, but sounds like it would meet the rules as you have described them... it's not a switch or a hub!

Edit: thinking about it a bit more, if she needs things other than the Internet on the laptop my idea wouldn't work. The opposite would work: if you can add an additional network adapter to the laptop, run ICS on the laptop and let Sage connect to the 'net through it.

[reggie14]

The college I went to had that policy too. I think it's silly, although I can understand why they wouldn't want rouge wireless AP's scattered about. I think the real reason for it is that they don't want people using wireless, and they know if they let people use NAT routers and/or switches people would just go out and buy a wireless router.

Seriously, don't bother going to the trouble of getting Sage working without an internet connection. Just go out and buy a NAT router (any wireless router will do), hook it up, clone the MAC address of your daughter's laptop, and turn off the wireless radio. While I wouldn't go so far as to say it's impossible to detect a NAT router on a network, it's pretty hard. The school's IT staff won't know about it, and even if they did they wouldn't care.

If you really want to blindly follow the college's rules there are things you could do. The first option would be to follow the letter of the law, but not the spirit. You could get a second network interface for the laptop (via USB, probably), and share the laptop's internet connection with the desktop. You could probably do this with the built-in internet connection sharing stuff that's in Windows XP, otherwise you might have to set up a proxy server or the routing functionality that's in XP Professional. But, this is essentially violating the policy, since the laptop is ultimately acting like a router.

Otherwise you're probably stuck with the XMLTV route. I used XMLTV back in 2003, but haven't looked at it since Sage got full guide data for the US. As you already seem to know, it's basically just a matter of downloading some files on the laptop and moving them to the desktop. You might have to do it manually, since it's not immediately clear how you could make it automatic. If you know any programming languages it probably wouldn't be that hard to write a simple little program that would run on each machine to pull over the files when the two machines are connected.

Still, just get a wireless router and turn off the wireless functionality. If it makes you feel any better, you can argue only one device is accessing the ethernet port at a time- the router (though, this is still technically true for a switch, and just a little less true for a hub). Saying you can only hook up one computer to an ethernet port is like saying you can only run one program at a time that will use a network connection.

[wazkaren]

Thanks for the reply guys. I actually had thought about sharing the connection through the laptop but since this is for my daughter I didn't want to put her in an embarrasing position. Even though it's unlikely she'd get caught I would really feel bad if she did. If it was just for me I'd do it in a heartbeat

I was not aware of the NAT router idea. I am not very saavy when it comes to networking so I don't know what the college IT could detect or not. They require a resident program (Bradford Campus client something or other) to be running on the computer in order to get network access. So I thought the IT dept could potentially be able to detect lots of things if they wanted to. Like they could check the IP address assigned to the lap top and see that it didn't match the address range for the campus network. Wouldn't that still be true with the NAT router? I agree that it's unlikely that the campus IT would notice or care about checking to this level but like I said, I hate to put my daughter at any risk. Especially since she is a freshman and is new to the whole college thing.

I was hoping there would be an eary Sage solution. I looked at the Network Encoder but I get the impression that the net connection needs to be there full time. It would be nice if the LapTop could setup the recording schedule and give it to the Sage Server and then let the server just run on it's own. But I'll take a closer look at the XMLTV route and see how that goes. I write s/w so that part is not a problem.

Thanks,
Greg

[GKusnick]

In your shoes, I would probably try explaining the situation to the college IT department and asking them what kind of solutions they'd find acceptable. If they're young tech geeks, they might find it an interesting challenge (particularly if your daughter is cute).

If it turns out they're not interested in helping and are just going to be jerks about it, there's plenty of time to try under-the-table solutions later. But I say give them a chance first to be helpful and show them you and your daughter are trying to do the right thing, rather than adopting an adversarial stance right from the getgo. Remember your daughter is going to have the deal with these folks for four years.

[wazkaren]

That's actually an excellent idea. Worst case they won't help and I'm back to where I am right now. Best case, they know the system and come up with a legitimate solution. So nothing to lose with this solution. Thanks!

Greg

[harco]

She could hook the server up at night when she's done on her laptop. The guide data is 7 to 14 days so she wouldn't have to have it connected all the time. Just long enough to update.

[reggie14]

GKusnick is probably right. Talk to somebody young at the help desk. They'd probably be more willing to tell you what you can get away with. In my experience, the higher-ups will just blindly refer you to the policy without clarifying it or working with you. Ultimately I think you'll be breaking policy, it would just be good to know if it's something that they actually care about. At my school they just didn't want people setting up rouge access points. Odds are pretty good that many of the student employees at the help desk are doing something to get around the one jack one device policy, and maybe they'll be willing to let you in on the secret.

They require a resident program (Bradford Campus client something or other) to be running on the computer in order to get network access. So I thought the IT dept could potentially be able to detect lots of things if they wanted to.

True, that could potentially make it tricky. In theory, though, it would probably work to hook up a router and set the laptop so it's in the DMZ. That way when the router gets traffic, like requests to the bradford client, it'll go to the laptop. It's sort of just a theory, but it seems like it should work. You'd also want to set up the router so it doesn't respond to any external requests, like pings. I think that's actually becoming pretty common to have routers come that way by default.

It's something you could try if you find out the IT staff doesn't actually go after people they find violating the policy. I knew the people that worked in the IT department at both schools I attended and I was more willing to take risks, since I knew even if I was caught nothing would happen to me.

Like they could check the IP address assigned to the lap top and see that it didn't match the address range for the campus network. Wouldn't that still be true with the NAT router?

Nope, that wouldn't work. NAT stands for Network Address Translation. Basically, everything behind the router looks like a single machine, with a single IP address (the IP address of the router). While the machines behind the router will have a IP address in a private range (e.g. 192.168.1.100), their requests which go from the router will be modified. That is, the source IP of a packet may start at as 192.168.1.100 at the computer, but once it goes through the router it will get changed to the router's IP, like 77.23.234.125.

I'm not saying you can't detect a NAT router, particularly when the network requires that you run client software on machines, but in general it's hard.

[evilpenguin]

Unless you go to MIT or something, the IT department is prolly 1 guy who knows what he's doing and 50 people without a clue hooking wires into switches. You'll never get caught, I did it for 4 years at my college

[Conejo]

Just did a GIS for Bradford Campus Manager System:

Campus Manager is a user-focused, network-based NAC solution that automates identity management, endpoint compliance, and usage policy enforcement for educational environments.

If your machine does not match the minimum security requirements for connection to the Southwest network then your machine will be put into a Remediation area until the problems are resolved. Internet access will be restricted to the sites from which updates, anti-virus and anti-spyware can be installed.

Bradford Campus Manager and the CSA Client do not monitor your system on a day to day basis. The CSA client program runs only when you initiate it to do its checks and then terminates. It does not install itself on your computer or allow us to keep tabs on your internet or computer usage.
EDIT: This statement was specific to a certain campus. See the last GIS item in this post.


Campus Manager identifies a rogue client as any MAC address on the system that is not registered to a name. You can disable all rogue clients, thereby forcing kids to register or never use the network. Secondly, in a VLAN environment and with our Dynamic VLAN switching tool, Campus Manager can be configured to switch all unregistered MAC addresses to a dead end VLAN which the IT director can set up. Schools using this solution now send rogues to a VLAN that allows them to only the registration page where they can register with the system or get off the network.

As long as they aren't using a VPN Client to traverse the hardware level, it sounds like you *could* substitute a NAT router with a cloned pre-authorized MAC address... and it would work. But if they require regular re-authentication... then you'd have to do that directly with the laptop.


EDIT: Or Not...
Campus Manager uses both persistent and dissolvable agents during the registration process and to assess endpoint compliance. Students, staff and professors, for example, will be required, as part of compliance, to install the persistent agent on their devices. Campus visitors would be identified by the system as “unrecognized users” and will have a dissolvable agent pushed to their device to establish identity and compliance.

Dissolvable. First time i've run across THAT as a software term. Probably created by the people who brought you Black Hat.

[wazkaren]

I also took a look at the Bradford website. There are lots of capabilities that I highly doubt the campus uses. But just seeing what is possible makes me not want to risk my daughter, even though I'm sure it's very low risk. I found this on their website:

Campus Manager can also provide continuous monitoring of endpoint devices for ongoing policy enforcement after network connectivity is established. For example, if unauthorized applications or files are downloaded or installed at some time after a device is allowed access to the network, Campus Manager is able to detect this and can take appropriate responsive actions automatically.
Response actions may include notifying the user of the policy violation, notifying security and/or network administrators of the policy violation, or limiting or disabling network access, among other potential actions.

So I think I'll try talking to the IT department first. If that fails I'll take a look at the XMLTV route next. If that's too much of a pain then I'll take a look at using a NAT router or Internet Sharing on her laptop down the road.

For now she'll just have to hook the Sage Box to the network overnight once a week or so.

Thanks for the help everybody,
Greg

[Conejo]

That... and all-too-soon she'll move to off-campus housing and have FIOS and be throwing keggers every other weekend. ..Or not.

[reggie14]

I also took a look at the Bradford website. There are lots of capabilities that I highly doubt the campus uses. But just seeing what is possible makes me not want to risk my daughter, even though I'm sure it's very low risk. I found this on their website:

That's a pretty fascist computer security policy. Is your daughter going to a small school? I can't imagine a major university getting away with this without some sort of significant student revolt (well, a geek student revolt). That sounds like very obtrusive software. It's essentially spyware. I think it would be funny if anti-spyware programs started marking it as such.

Also, I think you're overly worried about the risk. Yes, some schools say they will kick you off the network, but I've never heard of anyone getting kicked off after a first offense (especially for something as trivial as hooking up a router). I've done far worse, and have even gotten caught occasionally, and never got into any real trouble.

So I think I'll try talking to the IT department first. If that fails I'll take a look at the XMLTV route next. If that's too much of a pain then I'll take a look at using a NAT router or Internet Sharing on her laptop down the road.

If it gets to that point come back here and I'm sure we'll be able to give you some more details about these options. The Internet Sharing route probably wouldn't be detectable (unless the Bradford software checks for it, but it probably doesn't), but it sort of annoying. The router method probably isn't detectable either, if you set it up right. It's probably harder to set up initially, but would probably work a little better once it gets going.

And again, don't talk to the higher-ups at the school's IT department. They will almost certainly tell you you're not allowed to do what you want. The lower level geeks will be more helpful.

[wazkaren]

Funny you should mention moving off campus. A bunch of sorority girls helped us move in and are already recruiting her. She hadn't even gotten in the door yet!

[QueOnda]

Originally Posted by wazkaren

Funny you should mention moving off campus. A bunch of sorority girls helped us move in and are already recruiting her. She hadn't even gotten in the door yet!

All because of SAGETV? Wow, that's a good marketing slogan.

If you want to get in easy with a sorority, get SageTV.

[CollinR]

I would simply add a wireless PCI card to the server and have it supply the laptop wirelessly. Lock that puppy down though.

[wazkaren]

Hey, I think Sage is worth it! She has pretty much grown up with Sage and now that she has to do what the rest of the world does she sees how good she had it.

Yup, it's a small college (Utica College).

I have no doubt that I'm being over-protective of her. It's the first week she's gone so I'm more concerned than I normally would be. My guess is that in about a week or two she will be sick and tired of moving the cable and she will be bugging me to do something. Or she'll forget to do it and the first time she misses an episode of "Real World" I'll be getting a phone call. That's when the router will go in

Greg

[wazkaren]

Originally Posted by CollinR

I would simply add a wireless PCI card to the server and have it supply the laptop wirelessly. Lock that puppy down though.

I thought about that. I already have the wireless card. Of course now the computer is 100 miles away...

[mickp]

If I were trying to be a network fascist the first thing I'd do is implement 802.1x authentication per port. It wouldn't suprise me if this is how the bradford client works given what's been mentioned about dynamic vlan support.

If this is the case then it could be difficult to have it work with a nat device. The client may also pull nasty stunts (like the cisco vpn client) to disable all additional network interfaces .

Mick.

[sleonard]

Will she have any roommates? Do all of them have a PC? Just have one of the roomies register the Sage machine under their name.

S

P.S. I'm an IT guy at a local college, Mr. Penguin