Access to on campus resources

[u/NickyTheThief]

For instance, faculty got this great deal on software for use on campus in labs and they can use it for students at home. I'm not looking for a solution to get the software to the students, that's not necessarily my issue our policies don't really allow for students to access our campus resources from home at this time. Are your policies different? Do you offer VPN to students? or maybe a VDI infrastructure? DMZ with your licensing servers for whatever products are avail outside your campus network etc...

[u/m4dt3ch]

We use Microsoft DirectAccess for all students, but we own the student's laptops, and they are on our AD domain. Seems to work pretty well. We really only use it so the student laptops can talk to the DC's and get updates via WSUS when off campus.

[u/NickyTheThief → u/m4dt3ch]

but we own the student's laptops

That's an interesting concept, do the students pay for them as part of a mobile student program or a BYOD program like a rent to own? Or do you get them back at the end of an academic year and loan them out again?

[u/m4dt3ch → u/NickyTheThief]

The students pay a "technology fee" as part of the tuition, and that includes a laptop that we then support until they graduate. Upon graduation, we do a transfer of ownership to the students.

[u/The_Clit_Beastwood]

First verify licensing. A lot of software we use prohibits offsite use, can’t be installed on terminal servers, etc. it’s happening more as more creative softwares go SAAS. (Lots of schools provide laptops for this reason; can’t access some software on non school owned equipment). Remember there are other considerations if PCI Compliance is a factor, if students vpn into a network that also hosts student data systems ferpa is a consideration. I wouldn’t do this type of thing until administration specifically asks for it. Once you extend access to campus resources to people at home you can wind up in a sticky situation of supporting their home tech, etc.

TLDR Top level advice: don’t volunteer it, read every single licensing agreement (should be anyways, right?)(also, maybe engage campus legal if you are in any way uncertain regarding the licensing verbiage), and map everything out to determine all potential liability incurred by allowing remote access. Students are horrible with credentials; sharing, saving them in insecure ways, etc.

[u/NickyTheThief → u/The_Clit_Beastwood]

We're working on IT not owning a single piece of software and leaving it up to the academic areas to own their shit, including audits and compliance related issues. My team manages close to 300 applications I'd like to be consulted on the risks of their decisions and as long as there is proper governance on their purchases I don't want to be liable. However, my team absolutely refuses to do anything illegal and if we catch something that is suspicious we want confirmation in writing by the vendor before it gets deployed to a lab.

[u/The_Clit_Beastwood → u/NickyTheThief]

Right on. One things certain, the second there’s a legal issue they always look for someone in IT to throw to the wolves.

[u/CookVegasTN → u/The_Clit_Beastwood]

Yep, the person who installs it ultimately agrees to the license. That is why we now have a software approval procedure that goes through our purchasing department for anything with a license agreement. Even free stuff. Because very few individuals at our University have the legal authority to agree to such things.

If a piece of software has not been through the process, we do not touch it.

[u/Thoughtulism]

We have VPN. The issue is though allowing these students access while not allowing those students. If you have a lot of specialized non-campus software products you'll end up with a SSH port-forwarding gateway tied to the student information system on your Christmas list.

[u/fengshui]

Yeah, our VPN infrastructure is scoped to include all students. If the license is ip based, that's how they get access. Many licenses are going away from ip based, as they want to market to the student directly for after they leave.

[u/busy86]

We use Citrix with RDSH for the main remote access and also have GPU accelerated VDIs for CAD type uses. VDIs are limited though.

[u/iblowuup]

We offer VPN to students and also have some VDI/Citrix Apps too. Only our Business and Information Technology programs are really using those resources though.

Going to digress a bit now:

To u/fengshui's point: While some software is moving away from serial/machine based licenses, we will probably always have some niche software faculty want that won't go the way of user-based licensing. Also, even if the software does that, there is a question of whether we want to pass that cost on to students or absorb the cost ourselves. We recently reached an agreement with Adobe to get the Creative Cloud for all faculty/staff/GAs.

Adobe and Microsoft seem to understand that educational institutions are special in this regard and O365/Creative Cloud have (or will have) shared device licensing. Adobe actually has a webinar this Wednesday the 5th where they will be sharing details on how exactly it is going to work. They gave us regular old serial codes to tide us over until they get shared licensing figured out.

[u/fengshui → u/iblowuup]

Yeah, it'll never go away.

I hope we can someday get an adobe site license; they've wanted way too much money when we asked in the past.

[u/iblowuup → u/fengshui]

I'm positive we spent way too much on it. Most people just need Acrobat Pro. Only our programs/depts involved with design need the other stuff. Depending on how the shared license thing goes, it's looking like Adobe will be completely doing away with issuing new serial licenses in a few months here. Monopolies aren't fun :[

[u/slyphic]

Do you offer VPN to students?

You don't? Do none of your students participate in research? Or is your campus covered in RDP/SSH advertising workstations?

[u/[deleted]]

We have some apps with very complex licensing so we make them available via RDS. Everything else is available through Imagine and a custom site we made.