Prevent clients from communicating with each other

Christof

Dear all, I'm up to use moodlebox for exams in programming (beginners, preparatory courses for university). Students have to write programs on a computer where they can test the programs. Of course, they should not be able to go into the www, but should be able to hand in their work in the end. moodlebox solves this perfectly. However, users should not be able to communicate which each other during the exam. At the moment, I prevent this with firewall rules on the clients, but this prevents me from looking what they are doing during the exam. What I would prefer is to allow the network clients only to communicate with the pi, not with each other, which is a pretty normal setup for a guest wifi. Is there any possibility to achieve this by changing the wifi settings on the pi?
Regards
Christof
P.S.: Many thanks for this project. I thought of building up s. th. like this, but this would have taken ages, then I found moodlebox and got it working in half an hour, this is perfect!

Ratna

Christof

Secure exams is a big topic among the teachers I work with too. Yes, MoodleBox is a portable examination environment too! May be one could make it secure more easily than the usual Moodle LMSs in the wide net.

Interesting, we never thought of the candidates communicating with each other through their client devices, laptops in our case. You know that the number of simultaneous clients is limited by the RPi hardware? From what I read the number is about 20. Since they are physically in an examination hall and the number is small, invigilation is doable and simpler than technical means, I would say. Our people look for unattended (no invigilators) because of the large classes.

Anyway, the NixOS woke my curiosity. I've never heard of it, otherwise an old distro-hopper. Could you explain the client setup a bit: Is the NixOS a VM? Why NixOS? What is the programming environment they need to install?

Nicolas

Hi,

Your use case is very interesting. Thanks for sharing it.

Can you confirm that communication between wireless clients is currently possible? Can you share a way to do such communication, so I can test what solution can be implemented? TIA.

Nicolas

It should be possible to enable AP isolation mode using the two following commands in the MoodleBox CLI:

sudo nmcli con mod WifiAP wifi.ap-isolation 1
sudo nmcli connection reload

In this mode, Wi-Fi clients cannot communicate.

Please test and give feedback!

Christof

Hi Nicolas, thanks for the quick reply. However, it does not help. I still can ping a client from another. On the other hand, I rethought it: Students work on prepared nixos-systems. They can ping each other as long as they want, but I can see no way to really communicate, since they do not have ssh on their clients or sth. else that could be used for communication. If two students manage it, I'll rate them A in computer science anyway. With regard to this, Isolation would be a nice to have, but no necessity.
Kind regards
Christof

Nicolas

Strange, according to the documentation, this should do it.

Did you try to reboot the MoodleBox too ?

Christof

Did that, did it now again not with "reboot" but "shutdown" and put the power of and then restarted. Changes nothing. Maybe a bug in mcli? Is there any file where these settings are stored and I can have a look with nano? The networkmanager.conf is just 3 lines and nothing that seems to be related to this.
In the end, I can live with this since students take part in the exam with provided computers where they have no software to communicate actually. The use case "writing exams with moodle box" could be interesting for many teachers, not only in computer science. If isolation worked, it would allow to let students use their own devices or at least those they use usually at school, which would minimize the effort to prepare the exam.

Nicolas

Christof Is there any file where these settings are stored and I can have a look with nano?

Yes: look inside /etc/NetworkManager/system-connections/WifiAP.nmconnection. You should see something like

[connection]
id=WifiAP
uuid=[REDACTED]
type=wifi
interface-name=uap0
timestamp=[REDACTED]

[wifi]
ap-isolation=1
band=bg
channel=8
mode=ap
ssid=MoodleBox

[wifi-security]
group=ccmp;
key-mgmt=wpa-psk
pairwise=ccmp;
proto=rsn;
psk=[REDACTED]

[ipv4]
address1=10.0.0.1/24,10.0.0.1
method=shared

[ipv6]
addr-gen-mode=default
method=shared

[proxy]

Christof

I found this file and it contains the line ap-isolation=1 as it should, so nmcli did its job and your suggestion was correct. However, there seems to be an issue with the networkmanager, that seems to rely on wpa-supplicant, if I got it right from https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/469
I found no solution for it and will use it as it is, what should not be a problem in my case as discussed above. Many thanks!

Nicolas

Thanks for the feedback @Christof. The issue you mention seems to be fixed in current version of NetworkManager.

Anyway, there's indeed a problem: I've tested myself and AP isolation doesn't work, but I couldn't (yet?) find the reason. At first sight, it seems wpa-supplicant doesn't take the setting in account. I'm continuing the investigation…

Christof

Hi Ratna, you can find nixos at https://nixos.org/ . it is a Linux, but you do not customize it with commands, but descriptive with a config file and a command (nixos-rebuild) that sets the new config-file in action. I find it easier to keep control of what is on the clients compared to other distributions. However, I came to nixos in connection with the idea to use moodlebox for my exams: For the exams, I start the clients with an os on a usb stick (last time: Ubuntu, before that a customized SuSE). I copied the sticks with dd, so they were identical. With moodlebox, that won't work, because I have to tell one user from another when they connect to the moodlebox. In nixos, I can also copy the sticks with dd, but then change the name of the machine and the user in the config-file. That would be more effort with another distro, I think.
I just came home from preparing an exam tomorrow. This is the first test for my moodlebox and my nixos-stick. See what will happen.