A few years back, I was in a school within a community with a large cluster of open WiFi networks. The problem we had was students dropping off the filtered School WiFi and connecting to one of the neighborhood networks.
To address this issue, I created a script to ensure that students would get kicked off any other network if the school network was available. The attached Flow chart illustrates the logic of the script.
The script is below without any modification from it's original use. Note that in the FlowChart it checks to see if a device was allowed on the internet...and reads that info from a public fileserver..but that's another discussion.
The individual functions line up with the flow chart boxes. The script was triggered using a launchd item (which follows) which triggered on a network change.
#! /bin/bash
#########################################################################
# #
# manage wifi networks #
# #
# #
# #
# Del Brown #
# 2011 #
# delbrown@me.com #
# #
# #
# #
# #
# #
#########################################################################
# Define Variables Here
# Set the approved Wireless Network Name(s) in the WifiWhitelist variable
WifiWhitelist="Lyman_Moore_MS Lincoln_MS King_MS ProjectOffice"
# Set the Location of the AccessList file which determines if student is allowed internet access
#AccessCheck="http://www.delbrown.net/mlti/AccessList"
AccessCheck="http://staff.portlandschools.org/brownde/mlti/AccessList"
########################### DO NOT MODIFY BELOW THIS LINE ###############################
#check for current WiFi name
MyWifi=`networksetup -getairportnetwork Airport | awk '{print $4}'`
WifiAvailable=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -s | awk '{print $1}'`
# This can also be based on the serial number if you wish
#Asset=`ioreg -l | grep IOPlatformSerialNumber | sed 's/"//g' | awk '{print $4}'`
Asset=`nvram asset-tag | awk '{print $2}'` #this is where I have stored the Asset Tag Info
# Check for Access
Access=`curl -sf $AccessCheck | grep -i $Asset | awk '{print $2}'`
# Get Working Directory
WorkDir=`dirname "$0"`
# End of Variable Definitions
########################### Functions ###########################
disconnect ()
{
# Notify user that the network is not approved and disconnect from the wireless network.
./BigHonkingText $MyWifi is not an approved Network
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -z
exit 1
}
atSchool ()
{
# test to see if the Asset is at school by scanning for school networks and see if one is the school
for ScannedNetworks in $WifiAvailable
do
for SchoolNetwork in $WifiWhitelist
do
if [ "$SchoolNetwork" == "$ScannedNetworks" ]
then
AssetAtSchool="Yes"
return
fi
done
done
AssetAtSchool="No"
return
}
onSchoolNetwork ()
{
# test to see if the school network has been joined.
# Call the disconnect function if a network outside of school is joined
for AllowedID in $WifiWhitelist
do
if [ "$AllowedID" == "$MyWifi" ]
then # Asset is on the school network
exit 1
fi
done
disconnect
exit 2
}
checkAccess ()
{
# look up the list to see if home access has been turned off
Access=`curl -sf $AccessCheck | grep -i $Asset | awk '{print $2}'`
}
########################### End Functions ############################
# Change to Working Directory
cd "$WorkDir"
# Is the Asset at school?
atSchool
if [ $AssetAtSchool == "Yes" ]
then
# Is the Asset on the School Network
onSchoolNetwork
fi
# If we get here then the computer is at home...or cannot connect to the school network
# Is the student allowed on the internet at home?
checkAccess
if [ "$Access" == "No" ]
then
disconnect
fi
# Everything is good and we can exit
echo "Everything is A-OK"
exit 1Net manage plist follows:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>net.delbrown.NetManage</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/delbrown.net/bin/NetManage</string>
</array>
<key>WatchPaths</key>
<array>
<string>/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist</string>
</array>
</dict>
</plist>
