I'm a teacher and IT person at a small K-12 school.

The students are not supposed to have phones, laptops or access to the network. However, students being students they will try to find a way around the rules.

The students manage to acquire the Wi-Fi passwords pretty much as soon as we change them. It becomes a game to them. Although they are not supposed to, they will bring their laptops and phones in and use the network. One of them will get the password, and it travels like wildfire throughout the school. It is sometimes as simple as writing it on a wall where the rest of the students can get the updated password.

What can we do to keep them out of the network? I'm considering entering MAC addresses, but that's very labourious, and still not a guarantee of success if they spoof the address.

Do any of you have any suggestions?

Some background:

There are four routers in a 50-year-old building (plenty of concrete walls). One router downstairs, and three upstairs. They are different brands and models (Netgear, Asus, Acer, D-Link) so no central administration.

The school has about 30 Chromebooks and a similar number of iPads. Teachers will use their own laptops (a mix of Windows Vista, Windows 7, and Windows 8 as well as a number of Mac OS X).

Some of the teachers are not at all comfortable with technology and will leave the room with their machines accessible to the students. The teachers will often leave their password off or even give it to the students when they need help. They will ask for help from the students when setting up a projector for example and leave them to it, there goes the security once again. No sooner that the teacher is out of the room than they'll go to the taskbar and look at the properties of the Wi-Fi router to get the password.

Enforce Consequences for Students Found on the Network

The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless. 

This should also cover the usage policies for the Teachers, including locking their computers when they are not present at the machine. You can also use Group Policy to prevent users from being able to view the WiFi password.

Technical Measures

The following consists of various options for limiting the use of student devices on the school network. The most effective is WPA2-Enterprise. The others are included because they may be effective enough in limiting unauthorized access by students and, depending on you particular network, may be easier to implement. 

However, the question suggests that the students are on the main network for the organization. Only WPA2-Enterprise is going to adequately protect your network from an attack of an unauthorized device. Once a PSK is known, a student has the ability to sniff teacher web traffic, and possibly capture email and windows hashes. Additionally, a malicious user could start attacking other machines directly.

WPA2-Enterprise

The best solution would be to implement WPA2-Enterprise, instead of using a pre shared key (WPA2-PSK). This allows individual credentials to be issued. This is implemented by installing client certificates on each machine. This requires a good bit of engineering and is not trivial to set up in larger environments. This page has some good pointers on how to deploy WPA2-Enterprise.

Captive Portal

As @Steve Sether mentioned, the Chillispot captive portal can be used to authenticate users once they have connected to the network. Although I don't have evidence to point to, I suspect such a portal can be bypassed by spoofing MAC and IP addresses. However, it does raise the difficulty and will be easier to manage than MAC Filtering on multiple devices. 

MAC Address Filtering

As you mentioned, MAC addresses can be spoofed, so the effectiveness of MAC address filtering is limited. However, many phones prevent spoofing the MAC address, so this will address some of the problematic users. The iPhone for instance, needs to be jailbroken before the MAC address can be changed. The hardest part of using MAC address filtering is going to be managing the list of allowed MAC addresses especially across multiple devices from various vendors.

I would also argue that there is 'legal' benefit of using MAC Address Filtering or a Captive Portal. It can be hard to claim a user was unauthorized to access a network when the password is written on a whiteboard. However, if a user has to explicitly bypass a security restriction, you have a stronger case against the activity.

Using an Internet Proxy to Prevent Unauthorized Uses of HTTPS

Implement a HTTPS solution that uses your own private key. You can install the corresponding certificate to the organization's machines and they won't notice anything different (though the organization should still tell the staff that HTTPS interception is occurring). However, unauthorized devices without the certificate will get a nasty message about HTTPS being invalid whenever they try to browse a secure page. Additionally, since you are decrypting the HTTPS traffic, you will be able to monitor the traffic. For instance, seeing which students log into Facebook will allow you to address those students directly.

Many Content Control implementations offer the ability to decrypt HTTPS traffic. If the school already has a Content Control mechanism in place (such as Bluecoat or Net Nanny), talk to your vendor about how to implement this feature.
