User Permissions

[Paleo Pete]

I haven't found anything definitive, so I thought I might see if anyone here has some good ideas.

I set up two Mandrake 10 machines at a local coffee shop for Internet Cafe use, so far it seems to be going fairly well and no complaints, but someone is tinkering. We dumped Windows because I was removing spyware daily, I removed the icons to IE and someone put thaem back., Owner said "dump Windows and install Linux"...

It's a coffee shop, open till around 10PM or so, and someone has been playing around some. I've just about cut off the porn sites by using the hosts file, it's a public access location and someone was ignoring the notice tacked to the wall. I found around 50 or so 1-5MB video clips in the tmp folder and at least 30 cookies/history entries from various adult sites. As I said, that's mostly stopped using the hosts file except for one that is an IP address, which hosts won't stop. That's not a big problem, you would have to either find a direct link to it through Google etc or manually type in the IP address. I think it was only in cookies because someone hit a link from a different site to download a movie clip. Once I stop most of the "TGP" sites, I think 90% of the porn will stop.

Today I find someone has removed all desktop icons from one machine and when I try to manually recreate them they do not show up. The desktop folder (in Konqueror file manager) shows them to be there but they do not visibly appear on the desktop. Someone also changed one of the backgrounds, we use astronomical images from the Hubble and NASA sites, so we have something generic that shouldn't offend anyone, I don't like backgrounds and wallpaper but people think they have to have their eye candy... :rolleyes: I haven't found anything that will tell me how to shut down user access to desktop changes. I also can't find a way to get the icons back, Permissions were still set to the defaults, nothing in the Desktop Settings to globally hide icons.

The main thing I'm trying to find out is how to set the desktop so these twits can't change backgrounds and remove icons, it causes me a lot of unnecessary hassle to put them back. So far I haven't found a setting anywhere that will do it.

By the way I use a 8 character combination of random letters and numbers for the root password, I doubt if anyone has figured it out...and I don't see anything in the system logs that indicates root access other than when I used it. The coffee shop owner is the only other person with the password and he never touches it except to check email on the same public user account everyone else uses. He doesn't even bother to log into his personal user account, which I set up for that reason... I also have my own personal user account set up and passworded so I can use the forums and my user name and password are NOT available next time someone opens a browser. I'm on the second machine now, icons on it are still visible...

Anything you folks can come up with will be a big help, I'm going to simply remove the user account and re-create it, but that won't solve the problem, users will still be able to change backgrounds and remove icons. It'll happen again, this will be a recurring headache so I need to find out how to lock users out of any changes whatsoever. These two machines need web browsers and that's about it. They have Epiphany, Mozilla, Konqueror and one has Firefox, (the other will have it soon) I 'm using Firefox now. Those should always be available by desktop icon so customers don't have a hard time finding a web browser. (Hey where's the START button??? !!!) Otherwise I want to shut down all other access.

These are on DSL, anyone can use them and wireless is available for laptops. That hasn't been a problem so far.

Any ideas???

[pave_spectre]

Don't know if it will work offhand, so I'll try it on my test account when I get home, but you could try changing the ownership of just about eveything in that users home directory to root user and root group, and just allow read access only to the user. I'm certain there are a few things that the user will need write access to, but it should be possibleto figure out what they are reasonably quickly.

[pave_spectre]

I dont know if this will help any

Public Web Browser (http://www.linuxdig.com/howto/ldp/Public-Web-Browser.php)

A lot of the stuff for building a public web browser seems to utilise FVWM2 as the window manager.

[pop pop]

If internet access is the primary use here I have two words ... live CD. Knoppix would be a good choice. Before opening for business for the day, insert the CD, reboot, and connect. They can then only change what's there and it's only changed till you reboot. Change the main box to password required not autologin. That way if they try to get funny, they can't.

Of course, you may need a lock on the box to keep people from stealing the CD. :cool:

[pave_spectre]

Heres another link that might help though it may not work actually work with firefox later than 0.7 http://tln.lib.mi.us/~amutch/pro/phoenix/kiosk.htm

[Paleo Pete]

Serious reading there...looks like it has possibilities though. I don't think the Firefox idea would do much good since it was written for Windows and I'm dealing with Linux, but I'll read it anyway. Might have some useful ideas. FOr now I just deleted the user account, rebooted and re-created it. 10 minutes and it's back to fairly normal. Windows didn't last 2 weeks...

I'm wondering if this might have been a root kit. KInd of smelled like it...The bits I read so far of the first link look like that may have possibilities. If I can get it to start up a guest account with nothing but a browser, that might be workable. If it does work...

I like the Knoppix idea best though, and I can always make more CDs... :D I'll have to download it again though, the entire download folder was gone with knoppix in it, couple of other things, but nothing sensitive or irreplaceable.

Thanks for the input, now I have some reading too do...

[FastLearner]

Maybe I misunderstood something, but are all the users all using the same guest account? That wouldn't be wise, as one user could leave something behind to find out some info about another customer, come back later and retrieve the info, etc. Linux is designed to be multi-user to the highest degree, so why wouldn't the cafe use it like that? Since creating a new user in a pre-defined group is so blatantly easy with Linux, you could let each customer fill out a form (name, address, phone#) and confirm it with ID before they are given access to the system-you could give each customer their own userid to use each time they visit the cafe. Then, it doesn't really matter if they change their background or any other elements in their own home directory. Linux is great at protecting users from other users and at protecting the root account from accidental configuration changes--use it to it's full advantage.

Additionally I may have missed it, but I didn't see any mention of an application server, which would also not be a bad idea. By using X Windows, each customer could have their own X Window session, but the application would be running on the server (for each user at the same time). This would give you two benefits: 1) easier administration on one or two central servers and 2) The equipment needed for all of the "workstations" would not need to be high-caliber. Pentium II or III, 128 -256 MB Ram, etc. The only high performance machines would need to be the servers.

Just putting in my two cents...:)

[pave_spectre]

Linux is designed to be multi-user to the highest degree, so why wouldn't the cafe use it like that?

How much time would then be spent making accounts for everyone coming in, and then having to monitor and control all of those accounts to make sure nothing untoward was being done with them. Plus if people have personal accounts, there is a good chance they may come back next time and expect any files they have downloaded to still be there. A single account means only one place to look for unauthorised files or events.

In this environment, a single account makes securing it easier and reduces the amount of time and space required for backing up or restoring.

[pop pop]

Pete would have to hire an IT staff. :rolleyes:

[pave_spectre]

Another link for limiting users.

http://www.securityfocus.com/infocus/1575

[Paleo Pete]

pave_spectre pretty much pegged it. If 30 people wanted to use one of the computers in a week, that would mean creating 30 user accounts, then probably removing them again since you don't know if any one person will come back or not...way too time consuming.

For now I'm looking up info, it's 10 minutes to delete the trashed user account, reboot and recreate another. That's not too bad and it's been running fine for about 3 months with no problems until now, except for the adult sites I'm blocking with the hosts file. That didn't cause any trouble, it just isn't acceptable on a public machine...icons don't disappear by themselves though, so the desktop was trashed intentionally but this is the first time for anything malicious.

I'll be looking into it, for now recreating the account is not much fuss.

[FastLearner]

How much time would then be spent making accounts for everyone coming in, and then having to monitor and control all of those accounts to make sure nothing untoward was being done with them. Plus if people have personal accounts, there is a good chance they may come back next time and expect any files they have downloaded to still be there. A single account means only one place to look for unauthorised files or events.

In this environment, a single account makes securing it easier and reduces the amount of time and space required for backing up or restoring.

I know I am completely outmanned on this, but I can't help but think that it is more work to have to worry about cleaning up individual accounts at all. What is the problem if a user who comes in every day wants to have the file he downloaded still available? Sounds like a reasonable request to me, and it might help generate regular customers. Perhaps what I am thinking is it would be better to combine our two approaches by following these steps (and I know I'm going to get some more disagreeing comments, but I'm going to shoot this list out there anyway):

1) Create a carefully-defined user group with all restrictions applied (see Pave's link).
2) Each time a new user comes in, give them their own ID (I can't help but think you are all overreacting to the complications of this, as it is a one-liner at the command prompt and takes less than 10 seconds), and have that user tied to the restricted group (important).
3) Delete the group once a day or even once a week, which will clear out all of the home directories (again with one command at the shell prompt). This will clear out the home directories of all new account holders, which will certainly beat searching for malware and spending hours on a daily basis trying to track down improper files (even if it is only one account). How do I know the home directory will be the only place where the user can add garbage - because that's what you'll be setting up when you create all your restrictions. Deleting/creating one user account or deleting/creating one group each have exactly the same number of steps and take less than 10 seconds to do, so why not protect the users from each other, as well as protect your machines from each of them at the same time?
4) Create a new group with the same restrictions and start the process again.

What is not viable about this approach?

[Paleo Pete]

What is not viable about this approach?

1. I'm not there all day every day
2. The business owner does not want to have to go set up an account for everyone and does not have time. He's busy enough already. If he has to walk across the room and type for 10 seconds a customer is probably waiting...impatiently...not good...

It's 10 minutes tops to delete an account and recreate another one, if I have to do so once a month that's not too bad...if I can set it up so the user cannot change desktop, delete folders etc withoout jumping through hoops it would be nice. It's not quite as volatile a setting as a night club, so far we don't have people waiting in line to get to a machine, but now and then a prankster will turn up. I'm looking for a way to leave one public account running and ready and restrict access to desktop changes. Once I set up desktop icons for web browsers I want them to stay put. If I set a background I don't want to come in two days later and find a 640x480 pokemon picture stretched out to a 1024x768 desktop...

So far we're really considering Knoppix...reboot and it's back to normal. Can't get easier than that...

[FastLearner]

OK, I'm starting to see what your requirements are.

Instead of him having to walk across the room and enter a new account, I was thinking more along the lines of automating the process with a simple shell script. I am not sure if you have one central server or not, but if so, this would be easily possible. Otherwise, like you say, it may be too much trouble.

My vision is that you have a central server and delete all accounts automatically with the built-in cron tool every evening, and you could likewise create the accounts every morning - without having to lay a finger on the keyboard. Using a simple loop, you could set up, say 200 user accounts daily (say user1 to user200 for simplicity) at the start of business to be performed automatically each day.

But like you say, maybe this method doesn't exactly fit your particular requirements.

Another alternative (but pricey) could be to launch a network OS that is designed only for use with Internet Cafes. I've seen a few that the customer can use to order drinks, etc. while surfing without having to leave the terminal. But if your setup only consists of 2 machines, and probably won't get much bigger, than this would not be cost effective.

At any rate, I've really learned a lot from this thread, guys. Thanks...:) Meanwhile, I'm getting ready to take the leap from the CLI and start tinkering with the X Window system (KDE with my SuSE). I actually feel better that I already can navigate my way around the shell prompt fairly well, and I'm hoping that will ease my learing of the desktop GUI environment. We'll see!

[primorec]

Kiosk Admin Tool is a Point&Click tool for system administrators to enable KDE's KIOSK features or otherwise pre-configure KDE for groups of users

ftp://upload.kde.org/pub/kde/stable/apps/KDE3.x/admin/

http://extragear.kde.org/apps/kiosktool/

http://www.rocklinux.net/packages/kiosktool.html

[primorec]

http://webcvs.kde.org/kdelibs/kdecore/README.kiosk?rev=1.57&view=markup

[Paleo Pete]

Hehe...I just found kiosk admin tool myself, poking around for info and it looks like just what the doctor ordered. Was headed for this thread to post a link to it and see what these guys thought of it, and to bring it to their attention on case they need something of that nature sometime, looks like it will do exactly what I want.

Downloaded the RPM about an hour ago and will drop it on my USB drive so I can check it out later today. Thanks for posting the info, I'll be reading some of your links since I have to find out all I can about how to use it.