Hi,

Since I’m the only Linux user in the shop, I have been asked to put together a little test project. Unfortunately, I’m a newb and need some direction.

Here are the params, any advice would be great.

These are older PCs that sit on a winblows domain. Each has a 2GB processor, a gig or RAM, and usually about a 40GB hard drive.

I need to set them up so:

1) After login through KDM / GDM, Firefox fills the entire screen &
a. Only allows access to 3 predetermined websites (via Bookmarks?)
b. Any attempt to enter other URLs will default back to Homepage.
c. User cannot minimize Firefox or access desktop at all.

2) User will not have access to:
a. A task bar, any other apps, system services, or settings.
b. Logon / logoff capability (Start button or similar)
c. CTRL+ALT+DELETE or similar will bring up KDM / GDM, but only root account may reboot or shutdown the system.

d. Any other options on the “File Edit View…” bar (Only Bookmarks)

3) User cannot have the ability to mount floppies, thumb drives, or other external devices at all.

4) Machines are accessible via some kind of GUI based, secure, Remote Desktop or similar across winblows domain.

Can anyone recommend a distro? What really needs to be removed to make it more secure? Has someone already come up with something like this?

Thanks!

The short version of what you want is "kiosk mode". Firefox can be set to use the full screen, no task bars or buttons, and if you stop the auto-mount daemons, no external devices can be mounted, unless you're root. And you can limit the shutdown/reboot capabilities to just root, when you build the box.

Remote access can be done via VNC connection, too. The only sticky point I can see is the "only allow access to 3 websites". Since websites can theoretically run on any port, you can't just block port 80 (which WILL get most websites), so you'd probably have to run squid, and blacklist EVERYTHING, except those sites.

How you do all of this depends on the distro you pick. This http://www.linuxjournal.com/article/7718 is a bit old, but KDE supports kiosk mode, and is common across whatever distro you pick. I'm confident that Gnome has similar capabilities...