Need Guidance: Creating locked down browser only (kiosk?)

[oitsubob]

Hi!
Ever knew where you wanted to go but didn't know how to get there? That's where I'm at right now.

I'm fairly new to Linux customization and am trying to put together a Knoppix customization for a PC that will sit in our lobby at the guard's desk.

Since it will be in a semi-public space and not watched over 24x7, I need to make sure it's locked down. The only thing this machine should be used for is for the guard to access our online employee database (intranet site). Everything else, for the most part, should not be accessible.

Ideally, the machine would boot up and immediately start Mozilla and load the default web page.

I'm not looking for someone to do this for me, just guidance and direction. Unfortunately, I'm really not sure where to start and could use any advice you're willing to offer.

Thanks,

Bob

[poobaa]

http://www.knoppix.net/forum/viewtopic.php?t=9905

[oitsubob]

Poobaa,
You mention that your solution really isn't secure. For this application, security is essential.

Basically, I want just enough included to boot, obtain an IP Address, start a browser and load a web page. If possible, the user should be restricted from accessing any other site and/or, if possible, have all brower controls (and right click) disabled with the exception of a scroll bar. Then I can theoretically control where the user can go based on links within the web page.

There may also be a need in the future for things such as flash player and a pdf viewer that I might as well included now as well.

If I can get this to work, we'll likely make the CD image available to other company locations. Since I won't know what hardware they'll be using, I'd like for a wheel mouse not to be a required component.

Thanks Again...

Bob

[poobaa]

You will have to look at the WM2 configuration, or X server configuration to work out how to disable all of the break out options/key strokes. Removing access to a keyboard may help here.

Links is one way of handling where the user can go; a better way would be some kind of proxy server, or DNS settings. This will redirect all web requests to your pages.

Mozilla/Firefox is not a great way to do anything securely, they are designed for web browsing, and they will also let you look at local file systems, DL files etc. I did do some reading on using XML to lock down all the features, you can find the info on the Mozilla page.

Giving anyone access to a working network connection, is always going to be bad news. If you can segment the network so that the kiosks are not on it, you will be getting a much more secure solution. If a machine is compromised, all they can get to is you other kiosks, and maybe the web server.

Food for thought, I’m sure other people have other ideas (even better ones)

[Ghandalfar]

maybe this one?

http://prdownloads.sourceforge.net/m...1.iso?download

[oitsubob]

Well, I'm not usually one to cross post, but since I started this thread a couple months ago and found it again, I figured what's the harm in adding to it.

Anyway, I took Ghandalfar's advice and downloaded the Morphix/Firefox iso. After spending the day fooling around with it, it appears to be just about what I'm looking for. I would, however, need to make a few changes.

1) Change start-up background image and color of progress bar to match,
2) Boot Firefox into fullscreen mode less the title tab, add the printer icon and remove address/search bars,
3) Change default home page,
4) Disable the Firefox window resize while in full screen mode and/or take steps to prevent user from clicking on desktop to open a new Firefox window.
5) Disable Ctrl+Alt+Fn keys, and
6) Edit inittab to force user to login if they are able to crash X.

I'd like to try to do this myself if at all possible but don't really know where to start. Would someone be willing to guide me through the process? Any help would be very much appreciated.

Thanks,

Bob

[oitsubob]

Reading through Bendan's "How to make a single application morph", it describes how to change the bootsplash image by replacing the 'bootsplash-1024x768.jpg' and 'silent-1024x768.jpg' files in '/base/minitroot/bootsplash/images'. I'm assuming one is for the image and the other is for the progress bar.

If that's the case, we can scratch item 1 from the list

-Bob

[hurrells]

Hello.

I am very interested in this kiosk idea with a few local variations. If anybody is actively remastering knoppix or specifically for this type of idea. Please contact me to discuss a.s.a.p.

Here is what I can solve to date.

1. How to change home page. Changes file:
etc/X11/Xsession.d/45xsession

You will see Exec line for konqueror and you just change it to mozilla/firefox.
Firefox is not in the base knoppix 3.4 dist yet.

2. To remove the sidebar in mozilla. Hopefully firefox is similar.
Open file localstore.rdf and edit the sidebar elements to hidden="true".

/usr/share/knoppix/profile/.mozilla/knoppix/ujixazk6.slt/localstore.rdf

i.e.
prd5:/var/local/Knoppix_Custom# diff knoppix_src/usr/share/knoppix/profile/.mozilla/knoppix/ujixazk6.slt/localstore.rdf knoppix_files/localstore.rdf.k
50c50
< hidden="true" />
---
> hidden="" />
55c55
< hidden="true" />
---
> width="202" />
69c69
< <RDF:li>www.openoffice.org</RDF:li>
---
> <RDF:li>de.openoffice.org</RDF:li>


I would like to add the following to the list
1. I want to have the kiosk "reset" itself after N minutes of inactivity. I.e. if nobody is keyboarding/mousing then refresh/restart X11 back to the browser window. I would also like to shutdown (or reboot) the clients in the evening (something remote other than a cronjob) as I can etherwake them in the morning or when I install a new image.

I also have troubles with NFS if I stop/replace image and restart all the clients will eventually fail. Is this not possible to do?

2. I am also seeing a problem when my "kiosk" is left running overnight (>6-10hrs) where I get cloop errors at the clients and my network activity goes to 100%. This is a bad/showstopper and I am not sure why it happens.

My equipment is all good and resonably fast. Server P4;1Gb and Clients: PII;128Mb or more.

I'm really looking for help/assistance to get this going.

Cheers
Stephen

[Ghandalfar]

Can anyone provide mirror for firefox livecd - version2 ? It's < 200Mb

[oitsubob]

While I'm not in a position to provide an FTP mirror, I would like to download the new .iso when a mirror is available.

Thanks,

Bob