Lock down all programs besides web browser

Question

I am building some kiosks, running ubuntu, that will host an intranet site. What is the best way to allow access only to an Internet browser, and no other applications?

Answer 1

Custom Install

I'd guess a relatively efficient way (depending on the number of machines, this is only useful if you're setting up 10+ I'd guess) would be to do the same custom-install on all of the machines with only Firefox or Chromium installed by default:

• You need a sudo password to install software from the software centre so they won't be able to install anything else.
• You can reuse the same customised live-CD/USB for each. Theres already a post on AskUbuntu here on customising live-CD's.

Start-up disabling on a guest account

You could set a script on system start-up that disables all applications without having the sudo password other than your internet browser, things to note:

• You may need to disable Nautilus unless you plan to let them move files around or download and use files, up to you really.
• As a precautionary measure you may want to disable the open terminal keybind (Ctrl+Alt+T) to make sure people can't mess around using the terminal while on the guest account, though if you've set up the guest account correctly, this is slight overkill.

In the custom install you won't need to worry about creating accounts as all accounts will need your sudo password to do things other than access the internet. However if you want to modify the install it will make things more of a pain as you'll have to re-enable everything using the terminal and your sudo password each time. Up to you to choose which suits your needs better.

Answer 2

One way to do that is to open a terminal and run a few commands. First you want a "guest" user. To make our user you do: sudo adduser guest

add any information that would be applicable in the terminal. Then what you want to do is a chmod to change the security of the drive. sudo chmod o=wx /

o=other than root wx=write and execute. The guest user needs to be able to execute files in order to login. They will not be able to view any of the system files though. You can then add the web browser to the desktop then remove the menu bar by right clicking on it then hitting remove.

That should work.