Fw: Re: locking down the desktop

[Jim Kronebusch]

---------- Forwarded Message -----------
From: "Jim Kronebusch" <jim at winonacotter.org>
To: btabor <btabor at btownccs.k12.in.us>
Sent: Tue, 22 Jan 2008 09:22:11 -0500
Subject: Re: locking down the desktop

On Mon, 21 Jan 2008 08:01:32 -0800 (PST), btabor wrote
> All students log in the same (see the same desktop).
> Then they can navigate to their network folders.
> Obviously, from your "do you make sure they wipe themselves properly"
> comment, you
> do not understand the importance of not letting hundreds of teenagers save
> whatever they
> want to their school desktops. I am very new to Linux and trying to learn as
> I go. I thought
> signing up for this listserve would be helpful, but if you are just going to
> poke fun......I am thinking
> that this might not have been a good idea. I am just trying to figure things
> out and do the best
> I can. The high school computers with Edubuntu on them are looking a mess
> and everyone is
> complaining because the kids can save to the desktops, I was just trying to
> figure out a way to
> solve a problem that others have asked me to solve. If you feel the need to
> make insensitive comments, then I guess I am looking in the wrong place for
> answers.

I had a bunch of trouble with trying to keep our students desktops "clean" as well. 
Without meaning any offense, I think there are problems with students using the same
account that go beyond "clutter".  There are a lot of things that need individual
permissions to work correctly, say one student puts a USB stick into a machine, this is
likely going to show up on all desktops at once.  There are a lot of things that need
individual permissions to work correctly, I am afraid if you continue to run in this
fashion you will start to have problems.........wait a minute here......I should
probably verify that you are using terminal services and not stand alone
installations.....is that the case?  If not we should be offering a whole different line
of answers.  In LTSP configuration, you will have many problems with using a single
account, if these are stand alone, that won't really be a problem.  Please clarify this
part so we can offer better suggestions.

In either case you can install gconf-editor and use the already installed pessulus to
fine tune permissions.  I used gconf-editor to lock backgrounds, themes, icons, etc. 
However to completely lock down a machine's /home/user folder would take some scripting
likely at logout.  Maybe a script to run at logout that wipes /home/user and copies
/etc/skel back in.  The /etc/skel directory contains the default setup you want to
provide new users.  You can in this directory copy your theme settings, your menu
settings, your Firefox bookmarks, desktop icons, etc.  Then when a new user is created
the contents of this folder will be their default.  So you could wipe the folder on
logout and copy this default back in.  So you could do something as simple as lock the
Desktop folder and theme settings in gconf-editor to keep things looking pretty while in
use, then at logout wipe everything and set to default.

But again this would work best in a stand-alone setting, as in LTSP this could cause
problems if it happened while other users were logged in.  However if the LTSP setup had
individual users and permissions, then you could do this to every user on logout without
conflicts and not run into the other glitches either.

This is why Gavin is suggesting individual profiles for all users.  And trust me, even
though Gavin's comment seemed out of place, he can definitely be one of your biggest
allies in your use of Edubuntu.  Please don't leave this list due to one silly comment,
this is truly a very helpful community.  Unfortunately personal humor is hard to read
correctly in an email setting.  And trust me, as I work in a high school, I know how bad
a desktop can look after a few days, especially if they stretch a bunch of photos and
cover their desktop.  But another benefit of individual user logins is you then will
know which user to scold when it happens :-)

Jim
------- End of Forwarded Message -------


Jim Kronebusch
Cotter Tech Department
453-5188


-- 
This message has been scanned for viruses and
dangerous content by the Cotter Technology 
Department, and is believed to be clean.