|
|
| (6 intermediate revisions by 3 users not shown) |
| Line 1: |
Line 1: |
| | | This was moved to https://develop.kde.org/docs/administration/kiosk/introduction/ |
| == Introduction ==
| |
| | |
| The KDE Kiosk is a framework that has been built into KDE since version 3. It allows administrators to create a controlled environment for their users by customizing and locking almost any aspect of the desktop which includes the benign such as setting and fixing the background wallpaper, the functional such as disabling user log outs and access to the print system and the more security conscientious such as disabling access to a command shell.
| |
| | |
| This kind of framework is vital to maintain and increase KDE's propagation into areas such as business and enterprise environments and school and university laboratories. Other obvious areas of interest where a restricted desktop environment is required or desired would be the likes of Internet cafés, public access terminals and kiosks. | |
| | |
| KDE's Kiosk framework is controlled by entries in various configuration files or through a GUI application, the Kiosk Admin Tool. In this article I will discuss the layout of KDE's configuration files and how to edit them to enable Kiosk's features. I will also discuss the various aspects of the desktop environment that can be customized and/or locked using the Kiosk framework. Once the reader understands how the Kiosk framework actually works through KDE's configuration files, we will discuss the Kiosk Admin Tool for those that prefer a GUI interface. This tool also allows administrators to more easily set-up Kiosk profiles and assign them system wide, per-user or per-group.
| |
| | |
| == KDE's Configuration File Structure and Hierarchy ==
| |
| | |
| All KDE applications use the same API to create, access and alter their configuration files. As such, all configuration files are stored in predetermined directories and they share the same syntax and structure. They are organised into groupings of key-value pairs. For example, let us examine some of the settings for the KDE desktop background stored in {{path|~/.kde/share/config/kdesktoprc}}:
| |
| | |
| <syntaxhighlight lang="ini">
| |
| [Desktop0]
| |
| Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
| |
| WallpaperMode=Scaled
| |
| </syntaxhighlight>
| |
| | |
| The <tt>Desktop0</tt> group as shown contains two key-value pairs to indicate the image to be used as the wallpaper and how it should be displayed. The beginning of a group is indicated by placing its name in square brackets and that group ends when the next one begins or when the end of the configuration file is reached. Both the key and its value may contain spaces but all whitespace immediately before and after the equals sign and at the end of the line are ignored.
| |
| | |
| KDE configuration files can be stored in a number of possible directories and configuration files with the same name may exist in the different directories. There is a predetermined order in which these locations are checked for configuration files and KDE combines configuration files of the same name on a key-by-key basis; this is known as "cascading configuration". If the same key is defined in more than one of the configuration files then the key value read from the directory tree with the highest precedence will be used.
| |
| | |
| Two [https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html|environment variables] are used to indicate which directories should be searched for configuration files: <tt>$XDG_CONFIG_HOME</tt> is a cross-desktop environment variable used to locate configuration files in the user's home. <tt>$XDG_DATA_HOME</tt> defines the directory where user specific data should be stored.
| |
| | |
| The cascading nature of KDE's configuration files allows system administrators to set system wide defaults while ensuring that the user's custom configuration settings will always override these system defaults. It is also the basis of the Kiosk framework as configuration entries may be marked as "immutable" - entries in a user's configuration file in <tt>$XDG_CONFIG_HOME</tt> that have been marked as immutable in a system level directory will not be read and will therefore have no effect.
| |
| | |
| Let us continue with the desktop background example and, as the system administrators of an Internet café, we want to ensure that our logo or our sponsor's logo is always the desktop background and that it cannot be changed by our customers. In one of the system level directory trees (<tt>$KDEDIRS</tt>), we would edit the file {{path|/share/config/kdesktoprc}} so that it contained:
| |
| | |
| <syntaxhighlight lang="ini">
| |
| [Background Common]
| |
| CommonDesktop[$i]=true
| |
| | |
| [Desktop0]
| |
| Wallpaper[$i]=/usr/kde/share/wallpapers/our_logo.jpg
| |
| WallpaperMode[$i]=Scaled
| |
| </syntaxhighlight>
| |
| | |
| Appending '<tt>[$i]</tt>' to the configuration key marks it as immutable. As configuration files from <tt>$KDEDIRS</tt> are read before <tt>$KDEHOME</tt>, the background is now "locked down" and and any custom settings made by a user in {{path|$KDEHOME/share/config/kdesktoprc}}, either directly or though a configuration dialog, will not be read by the configuration system.
| |
| | |
| Configuration options can also be marked immutable by group and by file. To mark a group as immutable, we append '<tt>[$i]</tt>' to the group name:
| |
| | |
| <syntaxhighlight lang="ini">
| |
| [Desktop0][$i]
| |
| Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
| |
| WallpaperMode=Scaled
| |
| </syntaxhighlight>
| |
| | |
| Similarly, we can mark an entire configuration file as immutable by placing '<tt>[$i]</tt>' on a line of its own at the beginning of the file; KDE will now ignore a configuration file of the same name in the user's KDE configuration directory.
| |
| | |
| | |
| Setting default configuration options for KDE applications is just as easy as fixing the desktop background. We could lock Konqueror's homepage setting to our Internet café's homepage by setting the following in a file called <tt>konquerorrc</tt> in one of the system directory trees:
| |
| | |
| <syntaxhighlight lang="ini">
| |
| [FMSettings]
| |
| HomeURL[$i]=http://www.myinternetcafe.com/
| |
| </syntaxhighlight>
| |
| | |
| Any setting that can be changed or customized in an application is one that can be locked down using the Kiosk framework. Examine the contents of the various configuration files that can be found under {{path|$KDEHOME/share/config/}} to get a feeling for KDE application configuration settings.
| |
| | |
| You should also bear in mind that most applications will need to be restarted for configuration settings to take effect. For changes to configuration files such as <tt>kdesktoprc</tt> and <tt>kdeglobals</tt> (introduced in the next section) you will need to log out and back into KDE for changes to be applied.
| |
| | |
| | |
| The information presented in this section will allow you to set system defaults and lock them if necessary for any KDE application. However, this is only the proverbial tip of the iceberg of the KDE Kiosk system and in the following sections we will cover many more of its capabilities.
| |
| | |
| == KDE Action Restrictions ==
| |
| | |
| Many actions in KDE applications and Plasma can be restricted through the Kiosk system by placing appropriate entries in the
| |
| All KDE actions can be restricted through the Kiosk system by placing appropriate entries in the {{path|kdeglobals}} file in a system level directory, such as {{path|/etc/xdg/kdeglobals}}. We could disable the file open action by adding the following entry:
| |
| | |
| <syntaxhighlight lang="ini">
| |
| [KDE Action Restrictions][$i]
| |
| action/file_open=false
| |
| </syntaxhighlight>
| |
| | |
| This change can be visibly seen in Kate's 'File' menu and toolbar which are shown in Figs. 2 and 3.
| |
| | |
| <table border="0">
| |
| <tr>
| |
| <td align="center">
| |
| <img src="kiosk-lp/unrestricted.jpg" width="250" border="0" height="286" alt="Image of an unrestricted menu and toolbar" />
| |
| </td>
| |
| <td> </td>
| |
| <td align="center">
| |
| <img src="kiosk-lp/restricted.jpg" width="250" border="0" height="287" alt="Image of a restricted menu and toolbar" />
| |
| </td>
| |
| </tr>
| |
| <tr>
| |
| <td align="center">
| |
| Figure 2. <syntaxhighlight lang="text">file_open</syntaxhighlight> unrestricted.
| |
| </td>
| |
| <td></td>
| |
| <td align="center">
| |
| Figure 3. <syntaxhighlight lang="text">file_open</syntaxhighlight> restricted.
| |
| </td>
| |
| </tr>
| |
| </table>
| |
| | |
| The actions that can be restricted include all standard file options, editing options, Internet and file browsing actions, the use of bookmarks and access to the help system. A comprehensive list can be found in the [[KDE_System_Administration/Kiosk/Keys|Keys page]].
| |
| | |
| A few other actions that are worthy of individual mention in the context of corporate and similar environments are:
| |
| | |
| ;<tt>shell_access</tt>
| |
| :Defines whether the user can start a shell for entering commands, whether the “Run Command” option (Alt-F2) can be used to run shell commands and arbitrary executables and whether executables placed in the user's Autostart folder will be executed.
| |
| | |
| ;<tt>logout</tt>
| |
| :Defines whether a user will be able to end the KDE Plasma session.
| |
| | |
| ;<tt>lock_screen</tt>
| |
| :Defines whether a user will be able to lock the screen.
| |
| | |
| ;<tt>run_command</tt>
| |
| :Controls access to the “Run Command” option.
| |
| | |
| ;<tt>movable_toolbars</tt>
| |
| :Whether or not toolbars can be detached and/or moved around.
| |
| | |
| ;<tt>action/options_show_toolbar</tt>
| |
| :Whether or not toolbars can be hidden.
| |
| | |
| ;<tt>plasma/plasmashell/unlockedDesktop</tt>
| |
| :Whether or not widgets can be unlocked by the user. Unlocking widgets would allow the user to move around, add, and remove widgets, panels, launchers, etc.
| |
| | |
| In a public environment, set the action <tt>lineedit_text_completion</tt> to false so that text boxes and the “Run Command” dialog do not remember previously entered information. Do note that this will not affect 3rd party web browsers like Firefox.
| |
| | |
| == KDE URL Restrictions ==
| |
| | |
| The KDE Kiosk system allows system administrators to control access to specific URLs based on the referrer, the protocol, the host and the path through entries in the {{path|kdeglobals}} file. Although some of these tasks may be more appropriate for a proxy server or a firewall, this functionality becomes incredibly useful when you consider the fact that KDE treats all locations as URLs. For blocking access to websites, one might use the following example:
| |
| | |
| Note this, only affects KDE applications, such as Dolphin or Konqueror. Other browsers are not affected.
| |
| | |
| <syntaxhighlight lang="ini">
| |
| [KDE URL Restrictions][$i]
| |
| rule_count=2
| |
| rule_1=open,,,,http,*.hotmail.msn.com,,false
| |
| rule_2=open,,,,http!,webmail.college.com,,false
| |
| </syntaxhighlight>
| |
| | |
| The first rule blocks all http and https access to any URL that contains <tt>.hotmail.msn.com</tt> in the host part. Specifying one protocol will also match similar protocols that start with the same name; so specifying http will also include https. Rule 2 above blocks only http and thus forces the user to use https (assuming it is supported). The above rules could be used as a basis, for example, to block all access to third part web-based e-mail clients and force users to use a company or college provided virus-scanned e-mail account over https. If, for example, an Internet café took sponsorship from a search engine then its system administrators could use similar rules to block access to that search engine's competitors.
| |
| | |
| The format for URL restrictions is:
| |
| | |
| <syntaxhighlight lang="ini">
| |
| rule_N=<action>,<referrer protocol>,<referrer host>,<referrer path>,
| |
| <protocol>,<host>,<path>,<enabled>
| |
| </syntaxhighlight>
| |
| | |
| Any option that is left blank will match all by default. As we saw in the example above, wild cards may be used for host names. Specifying a path will match all URLs that begin with that path unless an exclamation mark is placed at the end of the path.
| |
| | |
| <p>
| |
| As I mentioned, KDE treats all locations as URLs: for example Internet addresses are URLs with the http or https protocol whereas local files on the hard drive are URLs using the file protocol. Access to the local filesystem can be restricted using rules such as the following:
| |
| | |
| <syntaxhighlight lang="ini">
| |
| [KDE URL Restrictions][$i]
| |
| rule_count=6
| |
| rule_1=open,,,,file,,,false
| |
| rule_2=list,,,,file,,,false
| |
| rule_3=open,,,,file,,$HOME,true
| |
| rule_4=list,,,,file,,$HOME,true
| |
| rule_5=open,,,,file,,$TMP,true
| |
| rule_6=list,,,,file,,$TMP,true
| |
| </syntaxhighlight>
| |
| | |
| These rules will only allow the user to browse and access files stored in their home directory. We also allow access to the temporary directory used by KDE to ensure normal operation. If you are implementing a security policy then these rules should be used in conjunction with other rules such as restricted shell access.
| |
| | |
| == KDE Control Module Restrictions ==
| |
| | |
| Almost all aspects of the K Desktop Environment can be configured and customized through the "System Settings". Each "group" of settings, such as "Screens", "Colours", "Fonts", etc as shown in Fig. 4, correspond to a system settings module and each of these modules can be locked down through the Kiosk framework.
| |
| | |
| As an example, a way of preventing users from changing their mouse settings would be to lock down that system settings module:
| |
| | |
| Add the following to the global kde5rc file, in the heirachy listed above.
| |
| <syntaxhighlight lang="ini">
| |
| [KDE Control Module Restrictions][$i]
| |
| mouse.desktop=false
| |
| </syntaxhighlight>
| |
| | |
| The users will not even see an option to configure the mouse in System settings.
| |
| | |
| Run the command '<tt>kcmshell5 --list</tt>' for a list of available modules and use the format <module-name>.desktop in the configuration file. In most public access/café environments, one will probably want to lock down almost all control centre modules.
| |
| | |
| Figure 4. The System Settings application interface.
| |
| | |
| == Closing Remarks ==
| |
| | |
| KDE's Kiosk framework is an essential tool for any system administrator who is maintaining or deploying the Plasma in a multi-desktop/multi-user scenario and/or in an environment where users cannot be trusted. By preventing users from changing default settings and locking down settings that may pose a security risk, a system administrator can significantly reduce the amount of time that will be spent "maintaining and repairing" each desktop as well as ensuring that each user has a common and familiar desktop environment every time they sit down to the computer.
| |
| | |
| {{CC-BY-SA}} © 2005 Barry O'Donovan
| |
| | |
| {{CC-BY-SA}} © 2016 David Edmundson
| |
| | |
| {{CC-BY-SA}} © 2016 Marco Martin
| |
| | |
| {{CC-BY-SA}} © 2016 Kai Uwe Broulik
| |
