6:28 p.m.
I want to create a restricted user without password that can only use
a web browser.
I added a user named "visitor" and created in his home dir a file
.xsession that contains:
firefox
so that when he logs in, firefox is launched, and when he closes
firefox, he is logged out.
This works fine but he is still able to ctrl+alt+F(1-6) and log in to
browse the file system.
To prevent that, I tried to set /bin/false as the default shell for
that user in /etc/passwd but this also prevented him to log in
graphically.
Is there a way to be sure that "visitor" will only be able to browse
the web and not the file system ? any security issues ?
Thanks for help
6:52 p.m.
On Sat, 2005-02-05 at 19:28, Zacharie Elcor wrote:
I want to create a restricted user without password that can only
use
a web browser.
I added a user named "visitor" and created in his home dir a file
.xsession that contains:
firefox
so that when he logs in, firefox is launched, and when he closes
firefox, he is logged out.
This works fine but he is still able to ctrl+alt+F(1-6) and log in to
browse the file system.
To prevent that, I tried to set /bin/false as the default shell for
that user in /etc/passwd but this also prevented him to log in
graphically.
Is there a way to be sure that "visitor" will only be able to browse
the web and not the file system ? any security issues ?
Thanks for help
You found the big problem with giving someone access to a program, most
times they can find a way to escape that program and get a shell prompt.
You should probably look at setting of a chroot jail for that user. If
they do get to a shell prompt they will not really have access to the
real system. Solaris 10 has a very nice system for creating multiple
virtual systems on a box that are segregated from everything else.
Similar type thing can be setup under linux but not as easy.
Of course if you have a user that you don't trust with shell access why
do you want to give them browser access?
--
Scot L. Harris
webid(a)cfl.rr.com
A day without sunshine is like night.
7:18 p.m.
On Sun, 6 Feb 2005 01:28:50 +0100
Zacharie Elcor <zelcor(a)gmail.com> wrote:
I want to create a restricted user without password that can only
use
a web browser.
I added a user named "visitor" and created in his home dir a file
.xsession that contains:
firefox
so that when he logs in, firefox is launched, and when he closes
firefox, he is logged out.
This works fine but he is still able to ctrl+alt+F(1-6) and log in to
browse the file system.
To prevent that, I tried to set /bin/false as the default shell for
that user in /etc/passwd but this also prevented him to log in
graphically.
Is there a way to be sure that "visitor" will only be able to browse
the web and not the file system ? any security issues ?
Thanks for help
A relatively way to do this would be to use rbash (or "bash -r") as the
user shell. For details, see "man bash" and search on the word
"restricted".
cheers,
Robert
9:44 p.m.
On Sat, 2005-02-05 at 22:10, Gain Paolo Mureddu wrote:
Scot L. Harris wrote:
>You found the big problem with giving someone access to a program, most
>times they can find a way to escape that program and get a shell prompt.
>
>
Shouldn't /bin/null help here to avoid giving them a shell?
That should keep them from logging in at all. Which is very secure. :)
The problem is that in order to run the browser I think you have to have
a shell running. I suspect if you put the browser in place of the shell
in the passwd file it would not work. (might be worth a quick test
though)
I really think the best option is to try and setup chrooted access. If
they manage to get a shell prompt they are restricted in what they can
access.
--
Scot L. Harris
webid(a)cfl.rr.com
Forty two.
11:17 p.m.
On Sun, Feb 06, 2005 at 01:28:50AM +0100, Zacharie Elcor wrote:
I added a user named "visitor" and created in his home dir
a file
.xsession that contains:
firefox
so that when he logs in, firefox is launched, and when he closes
firefox, he is logged out.
I'd suggest something like
metacity &
firefox
so that you can actually get managed windows. You'll want to use the gnome
keyboard configurator though, to make sure there aren't surprise keystrokes
that launch apps or anything. (Metacity might not be the best choice, but
it's easily available.)
This works fine but he is still able to ctrl+alt+F(1-6) and log in
to
browse the file system.
To prevent that, I tried to set /bin/false as the default shell for
that user in /etc/passwd but this also prevented him to log in
graphically.
Instead, add this section (anywhere) in /etc/X11/xorg.conf:
Section "ServerFlags"
Option "DontVTSwitch" "On"
EndSection
Is there a way to be sure that "visitor" will only be able
to browse
the web and not the file system ? any security issues ?
It's difficult but possible. You'll probably also want to edit the firefox
chrome to strip down what it can access.
--
Matthew Miller mattdm(a)mattdm.org <http://www.mattdm.org/>
--> Fedora Users & Developers Conference, hosted by Boston University <--
February 18th, 2005 <http://fedoraproject.org/wiki/FUDCon1>
4:03 a.m.
On Sun, 6 Feb 2005 09:18:37 +0800, Robert Storey <y2kbug(a)ms25.hinet.net> wrote:
On Sun, 6 Feb 2005 01:28:50 +0100
Zacharie Elcor <zelcor(a)gmail.com> wrote:
> I want to create a restricted user without password that can only use
> a web browser.
> I added a user named "visitor" and created in his home dir a file
> .xsession that contains:
>
> firefox
>
> so that when he logs in, firefox is launched, and when he closes
> firefox, he is logged out.
> This works fine but he is still able to ctrl+alt+F(1-6) and log in to
> browse the file system.
>
> To prevent that, I tried to set /bin/false as the default shell for
> that user in /etc/passwd but this also prevented him to log in
> graphically.
>
> Is there a way to be sure that "visitor" will only be able to browse
> the web and not the file system ? any security issues ?
>
> Thanks for help
A relatively way to do this would be to use rbash (or "bash -r") as the
user shell. For details, see "man bash" and search on the word
"restricted".
I tried that but this had the same effect than using /bin/false as the
default shell
cheers,
Robert
5:06 a.m.
On Sun, 6 Feb 2005 11:03:46 +0100
Zacharie Elcor <zelcor(a)gmail.com> wrote:
On Sun, 6 Feb 2005 09:18:37 +0800, Robert Storey
<y2kbug(a)ms25.hinet.net> wrote:
> On Sun, 6 Feb 2005 01:28:50 +0100
> Zacharie Elcor <zelcor(a)gmail.com> wrote:
>
> > I want to create a restricted user without password that can only
> > use a web browser.
> > I added a user named "visitor" and created in his home dir a file
> > .xsession that contains:
> >
> > firefox
> >
> > so that when he logs in, firefox is launched, and when he closes
> > firefox, he is logged out.
> > This works fine but he is still able to ctrl+alt+F(1-6) and log in
> > to browse the file system.
> >
> > To prevent that, I tried to set /bin/false as the default shell
> > for that user in /etc/passwd but this also prevented him to log in
> > graphically.
> >
> > Is there a way to be sure that "visitor" will only be able to
> > browse the web and not the file system ? any security issues ?
> >
> > Thanks for help
>
> A relatively way to do this would be to use rbash (or "bash -r") as
> the user shell. For details, see "man bash" and search on the word
> "restricted".
I tried that but this had the same effect than using /bin/false as the
default shell
I'm surprised that rbash didn't do what you wanted, but whatever. The
only other thing I can suggest is that KDE has a "kiosk" mode. I haven't
tried it though, but have heard that it's good.
cheers,
Robert
7:37 a.m.
On Sat, 05 Feb 2005 22:44:54 -0500, Scot L. Harris <webid(a)cfl.rr.com> wrote:
On Sat, 2005-02-05 at 22:10, Gain Paolo Mureddu wrote:
> Scot L. Harris wrote:
>
> >You found the big problem with giving someone access to a program, most
> >times they can find a way to escape that program and get a shell prompt.
> >
> >
> Shouldn't /bin/null help here to avoid giving them a shell?
That should keep them from logging in at all. Which is very secure. :)
The problem is that in order to run the browser I think you have to have
a shell running. I suspect if you put the browser in place of the shell
in the passwd file it would not work. (might be worth a quick test
though)
I really think the best option is to try and setup chrooted access. If
they manage to get a shell prompt they are restricted in what they can
access.
If I chroot the restricted user, what are the minimum commands that
should be available in order for him to be able to run firefox ? is a
shell required ?
--
Scot L. Harris
webid(a)cfl.rr.com
Forty two.
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
10:56 a.m.
On Sun, Feb 06, 2005 at 02:37:51PM +0100, Zacharie Elcor wrote:
If I chroot the restricted user, what are the minimum commands that
should be available in order for him to be able to run firefox ? is a
shell required ?
If this is a dedicated kiosk machine, I don't see much value in chrooting
anything. Just keep your install minimal, and do the things I suggested.
--
Matthew Miller mattdm(a)mattdm.org <http://www.mattdm.org/>
--> Fedora Users & Developers Conference, hosted by Boston University <--
February 18th, 2005 <http://fedoraproject.org/fudcon/>
5:15 p.m.
On Sun, 2005-02-06 at 08:37, Zacharie Elcor wrote:
If I chroot the restricted user, what are the minimum commands that
should be available in order for him to be able to run firefox ? is a
shell required ?
>
Figure on including firefox and whatever plugins you allow them to use.
The nice thing is that you can pick and choose.
--
Scot L. Harris
webid(a)cfl.rr.com
nohup rm -fr /&
3:54 p.m.
I think I found a way to do it :
In my visitor's .bashrc, I added :
if [ -z $DISPLAY ]
then
logout
fi
If the visitor tries to log in graphically, he can only do what
firefox allows him to do (perhaps should I use a more simple browser
because of extensions my visitor could add) and if he tries to log in
via ctrl-alt-f1, he is logged out immediately.
On 2/7/05, Scot L. Harris <webid(a)cfl.rr.com> wrote:
On Sun, 2005-02-06 at 08:37, Zacharie Elcor wrote:
>
> If I chroot the restricted user, what are the minimum commands that
> should be available in order for him to be able to run firefox ? is a
> shell required ?
> >
Figure on including firefox and whatever plugins you allow them to use.
The nice thing is that you can pick and choose.
--
Scot L. Harris
webid(a)cfl.rr.com
nohup rm -fr /&
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
4:40 a.m.
On Sat, 2005-06-04 at 22:54 +0200, Zacharie Elcor wrote:
I think I found a way to do it :
In my visitor's .bashrc, I added :
if [ -z $DISPLAY ]
then
logout
fi
If the visitor tries to log in graphically, he can only do what
firefox allows him to do (perhaps should I use a more simple browser
because of extensions my visitor could add) and if he tries to log in
via ctrl-alt-f1, he is logged out immediately.
And supposing your visitor logs in using ssh with X forwarding turned
on?
Security is *hard* I'm afraid.
Paul.
--
Paul Howarth <paul(a)city-fan.org>
8:52 a.m.
On 6/4/05, Zacharie Elcor <zelcor(a)gmail.com> wrote:
I think I found a way to do it :
In my visitor's .bashrc, I added :
if [ -z $DISPLAY ]
then
logout
fi
If the visitor tries to log in graphically, he can only do what
firefox allows him to do (perhaps should I use a more simple browser
because of extensions my visitor could add) and if he tries to log in
via ctrl-alt-f1, he is logged out immediately.
On 2/7/05, Scot L. Harris <webid(a)cfl.rr.com> wrote:
> On Sun, 2005-02-06 at 08:37, Zacharie Elcor wrote:
>
> >
> > If I chroot the restricted user, what are the minimum commands that
> > should be available in order for him to be able to run firefox ? is a
> > shell required ?
> > >
>
> Figure on including firefox and whatever plugins you allow them to use.
> The nice thing is that you can pick and choose.
>
> --
> Scot L. Harris
> webid(a)cfl.rr.com
>
> nohup rm -fr /&
>
The question came up as to whether or not this is for a kiosk-type
machine. If so, I would recommend the Opera browser, because:
1) It displays sites very similar to a certain browser that many
people as familiar with.
2) It has a kiosk mode.
3) It does NOT have the extensions that you worry about in firefox.
4) It can be easily configured to enable/disable JS, java, etc...
The only problems that you may have are the advertising in the top
(though you could buy it to remove the advertising) and the fact that
Hotmail blocks Opera. I have not found a way to fool hotmail into
thinking that the browser is not Opera.
http://lyricslist.com/lyrics/pages/artist_albums.php/445/Sepultura
Sepultura Lyrics
8:57 a.m.
On 2/5/05, Zacharie Elcor <zelcor(a)gmail.com> wrote:
I want to create a restricted user without password that can only
use
a web browser.
I added a user named "visitor" and created in his home dir a file
.xsession that contains:
firefox
so that when he logs in, firefox is launched, and when he closes
firefox, he is logged out.
This works fine but he is still able to ctrl+alt+F(1-6) and log in to
browse the file system.
To prevent that, I tried to set /bin/false as the default shell for
that user in /etc/passwd but this also prevented him to log in
graphically.
Is there a way to be sure that "visitor" will only be able to browse
the web and not the file system ? any security issues ?
Thanks for help
What you need is OpenKiosk, an extension to Mozilla that we developed
at Brooklyn Museum, with contracted help from MozDevGroup. Check it
out at:
http://mozdevgroup.com/clients/bm/
Note that there is an official Mozilla extension for this in the
regular place, but it's hard to get Mozilla to update those pages and
so the version there is probably out of date.
10:33 a.m.
Dotan Cohen wrote:
On 6/4/05, Zacharie Elcor <zelcor(a)gmail.com> wrote:
>I think I found a way to do it :
>In my visitor's .bashrc, I added :
>
>if [ -z $DISPLAY ]
>then
>logout
>fi
>
>If the visitor tries to log in graphically, he can only do what
>firefox allows him to do (perhaps should I use a more simple browser
>because of extensions my visitor could add) and if he tries to log in
>via ctrl-alt-f1, he is logged out immediately.
>
>
>On 2/7/05, Scot L. Harris <webid(a)cfl.rr.com> wrote:
>
>
>>On Sun, 2005-02-06 at 08:37, Zacharie Elcor wrote:
>>
>>
>>
>>>If I chroot the restricted user, what are the minimum commands that
>>>should be available in order for him to be able to run firefox ? is a
>>>shell required ?
>>>
>>>
>>Figure on including firefox and whatever plugins you allow them to use.
>>The nice thing is that you can pick and choose.
>>
>>--
>>Scot L. Harris
>>webid(a)cfl.rr.com
>>
>>nohup rm -fr /&
>>
>>
>>
The question came up as to whether or not this is for a kiosk-type
machine. If so, I would recommend the Opera browser, because:
1) It displays sites very similar to a certain browser that many
people as familiar with.
2) It has a kiosk mode.
3) It does NOT have the extensions that you worry about in firefox.
4) It can be easily configured to enable/disable JS, java, etc...
The only problems that you may have are the advertising in the top
(though you could buy it to remove the advertising) and the fact that Hotmail blocks
Opera. I have not found a way to fool hotmail into
thinking that the browser is not Opera.
Hotmail blocks Opera?...why..what sense does that make?
-Phillip
10:39 a.m.
It makes sense to microsoft who wants Hotmail to be used by IE only
users, not the MSIE turn-on of Opera, which was written in Europe and
Microsoft sees them as a competitor and a harmful influence to their
browser.
Erich
just my 2 cents
Hotmail blocks Opera?...why..what sense does that make?
-Phillip
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
6892
days inactive
7012
days old
17 comments
11 participants
participants (11)
-
Dotan Cohen -
Erich Carlson -
Gain Paolo Mureddu -
Matt Morgan -
Matthew Miller -
Michael A. Peters -
Paul Howarth -
Phillip T. George -
Robert Storey -
Scot L. Harris -
Zacharie Elcor