Xfce Forum

theongrey

Member

Registered: 2009-10-26

Posts: 2

Locking Down Xfce

Hello,

We are working with a client who wishes to provide a kiosk-style machine to several of their customers for reordering parts. We chose to use Ubuntu Linux with Xfce and Firefox. For the most part, we've had great success delivering what our client wants. There are a few items, however, that I am having trouble with. Hopefully someone here can help!

My problems:
1) Although we have Firefox running full screen with all keyboard shortcuts disabled, the client is still concerned about users getting to the desktop and changing the desktop background or any other user-level setting. We already have disabled the xfce4-panel so they can't change anything through that, but a user could, if they found a way out of firefox, right click on the desktop and get a context menu option for changing desktop settings. Can I remove that option? Or, better yet, how can I completely remove the desktop right-click menu?
2) In my configuration of this 'kiosk' session, I can't seem to get rid of the Session Settings window... it pops up every time the system starts. I could close it, but then how would I save the session? (Logout is disabled for the kiosk user... so can't save the session that way...) Is there a command line way to save the session, or otherwise edit the saved session so the Session Settings don't open on next boot?

Also, this isn't an Xfce problem/question, but maybe someone has a thought on it: How can I make sure Firefox can only browse http://localhost ? This is where the reordering application is and our client doesn't want them using it for a web browser (although the other firefox lock-downs should prevent that anyways).

Thanks for any advice you can offer!

s0ulslack

Member

From: Idaho

Registered: 2005-12-25

Posts: 291

Re: Locking Down Xfce

1.) Settings-> Desktop-> Menu tab
2.) Have you looked over Settings-> Session & Startup?  You might have to edit the session by hand, files are located in ~/.cache/sessions.  Also, poke over xfce4-session-logout --help

Not sure about the last one, I guess you could remove the name server (although if they were smart enough they could still use IP addresses) and specify specific hosts in /etc/hosts for ones that you actually need.

GL!

theongrey

Member

Registered: 2009-10-26

Posts: 2

Re: Locking Down Xfce

1) I was able to use this to disable the Applications menu in the context menu, but I can still get options like "Open Terminal Here", "Desktop Settings", "New Folder", etc... is there any way to get rid of those? Edit: I found that if you set the Desktop Icons to something other than None, close, then go back and set them to None, the context menu will be gone. Looks like it sticks, too.
2) Thanks! I was able to manually edit the files to get rid of the unwanted app.
3) Since the only host needed is localhost, I guess I could block port 53 (DNS) on the firewall... to at least discourage Internet browsing. I doubt these users are savvy enough to use IPs for browsing.... thanks for the suggestion!

ManOfSteel

Member

Registered: 2005-10-06

Posts: 104

Re: Locking Down Xfce

By localhost, you really mean 127.0.0.1?
Simply use one external firewall (the one on your router or a software firewall on your server) to block all in/out connections on port 80 for all these computers.