running Koha on a dedicated computer?
Hi, We've got a question that I hope can be answered here. We're currently running Koha on a Debian Linux PC. This PC is dedicated for patron use in the Library and is usually unattended most of the time. The problem we're having is that kids are constantly using this machine for playing games and web surfing. I'd like to lock down this PC so that it is used only for Koha. I've tried firewall rules to prevent general web browsing but apparently this can be defeated (how they do it I don't know). I've tried deleting the games links in the Linux desktop start menu but there is always the Terminal window that can be opened up to run programs. How can I set up this dedicated PC so that it can ONLY run Koha? This would mean disabling all options to execute everything other than Koha (via the web browser) and the option to log off/shut down/restart. Ideally, what I would like is to have a default user profile in Linux that, when logged in, would only allow Koha to run and nothing else. I could envision this as no icons on the Desktop or Panels and nothing in the Start menu except the Log Out or Shutdown choices. Koha would automatically start up on the web browser when this login profile is started. If I can get a user profile to do this, then I can have another user profile for Library staff to use that has a "normal" Linux desktop. Has anyone done this sort of thing in Linux? I'm willing to move to another distro if it is available elsewhere. I've also heard from a few years back that Linux firewalls (I am using GuardDog) cannot have user-specific profiles as Linux only supported a single firewall profile for all users. Has this situation changed more recent releases of Linux? Thanks for your help, Lee --------------------------------- Finding fabulous fares is fun. Let Yahoo! FareChase search your favorite travel sites to find flight and hotel bargains.
Hi,
We've got a question that I hope can be answered here. We're currently running Koha on a Debian Linux PC. This PC is dedicated for patron use in the Library and is usually unattended most of the time. You know of course that Koha is a client/server system, with the client being simply a web browser and the server usually running on a different machine. It is not clear to me whether the dedicated machine you are talking about is simply a terminal running a web browser and koha is actually running on a separate server , or whether it is a standalone machine running both the koha server and a web browser client.
The problem we're having is that kids are constantly using this machine for playing games and web surfing. I'd like to lock down this PC so that it is used only for Koha. OK, lets take playing games first. This actually needs to be split into two categories. The first is games that come as part of the system (i.e., part of Debian.) Luckily, Debian is very flexible in this regard; it is designed to be very modular so that only the things you use need to be on the machine. Assuming that no-one else needs to use
This should be quite doable and I will attempt to guide you on how it could be done. However, I will make a few assumptions since your exact situation is not entirely clear to me. H Lee wrote: the games, they can simply be removed using the system package tool (e.g.. apt). The other part of the games problem is games accessed through the web browser. This comes down to your second stated need; restricting the web sites that the browser can access to just the Koha system.
I've tried firewall rules to prevent general web browsing but apparently this can be defeated (how they do it I don't know). I've tried deleting the games links in the Linux desktop start menu but there is always the Terminal window that can be opened up to run programs.
The games links & terminal trick won't work once you remove the games as above. You are wrong about firewall rules to restrict browsing though, in practice firewall rules should _not_ be able to be defeated by the users (there are a couple of provisos though.) Firewall rules (using iptables) are installed as root (the machine administrative user) and can only be changed or circumvented by the root user. So the firewall will be as safe as long as users don't have access to the root account on the computer. To ensure the root user account is not compromised, you need to be sure the root password isn't known to any of the kids (so perhaps change it if you suspect it might be.) You also need to take steps to prevent the root account from being compromised in the future. It's actually quite difficult to prevent a knowledgeable attacker from compromising the root account if the computer is unattended and they have uninterrupted access to it for any length of time. However, there are steps you can take to make it more difficult, and if you take these steps it will prevent the vast majority of users from being able to compromise it. Some steps you might take to make your computer more secure include password protecting the boot loader (grub), password protecting the bios, removing removable drives (floppys, CD/DVD drives), removing, disconnecting or disabling USB ports. You might consider modifying the boot loader configuration so that a password needs to be entered each time the machine boots; thus a staff member needs to be notified each time the computer is restarted and can supervise the process. The thinking behind the above is that two of the more common methods of gaining root access are an ability to restart the computer and then modify or influence it's start-up process, especially if you can get get your own media into drives on the machine, and loading certain exploit programs (again using media the user can insert, or loading from the internet.)
How can I set up this dedicated PC so that it can ONLY run Koha? This would mean disabling all options to execute everything other than Koha (via the web browser) and the option to log off/shut down/restart.
Well, there are two ways to do that. You can either have some kind of mandatory user profile loaded to prevent users running programs they shouldn't, or you can just remove the programs altogether. Removing the programs altogether is the quickest and most secure way to do it, but obviously not every program can be removed using this method. You may need to use a user profile as well. Why do you want users to have the option of shut-down/restart as well? If there isn't really a need to let users do this, I would recommend against it. If it is needed, it can be left, but makes the system slightly less secure.
Ideally, what I would like is to have a default user profile in Linux that, when logged in, would only allow Koha to run and nothing else. I could envision this as no icons on the Desktop or Panels and nothing in the Start menu except the Log Out or Shutdown choices. Koha would automatically start up on the web browser when this login profile is started. If I can get a user profile to do this, then I can have another user profile for Library staff to use that has a "normal" Linux desktop.
This should be quite doable under any of the major Desktops/ Window managers. Does the computer run GNOME, or KDE, or something else? If so what? This would be the most time consuming aspect of securing the system, and it may be unnecessary if you do the other stuff I suggest.
Has anyone done this sort of thing in Linux? I'm willing to move to another distro if it is available elsewhere.
I do this type of thing with Linux on a regular basis, as do many others. I've found Debian to be one of the most flexable distributions and therefore best suited to this type of task.
I've also heard from a few years back that Linux firewalls (I am using GuardDog) cannot have user-specific profiles as Linux only supported a single firewall profile for all users. Has this situation changed more recent releases of Linux?
I'm not familiar with GuardDog. I normally use the "under the bonet" type tool called iptables. You are correct that firewall rules in linux are not user-specific, ie, they can only restrict the whole machine, and cannot place per user restrictions. However, the firewalling you need to do doesn't need to be user specific. You can simply lock the whole machine down to accessing koha only. When I talk about firewalling, I am talking about restricting internet (network) traffic flowing into and out of the machine. I am not talking about any other kind of restrictions on what a user or program can do. Those other restrictions are handled by the other methods I have referred to above, and I don't refer to them as firewalling. This is where the distinction of whether you have a standalone machine with both client and server on the same machine becomes important. If this is the case, the simplest firewall technique is to disconnect the internet from your machine. You might remove the network card (if it has one) when removing the CDROM etc. Otherwise, just make sure there is no network or dsl or whatever cable plugged into the machine in normal operation. If it is on a wireless network, it should be possible to disable the network in such a way that only root can re-enable it. Your computer may need a little tuning to work properly without a network. If it is taking a long time to boot or doesn't function correctly when not connected to the network, it may need some minor adjustments. However, it's perfectly possible to run Debian systems without a network connection; they are designed to be able to do this. If you _are_ running the machine as an unattended standalone machine with the Koha database right on it, and if the users have unfettered access and especially if they are gaining root access, note that your whole Koha system is at risk. A malicious user could destroy the whole database. Most users of course aren't malicious and they probably just want to play games. Still, you would want to check your backups if the data is important to you. If it is not a standalone machine and koha is really running somewhere else on the network, you will need to keep the network connection and firewall the machine. You can probably get what you need with a very simple firewall setup. You need to give the machine access to the remote host running the Koha server, and possibly also to its DNS and DHCP servers. Other than that, you can block all network access. The work required to do all this (excluding the user profile/locked down user desktop) should take an experienced Linux/Deiban admin less than an hour. In fact, once they have access to the machine and you've told them the passwords and requirements etc, they should have most of it done in around 15 minutes, and just be needing to tidy up, test and document. There's a list of Debian consultants linked off the Deiban website. Alternatively, you should be able to do it yourself by reading up on the tools and a bit of trial and error if you are that way inclined. There are plenty of Linux user groups, mailing lists and help sites which offer free assistance. However, the fine details of how to do it are probably not appropriate for the koha list.
Thanks for your help, Lee
------------------------------------------------------------------------ Finding fabulous fares is fun. Let Yahoo! FareChase search your favorite travel sites <http://farechase.yahoo.com/promo-generic-14795097;_ylc=X3oDMTFtNW45amVpBF9TAzk3NDA3NTg5BF9zAzI3MTk0ODEEcG9zAzEEc2VjA21haWx0YWdsaW5lBHNsawNxMS0wNw--> to find flight and hotel bargains. ------------------------------------------------------------------------
_______________________________________________ Koha mailing list Koha@lists.katipo.co.nz http://lists.katipo.co.nz/mailman/listinfo/koha
-- Alex King Linuxworks Phone: +64 3 473 1611 Mobile: +64 21 410 420
On computers dedicated as "opac only" we use the proxy settings in Firefox to only allow access to our catalog. If you are running Koha on the same computer that patrons are using to browse your catalog you could set the proxy to localhost and have all browser traffic end up at your catalog as a matter of course. this on top of iptables, as Alex mentioned, is an arrangement that works really well for us. To keep users from altering the proxy settings (and a bunch of other stuff) in Firefox we have altered the Firefox browser.jar file (in the Firefox /chrome folder) in such a way that only minimal browsing is allowed and all other controls are not available, such as menu "options" and context menus. It's really stripped down. If you'd like to obtain that .jar file I'd be happy to pass it along. It works great on our regular public-use internet computers as well (for ffox v1.5). We had really good luck with K-Meleon before that, using the same concept. Hope this helps! Kind regards, Sean - CCLSD, OR, USA
This should be quite doable and I will attempt to guide you on how it could be done. However, I will make a few assumptions since your exact situation is not entirely clear to me.
Hi,
We've got a question that I hope can be answered here. We're currently running Koha on a Debian Linux PC. This PC is dedicated for patron use in the Library and is usually unattended most of the time. You know of course that Koha is a client/server system, with the client being simply a web browser and the server usually running on a different machine. It is not clear to me whether the dedicated machine you are talking about is simply a terminal running a web browser and koha is actually running on a separate server , or whether it is a standalone machine running both the koha server and a web browser client.
The problem we're having is that kids are constantly using this machine for playing games and web surfing. I'd like to lock down this PC so that it is used only for Koha. OK, lets take playing games first. This actually needs to be split into two categories. The first is games that come as part of the system (i.e., part of Debian.) Luckily, Debian is very flexible in this regard; it is designed to be very modular so that only the things you use need to be on the machine. Assuming that no-one else needs to use
H Lee wrote: the games, they can simply be removed using the system package tool (e.g.. apt).
The other part of the games problem is games accessed through the web browser. This comes down to your second stated need; restricting the web sites that the browser can access to just the Koha system.
I've tried firewall rules to prevent general web browsing but apparently this can be defeated (how they do it I don't know). I've tried deleting the games links in the Linux desktop start menu but there is always the Terminal window that can be opened up to run programs.
The games links & terminal trick won't work once you remove the games as above. You are wrong about firewall rules to restrict browsing though, in practice firewall rules should _not_ be able to be defeated by the users (there are a couple of provisos though.)
Firewall rules (using iptables) are installed as root (the machine administrative user) and can only be changed or circumvented by the root user. So the firewall will be as safe as long as users don't have access to the root account on the computer. To ensure the root user account is not compromised, you need to be sure the root password isn't known to any of the kids (so perhaps change it if you suspect it might be.)
You also need to take steps to prevent the root account from being compromised in the future. It's actually quite difficult to prevent a knowledgeable attacker from compromising the root account if the computer is unattended and they have uninterrupted access to it for any length of time. However, there are steps you can take to make it more difficult, and if you take these steps it will prevent the vast majority of users from being able to compromise it.
Some steps you might take to make your computer more secure include password protecting the boot loader (grub), password protecting the bios, removing removable drives (floppys, CD/DVD drives), removing, disconnecting or disabling USB ports. You might consider modifying the boot loader configuration so that a password needs to be entered each time the machine boots; thus a staff member needs to be notified each time the computer is restarted and can supervise the process.
The thinking behind the above is that two of the more common methods of gaining root access are an ability to restart the computer and then modify or influence it's start-up process, especially if you can get get your own media into drives on the machine, and loading certain exploit programs (again using media the user can insert, or loading from the internet.)
How can I set up this dedicated PC so that it can ONLY run Koha? This would mean disabling all options to execute everything other than Koha (via the web browser) and the option to log off/shut down/restart.
Well, there are two ways to do that. You can either have some kind of mandatory user profile loaded to prevent users running programs they shouldn't, or you can just remove the programs altogether. Removing the programs altogether is the quickest and most secure way to do it, but obviously not every program can be removed using this method. You may need to use a user profile as well.
Why do you want users to have the option of shut-down/restart as well? If there isn't really a need to let users do this, I would recommend against it. If it is needed, it can be left, but makes the system slightly less secure.
Ideally, what I would like is to have a default user profile in Linux that, when logged in, would only allow Koha to run and nothing else. I could envision this as no icons on the Desktop or Panels and nothing in the Start menu except the Log Out or Shutdown choices. Koha would automatically start up on the web browser when this login profile is started. If I can get a user profile to do this, then I can have another user profile for Library staff to use that has a "normal" Linux desktop.
This should be quite doable under any of the major Desktops/ Window managers. Does the computer run GNOME, or KDE, or something else? If so what? This would be the most time consuming aspect of securing the system, and it may be unnecessary if you do the other stuff I suggest.
Has anyone done this sort of thing in Linux? I'm willing to move to another distro if it is available elsewhere.
I do this type of thing with Linux on a regular basis, as do many others. I've found Debian to be one of the most flexable distributions and therefore best suited to this type of task.
I've also heard from a few years back that Linux firewalls (I am using GuardDog) cannot have user-specific profiles as Linux only supported a single firewall profile for all users. Has this situation changed more recent releases of Linux?
I'm not familiar with GuardDog. I normally use the "under the bonet" type tool called iptables. You are correct that firewall rules in linux are not user-specific, ie, they can only restrict the whole machine, and cannot place per user restrictions.
However, the firewalling you need to do doesn't need to be user specific. You can simply lock the whole machine down to accessing koha only. When I talk about firewalling, I am talking about restricting internet (network) traffic flowing into and out of the machine. I am not talking about any other kind of restrictions on what a user or program can do. Those other restrictions are handled by the other methods I have referred to above, and I don't refer to them as firewalling.
This is where the distinction of whether you have a standalone machine with both client and server on the same machine becomes important. If this is the case, the simplest firewall technique is to disconnect the internet from your machine. You might remove the network card (if it has one) when removing the CDROM etc. Otherwise, just make sure there is no network or dsl or whatever cable plugged into the machine in normal operation. If it is on a wireless network, it should be possible to disable the network in such a way that only root can re-enable it.
Your computer may need a little tuning to work properly without a network. If it is taking a long time to boot or doesn't function correctly when not connected to the network, it may need some minor adjustments. However, it's perfectly possible to run Debian systems without a network connection; they are designed to be able to do this.
If you _are_ running the machine as an unattended standalone machine with the Koha database right on it, and if the users have unfettered access and especially if they are gaining root access, note that your whole Koha system is at risk. A malicious user could destroy the whole database. Most users of course aren't malicious and they probably just want to play games. Still, you would want to check your backups if the data is important to you.
If it is not a standalone machine and koha is really running somewhere else on the network, you will need to keep the network connection and firewall the machine. You can probably get what you need with a very simple firewall setup. You need to give the machine access to the remote host running the Koha server, and possibly also to its DNS and DHCP servers. Other than that, you can block all network access.
The work required to do all this (excluding the user profile/locked down user desktop) should take an experienced Linux/Deiban admin less than an hour. In fact, once they have access to the machine and you've told them the passwords and requirements etc, they should have most of it done in around 15 minutes, and just be needing to tidy up, test and document. There's a list of Debian consultants linked off the Deiban website.
Alternatively, you should be able to do it yourself by reading up on the tools and a bit of trial and error if you are that way inclined. There are plenty of Linux user groups, mailing lists and help sites which offer free assistance. However, the fine details of how to do it are probably not appropriate for the koha list.
Thanks for your help, Lee
------------------------------------------------------------------------ Finding fabulous fares is fun. Let Yahoo! FareChase search your favorite travel sites <http://farechase.yahoo.com/promo-generic-14795097;_ylc=X3oDMTFtNW45amVpBF9TAzk3NDA3NTg5BF9zAzI3MTk0ODEEcG9zAzEEc2VjA21haWx0YWdsaW5lBHNsawNxMS0wNw--> to find flight and hotel bargains. ------------------------------------------------------------------------
_______________________________________________ Koha mailing list Koha@lists.katipo.co.nz http://lists.katipo.co.nz/mailman/listinfo/koha
-- Alex King Linuxworks Phone: +64 3 473 1611 Mobile: +64 21 410 420
_______________________________________________ Koha mailing list Koha@lists.katipo.co.nz http://lists.katipo.co.nz/mailman/listinfo/koha
Alex King <alex@king.net.nz> wrote:
I'm not familiar with GuardDog. I normally use the "under the bonet" type tool called iptables. You are correct that firewall rules in linux are not user-specific, ie, they can only restrict the whole machine, and cannot place per user restrictions.
iptables can do per-user restrictions. From man iptables, in amongst the 'owner' module: --uid-owner userid Matches if the packet was created by a process with the given effective user id. Back to the original question: sounds like a web terminal is needed. I've done that in the past by running just X and a browser full-screen, with it set to restart X and the browser if someone quits it. No desktop environment, no window manager, no nothing. Some web sites can cause problems, opening new windows and other nasties, which you can't manage because you have no window manager, but if you control the only permitted site, that's not going to be a problem. I think there are X-terminal HOWTOs and similar at http://www.tldp.org/ I'd love to develop one of these again, if anyone's paying... ;-) otherwise, just take the idea and run with it. Hope that helps, -- MJ Ray - see/vidu http://mjr.towers.org.uk/email.html Somerset, England. Work/Laborejo: http://www.ttllp.co.uk/ IRC/Jabber/SIP: on request/peteble.
On Thursday 15 February 2007 22:37, H Lee wrote:
Hi,
We've got a question that I hope can be answered here. We're currently running Koha on a Debian Linux PC. This PC is dedicated for patron use in the Library and is usually unattended most of the time.
The problem we're having is that kids are constantly using this machine for playing games and web surfing. I'd like to lock down this PC so that it is used only for Koha. I've tried firewall rules to prevent general web browsing but apparently this can be defeated (how they do it I don't know). I've tried deleting the games links in the Linux desktop start menu but there is always the Terminal window that can be opened up to run programs.
How can I set up this dedicated PC so that it can ONLY run Koha? This would mean disabling all options to execute everything other than Koha (via the web browser) and the option to log off/shut down/restart.
Ideally, what I would like is to have a default user profile in Linux that, when logged in, would only allow Koha to run and nothing else. I could envision this as no icons on the Desktop or Panels and nothing in the Start menu except the Log Out or Shutdown choices. Koha would automatically start up on the web browser when this login profile is started. If I can get a user profile to do this, then I can have another user profile for Library staff to use that has a "normal" Linux desktop.
This is a Linux issue not a Koha issue. What you need is a kiosk environment and there is loads of info on the web about this. Basically lockdown the desktop. If your desktop is KDE, seek out kiosktool; if it's gnome, you need lockdown editor. Other X managers have similar tools. Ask yourself the question, "Why are games installed on the system?" If there is no reason to have them, uninstall them, that way your pupils can't play. To stop your koha user from surfing the web, you need to look at url redirection - basically every url entered gets redirected to your koha site. Again there is lots of info on how to do this on the web. -- Regards Martin Woolley ICT Support Handsworth Grammar School Isis Astarte Diana Hecate Demeter Kali Inanna ************************************************************* This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify postmaster@bgfl.org The views expressed within this email are those of the individual, and not necessarily those of the organisation *************************************************************
Hi, Thanks, everyone, for all of the helpful suggestions. I think I now have enough of the proper 'keywords' and jargon hints to allow me to do the further hunting I need. I apologize if my original email had insufficient information or clarity. The PC I refer to is indeed operating as both client and server. It is using the Mepis version of Debian running the KDE interface. The PC is used mainly by patrons in a limited 'self-serve' mode but is occasionally used by Library staff to perform other staff-type functions. We need the internet connection in order to access the Z39.50 servers that are configured in Koha. I had set up the Guarddog firewall to only allow ports 210 and 7090 access to the internet. This seemed to have successfully blocked out normal web surfing but allowed Koha to talk to the Z39.50 servers. Again, thanks for the great ideas; this will keep me busy for a while! Kind regards, Lee --------------------------------- Check out the all-new Yahoo! Mail beta - Fire up a more powerful email and get things done faster.
participants (5)
-
Alex King -
H Lee -
Martin Woolley -
MJ Ray -
spark＠cclsd.org