I run a small business and would like to use Linux for its free naturet. Is there a way to lock down linux using software or a whole distro that would prevent people from doing pretty much anything other than opening a web browser similar to Windows or ChromeOS. I would use ChromeOS, had it not been made by Google as I am not super keen on using something made by big tech.
Edit: This would be for employees and is exclusively about endpoint security, mot enforcing staying on task.
If you’re looking for a pure kiosk experience check out porteus kiosk, it’s a very stripped down distro that lets you choose Firefox or chrome and by default uses private browsing.
I’m sure if you need a whole desktop experience that’s also possible but i don’t know how
Porteus is cool. I messed around with it when trying to set up an idiot proof browsing pc for a relative.
Would this locked-down distro be used by customers or by employees? If it is being used by employees, there is no faster way to be hated than putting unnecessary restrictions on their logins. You don’t want that kind of workplace.
I simply do this:
-
Make sure they don’t get sudo/root privileges.
-
Remote mount their home directories (nfs).
-
Don’t add any restrictions beyond that. It is a waste of time and money.
-
Control the rest through company policy, usually clauses under the ‘Misuse of company network’ section.
-
Who cares if employees are browsing tik-tok or whatever if they’ve done all their work? That’s a work-allocation issue. If they haven’t done all their work then that’s already a solved problem. Either motivate them or performance manage them slowly towards the door.
-
Who cares if they want to install xyz software [in their home directory]? Chances are it’ll be a free boost for performance and/or morale.
All good points. Who the heck cares as long as your employees deliver their promised work on time?
I should add that you should however restrict data storage, mandate disk encryption, etc.
Agreed. I manage both of these transparently beyond the employee’s view. All the employee knows is that they have xyz free space to use on their profile.
Who cares if they want to install xyz software [in their home directory]? Chances are it’ll be a free boost for performance and/or morale.
This /really/ depends on your threat model. “xyz software in their home directory” could easily be “exfil tool that uploads all data employee X has access too, disguised as a meme template generator”
I was more worried on the cybersecurity side rather than the work allocation issue.
-
Back when internet cafés were still a thing, a common practice was to have a bunch of thin clients that would have no local storage and have them boot over the network. The environment would get wiped every time someone logged off.
You could do something similar. Cheap machines with no local storage. Bios settings that prevent any sort of booting from usb sticks and protect the bios with a password.
Projects like LTSP are designed for this.
You could boot the machines in a read only mode and just have the browser available. Perhaps also only allowing sharing of files through something like nextcloud where you could theoretically also lock down what type of files are allowed. Or at least be able to inspect the files that people are storing.
You will need to configure secure boot with your own keys, efistub and create a user with no sudo.
After that any selinux or apparmor distro will do.
What you are concerned about here is physical security so you will need to lock the bios, cut off the CMOS reset pins and probably solder the 3.3 battery.
Thank you!
I’ve found the gold standard to be the NCSC Guidelines. This covers everything around proper deployment of end user devices in an organization. https://www.ncsc.gov.uk/collection/device-security-guidance
They have clamp down configurations for Windows and Ubuntu, plus others. This is the Ubuntu page, but there’ll be lots of cross over to other distros https://www.ncsc.gov.uk/collection/device-security-guidance/platform-guides/ubuntu-lts
Their security configuration packs are hosted on GitHub so you can vet them first if you want https://github.com/ukncsc/Device-Security-Guidance-Configuration-Packs
ChromeOS sucks… I think its the worst OS I ever used
Almost agree, just Windows RT is worse.
I’m sure there’s a better solution, but SELinux is an option. It can be difficult to customize, but it’s capable of locking down the system entirely. You could theoretically block all actions taken by the user except for a select few
mozilla_tactions and others necessary for login.But how will they have time to learn SELinux and run a business?
Haha. Yeah it takes time to learn how to do even the most basic things with it. Just how I would approach the situation
I think avoiding ChromeOS is wise, that just puts Google in charge of your IT systems and leave you at the mercy of their data harvesting abomination of Linux loaded with proprietary software.
openSuse Aeon with a non-admin user. It’s an immutable distro that uses Flatpaks for apps and automatically updates in the background. I use it on my laptop and it’s great.
As long as you don’t give the users sudo powers there is little they can do to screw up the system.
But that would only make sense if you want them to have their own users. If it’s just a public computer, you probably want the kiosk thin mentioned before.
There’s also the risk of users saving and distributing confidential data. You don’t need admin rights for that! I’m not actually sure this applies to OP, but if he’s giving everyone a web browser, it certainly seems like a risk.
If Snowden can exfiltrate data from the NSA, there is simply no way for your average employer to prevent this through computer restrictions. Effort in that direction is a total waste of money.
This is a company policy issue, enforced through non-disclosure agreements and, ultimately, the legal system.
A cell phone can save and distribute data.
He didn’t say it was crazy confidential. I got the feeling it was more about keeping them from fucking around and breaking it.
Correct
NixOS
Good choice, just a little to sophisticated for a user coming from ChromeOS.
My apologies for the miscommunication; I wasn’t coming from ChromeOS, I was skating it as the only viable alternative, though undesirable.
for kiosk, there’s also https://github.com/cage-kiosk/cage
LiveCD? Take a look at that as a number of distributions give you a read only experience.
Fedora Silverblue is locked down desktop linux
Ngl I know you don’t want to use big tech but I think chromeOS is probably your best bet.
