5

I would like to set up a guest account on my Ubuntu so that anyone could log in (no password) and browse the Internet. But the guest user should not be able to modify desktop configuration (remove desktop icons, change theme, and so on).

Is it possible? On one hand I need write permissions (browser cache), on the other - if write permissions to home dir are given, anything may get broken. Not mentioning running any malware by guest users...

And there is another problem - if anyone would like to download anything from the Internet - they should be able to insert a pendrive and save there.

One idea I have is to restore home directory from a preconfigured location - on logout. In a ramdrive or just delete and copy again.

I think there should be a ready solution to this but I could not find any. Could you please help?

Grzegorz
  • 151
  • 3

2 Answers2

2

Boot from a Live USB stick. A knowledgeable user could discover the hard drive but for casual users, this might suit your needs. There are several distros specifically for this; google for Linux kiosk.

I seem to recall that some versions of Ubuntu offer a guest login option which does precisly what you describe. You have to enable it in the login settings, but it was there at least in some Gnome-based versions (try 10.04 or 8.04 if it's not in 12.04).

tripleee
  • 7,506
  • 2
  • 32
  • 42
1

The desktop configuration files are somewhere in the home directory. It is probably more than just them that you should set read-only -- eg, also .bashrc. So figure out what those files are and just chown them to someone else, root or another user (you'll probably have to use sudo). Make sure they have permissions of 644 or 755 (they mostly will) and then test it; everything should work without needing to write, except when you go to configure, it will fail. How the desktop handles that is an important test.

goldilocks
  • 86,451
  • 30
  • 200
  • 258
  • This is real pain, to check every file, some need to be writable, some not. I think I would rather revoke write access to $HOME at all. But still the browser cache directory should be writable... – Grzegorz Feb 02 '13 at 21:30