KDE System Administration/Kiosk/Introduction - Revision history

AnneW at 15:57, 13 July 2012

2012-07-13T15:57:56Z

Interele: updates for 4.8

2012-06-10T18:05:42Z

updates for 4.8

Neverendingo: Text replace - "" to ""

2011-06-29T20:57:18Z

Text replace - "</code>" to "</syntaxhighlight>"

Neverendingo: Text replace - "`" to ""`


2011-06-29T20:47:55Z
Text replace - "<code>" to "<syntaxhighlight lang="text">"

				
				
				
				
			
			← Older revision
			Revision as of 20:47, 29 June 2011
			
Line 93:
Line 93:
  <tr>   <tr>
      <td align="center">       <td align="center">
−        Figure 2. <code>file_open</code> unrestricted. +        Figure 2. <syntaxhighlight lang="text">file_open</code> unrestricted.
      </td>       </td>
      <td></td>       <td></td>
      <td align="center">       <td align="center">
−        Figure 3. <code>file_open</code> restricted. +        Figure 3. <syntaxhighlight lang="text">file_open</code> restricted.
      </td>       </td>
  </tr>   </tr>



Neverendingo: Text replace - "" to ""

2011-06-29T20:38:21Z
Text replace - "<code ini>" to "<syntaxhighlight lang="ini">"

				
				
				
				
			
			← Older revision
			Revision as of 20:38, 29 June 2011
			
Line 13:
Line 13:
  All KDE applications use the same API to create, access and alter their configuration files. As such, all configuration files are stored in predetermined directories and they share the same syntax and structure. They are organised into groupings of key-value pairs. For example, let us examine some of the settings for the KDE desktop background stored in {{path|~/.kde/share/config/kdesktoprc}}:   All KDE applications use the same API to create, access and alter their configuration files. As such, all configuration files are stored in predetermined directories and they share the same syntax and structure. They are organised into groupings of key-value pairs. For example, let us examine some of the settings for the KDE desktop background stored in {{path|~/.kde/share/config/kdesktoprc}}:
    
− <code ini> + <syntaxhighlight lang="ini">
  [Desktop0]   [Desktop0]
  Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg   Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
Line 29:
Line 29:
  Let us continue with the desktop background example and, as the system administrators of an Internet caf&eacute;, we want to ensure that our logo or our sponsor's logo is always the desktop background and that it cannot be changed by our customers. In one of the system level directory trees (<tt>$KDEDIRS</tt>), we would edit the file {{path|/share/config/kdesktoprc}} so that it contained:   Let us continue with the desktop background example and, as the system administrators of an Internet caf&eacute;, we want to ensure that our logo or our sponsor's logo is always the desktop background and that it cannot be changed by our customers. In one of the system level directory trees (<tt>$KDEDIRS</tt>), we would edit the file {{path|/share/config/kdesktoprc}} so that it contained:
    
− <code ini> + <syntaxhighlight lang="ini">
  [Background Common]   [Background Common]
  CommonDesktop[$i]=true   CommonDesktop[$i]=true
Line 42:
Line 42:
  Configuration options can also be marked immutable by group and by file. To mark a group as immutable, we append '<tt>[$i]</tt>' to the group name:   Configuration options can also be marked immutable by group and by file. To mark a group as immutable, we append '<tt>[$i]</tt>' to the group name:
    
− <code ini> + <syntaxhighlight lang="ini">
  [Desktop0][$i]   [Desktop0][$i]
  Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg   Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
Line 53:
Line 53:
  Setting default configuration options for KDE applications is just as easy as fixing the desktop background. We could lock Konqueror's homepage setting to our Internet caf&eacute;'s homepage by setting the following in a file called <tt>konquerorrc</tt> in one of the system directory trees:   Setting default configuration options for KDE applications is just as easy as fixing the desktop background. We could lock Konqueror's homepage setting to our Internet caf&eacute;'s homepage by setting the following in a file called <tt>konquerorrc</tt> in one of the system directory trees:
    
− <code ini> + <syntaxhighlight lang="ini">
  [FMSettings]   [FMSettings]
  HomeURL[$i]=http://www.myinternetcafe.com/   HomeURL[$i]=http://www.myinternetcafe.com/
Line 74:
Line 74:
  All KDE actions can be restricted through the Kiosk system by placing appropriate entries in the {{path|/share/config/kdeglobals}} file in a system level directory. We could disable the file open action by adding the following entry:   All KDE actions can be restricted through the Kiosk system by placing appropriate entries in the {{path|/share/config/kdeglobals}} file in a system level directory. We could disable the file open action by adding the following entry:
    
− <code ini> + <syntaxhighlight lang="ini">
  [KDE Action Restrictions][$i]   [KDE Action Restrictions][$i]
  action/file_open=false   action/file_open=false
Line 106:
Line 106:
  Some KDE applications, such as system configuration front ends like KUser, need to be run as the root user. These applications would be unnecessary in an Internet caf&eacute; and they can be disabled with:   Some KDE applications, such as system configuration front ends like KUser, need to be run as the root user. These applications would be unnecessary in an Internet caf&eacute; and they can be disabled with:
    
− <code ini> + <syntaxhighlight lang="ini">
  [KDE Action Restrictions][$i]   [KDE Action Restrictions][$i]
  user/root=false   user/root=false
Line 138:
Line 138:
  The KDE Kiosk system allows system administrators to control access to specific URLs based on the referrer, the protocol, the host and the path through entries in the {{path|kdeglobals}} file. Although some of these tasks may be more appropriate for a proxy server or a firewall, this functionality becomes incredibly useful when you consider the fact that KDE treats all locations as URLs. For blocking access to websites, one might use the following example:   The KDE Kiosk system allows system administrators to control access to specific URLs based on the referrer, the protocol, the host and the path through entries in the {{path|kdeglobals}} file. Although some of these tasks may be more appropriate for a proxy server or a firewall, this functionality becomes incredibly useful when you consider the fact that KDE treats all locations as URLs. For blocking access to websites, one might use the following example:
    
− <code ini> + <syntaxhighlight lang="ini">
  [KDE URL Restrictions][$i]   [KDE URL Restrictions][$i]
  rule_count=2   rule_count=2
Line 149:
Line 149:
  The format for URL restrictions is:   The format for URL restrictions is:
    
− <code ini> + <syntaxhighlight lang="ini">
  rule_N=<action>,<referrer protocol>,<referrer host>,<referrer path>,   rule_N=<action>,<referrer protocol>,<referrer host>,<referrer path>,
       <protocol>,<host>,<path>,<enabled>        <protocol>,<host>,<path>,<enabled>
Line 159:
Line 159:
  As I mentioned, KDE treats all locations as URLs: for example Internet addresses are URLs with the http or https protocol whereas local files on the hard drive are URLs using the file protocol (for a full list of supported protocols, execute the command '<tt>kcmshell ioslaveinfo</tt>'). Access to the local filesystem can be restricted using rules such as the following:   As I mentioned, KDE treats all locations as URLs: for example Internet addresses are URLs with the http or https protocol whereas local files on the hard drive are URLs using the file protocol (for a full list of supported protocols, execute the command '<tt>kcmshell ioslaveinfo</tt>'). Access to the local filesystem can be restricted using rules such as the following:
    
− <code ini> + <syntaxhighlight lang="ini">
  [KDE URL Restrictions][$i]   [KDE URL Restrictions][$i]
  rule_count=6   rule_count=6
Line 174:
Line 174:
  Even in a default KDE setup, KHTML uses this system to warn when following links from untrusted pages (such as HTTP pages) to more local filesystems (e.g. smb or file). To disable this warning, for instance if your intranet has pages with links to smb folders, add this to your konquerorrc:   Even in a default KDE setup, KHTML uses this system to warn when following links from untrusted pages (such as HTTP pages) to more local filesystems (e.g. smb or file). To disable this warning, for instance if your intranet has pages with links to smb folders, add this to your konquerorrc:
    
− <code ini> + <syntaxhighlight lang="ini">
  [KDE URL Restrictions]   [KDE URL Restrictions]
  rule_count=1   rule_count=1
Line 186:
Line 186:
  As an example, a better way of preventing users from customizing their desktop backgrounds than that shown in section 1 would be to lock down that control module:   As an example, a better way of preventing users from customizing their desktop backgrounds than that shown in section 1 would be to lock down that control module:
    
− <code ini> + <syntaxhighlight lang="ini">
  [KDE Control Module Restrictions][$i]   [KDE Control Module Restrictions][$i]
  kde-background.desktop=false   kde-background.desktop=false



Dfaure: Add solution for removing warning when following links to smb in konqueror
2010-10-01T22:05:37Z
Add solution for removing warning when following links to smb in konqueror

				
				
				
				
			
			← Older revision
			Revision as of 22:05, 1 October 2010
			
Line 170:
Line 170:
  </code>   </code>
    
− <p>  
  These rules will only allow the user to browse and access files stored in their home directory. We also allow access to the temporary directory used by KDE to ensure normal operation. If you are implementing a security policy then these rules should be used in conjunction with other rules such as restricted shell access.   These rules will only allow the user to browse and access files stored in their home directory. We also allow access to the temporary directory used by KDE to ensure normal operation. If you are implementing a security policy then these rules should be used in conjunction with other rules such as restricted shell access.
    
  + Even in a default KDE setup, KHTML uses this system to warn when following links from untrusted pages (such as HTTP pages) to more local filesystems (e.g. smb or file). To disable this warning, for instance if your intranet has pages with links to smb folders, add this to your konquerorrc:
  + 
  + <code ini>
  + [KDE URL Restrictions]
  + rule_count=1
  + rule_1=redirect,http,,,smb,,,true
  + </code>
    
  == KDE Control Module Restrictions ==   == KDE Control Module Restrictions ==



Apachelogger: README.kiosk moved
2008-10-23T11:52:52Z
README.kiosk moved

				
				
				
				
			
			← Older revision
			Revision as of 11:52, 23 October 2008
			
Line 193:
Line 193:
  == KDE Resource Restrictions ==   == KDE Resource Restrictions ==
    
− There are many other resources located under the {{path|/share}} directory that are used by KDE applications such as icons, sounds, wallpapers, etc. Users can override these resources by placing files in the same location under <tt>$KDEHOME</tt>. The KDE Kiosk system can prevent users from overriding the default resources and the necessary configuration options can be found in the [http://websvn.kde.org/trunk/KDE/kdelibs/kdecore/README.kiosk?view=markup README.kiosk] file that was mentioned in section 2. + There are many other resources located under the {{path|/share}} directory that are used by KDE applications such as icons, sounds, wallpapers, etc. Users can override these resources by placing files in the same location under <tt>$KDEHOME</tt>. The KDE Kiosk system can prevent users from overriding the default resources and the necessary configuration options can be found in the [http://websvn.kde.org/trunk/KDE/kdelibs/kdecore/doc/README.kiosk?view=markup README.kiosk] file that was mentioned in section 2.
    
  == The KDE Kiosk Tool ==   == The KDE Kiosk Tool ==





Lars at 15:27, 14 March 2008
2008-03-14T15:27:37Z


				
				
				
				
			
			← Older revision
			Revision as of 15:27, 14 March 2008
			
Line 1:
Line 1:
  + {{Template:I18n/Language Navigation Bar|KDE System Administration/Kiosk/Introduction}}
  + 
  == Introduction ==   == Introduction ==
    



Dhaumann: adapt link
2007-09-09T21:20:07Z
adapt link

				
				
				
				
			
			← Older revision
			Revision as of 21:20, 9 September 2007
			
Line 21:
Line 21:
  KDE configuration files can be stored in a number of possible directories and configuration files with the same name may exist in the different directories. There is a predetermined order in which these locations are checked for configuration files and KDE combines configuration files of the same name on a key-by-key basis; this is known as "cascading configuration". If the same key is defined in more than one of the configuration files then the key value read from the directory tree with the highest precedence will be used.   KDE configuration files can be stored in a number of possible directories and configuration files with the same name may exist in the different directories. There is a predetermined order in which these locations are checked for configuration files and KDE combines configuration files of the same name on a key-by-key basis; this is known as "cascading configuration". If the same key is defined in more than one of the configuration files then the key value read from the directory tree with the highest precedence will be used.
    
− Two [[SysAdmin/Environment_Variables|environment variables]] are used to indicate which directories should be searched for configuration files: <tt>$KDEDIRS</tt> and <tt>$KDEHOME</tt>. <tt>$KDEDIRS</tt> is a list of &quot;system level&quot; directory trees for KDE system files including icons, wallpapers, fonts and configuration files. <tt>$KDEHOME</tt> determines the current users local KDE directory tree. Paths specified in <tt>$KDEDIRS</tt> should be separated with a colon (:) and the order of precedence for searching is from right to left. <tt>$KDEHOME</tt> has the highest precedence and is therefore searched last. If <tt>$KDEHOME</tt> is not set then {{path|$HOME/.kde}} is used. If <tt>$KDEDIRS</tt> is also not set then KDE3 reverts to KDE2 behaviour and uses the single path specified in <tt>$KDEDIR</tt>. The location of the configuration files in the KDE directory trees is <tt>/share/config</tt>. + Two [[KDE System Administration/Environment_Variables|environment variables]] are used to indicate which directories should be searched for configuration files: <tt>$KDEDIRS</tt> and <tt>$KDEHOME</tt>. <tt>$KDEDIRS</tt> is a list of &quot;system level&quot; directory trees for KDE system files including icons, wallpapers, fonts and configuration files. <tt>$KDEHOME</tt> determines the current users local KDE directory tree. Paths specified in <tt>$KDEDIRS</tt> should be separated with a colon (:) and the order of precedence for searching is from right to left. <tt>$KDEHOME</tt> has the highest precedence and is therefore searched last. If <tt>$KDEHOME</tt> is not set then {{path|$HOME/.kde}} is used. If <tt>$KDEDIRS</tt> is also not set then KDE3 reverts to KDE2 behaviour and uses the single path specified in <tt>$KDEDIR</tt>. The location of the configuration files in the KDE directory trees is <tt>/share/config</tt>.
    
  The cascading nature of KDE's configuration files allows system administrators to set system wide defaults while ensuring that the user's custom configuration settings will always override these system defaults. It is also the basis of the Kiosk framework as configuration entries may be marked as &quot;immutable&quot; - entries in a user's configuration file in <tt>$KDEHOME</tt> that have been marked as immutable in a system level directory will not be read and will therefore have no effect.   The cascading nature of KDE's configuration files allows system administrators to set system wide defaults while ensuring that the user's custom configuration settings will always override these system defaults. It is also the basis of the Kiosk framework as configuration entries may be marked as &quot;immutable&quot; - entries in a user's configuration file in <tt>$KDEHOME</tt> that have been marked as immutable in a system level directory will not be read and will therefore have no effect.



Logixoul: SysAdmin/Kiosk/Introduction moved to KDE System Administration/Kiosk/Introduction
2007-09-09T18:10:32Z
SysAdmin/Kiosk/Introduction moved to KDE System Administration/Kiosk/Introduction

			
			← Older revision
			Revision as of 18:10, 9 September 2007

← Older revision		Revision as of 18:05, 10 June 2012
Line 196:		Line 196:

	Figure 4. The Control Centre application interface.		Figure 4. The Control Centre application interface.
		+
		+	Changes in KDE 4.8.n
		+
		+	To see all of the possible control modules use:
		+	kcmshell4 --list
		+
		+	Find the name of the module you wish to disable, for example to disable the proxy option in System Settings
		+
		+	Go to
		+
		+	/etc/kde4/share/config/kdeglobals
		+
		+	Using an account with suitable rights add the following to this file
		+
		+	<syntaxhighlight lang="ini">
		+	[KDE Control Module Restrictions][$i]
		+	proxy.desktop=false
		+	</syntaxhighlight>
		+

	== KDE Resource Restrictions ==		== KDE Resource Restrictions ==

← Older revision		Revision as of 15:57, 13 July 2012
Line 1:		Line 1:
−	~~{{Template:I18n/Language Navigation Bar\|KDE System Administration/Kiosk/Introduction}}~~

	== Introduction ==		== Introduction ==

@@ Line 17: / Line 17: @@
 Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
 WallpaperMode=Scaled
-</code>
+</syntaxhighlight>
 The <tt>Desktop0</tt> group as shown contains two key-value pairs to indicate the image to be used as the wallpaper and how it should be displayed. The beginning of a group is indicated by placing its name in square brackets and that group ends when the next one begins or when the end of the configuration file is reached. Both the key and its value may contain spaces but all whitespace immediately before and after the equals sign and at the end of the line are ignored.
@@ Line 36: / Line 36: @@
 Wallpaper[$i]=/usr/kde/share/wallpapers/our_logo.jpg
 WallpaperMode[$i]=Scaled
-</code>
+</syntaxhighlight>
 Appending '<tt>[$i]</tt>' to the configuration key marks it as immutable. As configuration files from <tt>$KDEDIRS</tt> are read before <tt>$KDEHOME</tt>, the background is now &quot;locked down&quot; and and any custom settings made by a user in {{path|$KDEHOME/share/config/kdesktoprc}}, either directly or though a configuration dialog, will not be read by the configuration system.
@@ Line 46: / Line 46: @@
 Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
 WallpaperMode=Scaled
-</code>
+</syntaxhighlight>
 Similarly, we can mark an entire configuration file as immutable by placing '<tt>[$i]</tt>' on a line of its own at the beginning of the file; KDE will now ignore a configuration file of the same name in the user's KDE configuration directory.
@@ Line 56: / Line 56: @@
 [FMSettings]
 HomeURL[$i]=http://www.myinternetcafe.com/
-</code>
+</syntaxhighlight>
 Any setting that can be changed or customized in an application is one that can be locked down using the Kiosk framework. Examine the contents of the various configuration files that can be found under {{path|$KDEHOME/share/config/}} to get a feeling for KDE application configuration settings.
@@ Line 77: / Line 77: @@
 [KDE Action Restrictions][$i]
 action/file_open=false
-</code>
+</syntaxhighlight>
 This change can be visibly seen in Kate's 'File' menu and toolbar which are shown in Figs. 2 and 3.
@@ Line 93: / Line 93: @@
 <tr>
     <td align="center">
-       Figure 2. <syntaxhighlight lang="text">file_open</code> unrestricted.
+       Figure 2. <syntaxhighlight lang="text">file_open</syntaxhighlight> unrestricted.
     </td>
     <td></td>
     <td align="center">
-       Figure 3. <syntaxhighlight lang="text">file_open</code> restricted.
+       Figure 3. <syntaxhighlight lang="text">file_open</syntaxhighlight> restricted.
     </td>
 </tr>
@@ Line 109: / Line 109: @@
 [KDE Action Restrictions][$i]
 user/root=false
-</code>
+</syntaxhighlight>
 The ability to print documents can be blocked via the action <tt>file_print</tt> and access to the printing system/backend can be blocked by setting the <tt>print/system</tt> to <tt>false</tt>. One can also disable access to the printing properties dialogue, the ability to print more than one copy, etc. These are all referenced in the [http://websvn.kde.org/trunk/KDE/kdelibs/kdecore/doc/README.kiosk?view=markup kdecore/doc/README.kiosk] file.
@@ Line 143: / Line 143: @@
 rule_1=open,,,,http,*.hotmail.msn.com,,false
 rule_2=open,,,,http!,webmail.college.com,,false
-</code>
+</syntaxhighlight>
 The first rule blocks all http and https access to any URL that contains <tt>.hotmail.msn.com</tt> in the host part. Specifying one protocol will also match similar protocols that start with the same name; so specifying http will also include https. Rule 2 above blocks only http and thus forces the user to use https (assuming it is supported). The above rules could be used as a basis, for example, to block all access to third part web-based e-mail clients and force users to use a company or college provided virus-scanned e-mail account over https. If, for example, an Internet caf&eacute; took sponsorship from a search engine then its system administrators could use similar rules to block access to that search engine's competitors.
@@ Line 152: / Line 152: @@
 rule_N=<action>,<referrer protocol>,<referrer host>,<referrer path>,
      <protocol>,<host>,<path>,<enabled>
-</code>
+</syntaxhighlight>
 Any option that is left blank will match all by default. As we saw in the example above, wild cards may be used for host names. Specifying a path will match all URLs that begin with that path unless an exclamation mark is placed at the end of the path.
@@ Line 168: / Line 168: @@
 rule_5=open,,,,file,,$TMP,true
 rule_6=list,,,,file,,$TMP,true
-</code>
+</syntaxhighlight>
 These rules will only allow the user to browse and access files stored in their home directory. We also allow access to the temporary directory used by KDE to ensure normal operation. If you are implementing a security policy then these rules should be used in conjunction with other rules such as restricted shell access.
@@ Line 178: / Line 178: @@
 rule_count=1
 rule_1=redirect,http,,,smb,,,true
-</code>
+</syntaxhighlight>
 == KDE Control Module Restrictions ==
@@ Line 189: / Line 189: @@
 [KDE Control Module Restrictions][$i]
 kde-background.desktop=false
-</code>
+</syntaxhighlight>
 In fact, the users will not even see an option to configure the background in either the Control Centre or by right-clicking on the desktop. Run the command '<tt>kcmshell --list</tt>' for a list of available modules and use the format kde-&lt;module-name&gt;.desktop in the configuration file. In most public access/caf&eacute; environments, one will probably want to lock down almost all control centre modules.

← Older revision		Revision as of 15:27, 14 March 2008
Line 1:		Line 1:
		+	{{Template:I18n/Language Navigation Bar\|KDE System Administration/Kiosk/Introduction}}
		+
	== Introduction ==		== Introduction ==