KDE System Administration/Kiosk/Introduction

Introduction

The KDE Kiosk is a framework that has been built into KDE since version 3. It allows administrators to create a controlled environment for their users by customizing and locking almost any aspect of the desktop which includes the benign such as setting and fixing the background wallpaper, the functional such as disabling user log outs and access to the print system and the more security conscientious such as disabling access to a command shell.

This kind of framework is vital to maintain and increase KDE's propagation into areas such as business and enterprise environments and school and university laboratories. Other obvious areas of interest where a restricted desktop environment is required or desired would be the likes of Internet cafés, public access terminals and kiosks.

KDE's Kiosk framework is controlled by entries in various configuration files or through a GUI application, the Kiosk Admin Tool. In this article I will discuss the layout of KDE's configuration files and how to edit them to enable Kiosk's features. I will also discuss the various aspects of the desktop environment that can be customized and/or locked using the Kiosk framework. Once the reader understands how the Kiosk framework actually works through KDE's configuration files, we will discuss the Kiosk Admin Tool for those that prefer a GUI interface. This tool also allows administrators to more easily set-up Kiosk profiles and assign them system wide, per-user or per-group.

KDE's Configuration File Structure and Hierarchy

All KDE applications use the same API to create, access and alter their configuration files. As such, all configuration files are stored in predetermined directories and they share the same syntax and structure. They are organised into groupings of key-value pairs. For example, let us examine some of the settings for the KDE desktop background stored in ~/.kde/share/config/kdesktoprc:

[Desktop0]
Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
WallpaperMode=Scaled

The Desktop0 group as shown contains two key-value pairs to indicate the image to be used as the wallpaper and how it should be displayed. The beginning of a group is indicated by placing its name in square brackets and that group ends when the next one begins or when the end of the configuration file is reached. Both the key and its value may contain spaces but all whitespace immediately before and after the equals sign and at the end of the line are ignored.

KDE configuration files can be stored in a number of possible directories and configuration files with the same name may exist in the different directories. There is a predetermined order in which these locations are checked for configuration files and KDE combines configuration files of the same name on a key-by-key basis; this is known as "cascading configuration". If the same key is defined in more than one of the configuration files then the key value read from the directory tree with the highest precedence will be used.

Two environment variables are used to indicate which directories should be searched for configuration files: $KDEDIRS and $KDEHOME. $KDEDIRS is a list of "system level" directory trees for KDE system files including icons, wallpapers, fonts and configuration files. $KDEHOME determines the current users local KDE directory tree. Paths specified in $KDEDIRS should be separated with a colon (:) and the order of precedence for searching is from right to left. $KDEHOME has the highest precedence and is therefore searched last. If $KDEHOME is not set then $HOME/.kde is used. If $KDEDIRS is also not set then KDE3 reverts to KDE2 behaviour and uses the single path specified in $KDEDIR. The location of the configuration files in the KDE directory trees is /share/config.

The cascading nature of KDE's configuration files allows system administrators to set system wide defaults while ensuring that the user's custom configuration settings will always override these system defaults. It is also the basis of the Kiosk framework as configuration entries may be marked as "immutable" - entries in a user's configuration file in $KDEHOME that have been marked as immutable in a system level directory will not be read and will therefore have no effect.

Let us continue with the desktop background example and, as the system administrators of an Internet café, we want to ensure that our logo or our sponsor's logo is always the desktop background and that it cannot be changed by our customers. In one of the system level directory trees ($KDEDIRS), we would edit the file /share/config/kdesktoprc so that it contained:

[Background Common]
CommonDesktop[$i]=true

[Desktop0]
Wallpaper[$i]=/usr/kde/share/wallpapers/our_logo.jpg
WallpaperMode[$i]=Scaled

Appending '[$i]' to the configuration key marks it as immutable. As configuration files from $KDEDIRS are read before $KDEHOME, the background is now "locked down" and and any custom settings made by a user in $KDEHOME/share/config/kdesktoprc, either directly or though a configuration dialog, will not be read by the configuration system.

Configuration options can also be marked immutable by group and by file. To mark a group as immutable, we append '[$i]' to the group name:

[Desktop0][$i]
Wallpaper=/usr/kde/share/wallpapers/KDE34.jpg
WallpaperMode=Scaled

Similarly, we can mark an entire configuration file as immutable by placing '[$i]' on a line of its own at the beginning of the file; KDE will now ignore a configuration file of the same name in the user's KDE configuration directory.

Setting default configuration options for KDE applications is just as easy as fixing the desktop background. We could lock Konqueror's homepage setting to our Internet café's homepage by setting the following in a file called konquerorrc in one of the system directory trees:

[FMSettings]
HomeURL[$i]=http://www.myinternetcafe.com/

Any setting that can be changed or customized in an application is one that can be locked down using the Kiosk framework. Examine the contents of the various configuration files that can be found under $KDEHOME/share/config/ to get a feeling for KDE application configuration settings.

You should also bear in mind that most applications will need to be restarted for configuration settings to take effect. For changes to configuration files such as kdesktoprc and kdeglobals (introduced in the next section) you will need to log out and back into KDE for changes to be applied.

The information presented in this section will allow you to set system defaults and lock them if necessary for any KDE application. However, this is only the proverbial tip of the iceberg of the KDE Kiosk system and in the following sections we will cover many more of its capabilities.

KDE Action Restrictions

One of KDE's strongest features is the fact that it is "an integrated desktop environment". This means that all of its applications share the same 'look-and-feel' so that once you have learned how to use one KDE application, learning the next is even easier. This common functionality - standardised menus and toolbars, integrated help system, etc â is built around the concept of "actions".

For example, one can open a file by selecting the 'File->Open...' menu option, by clicking on the 'File Open' toolbar icon or by pressing 'CTRL+O'. Whichever way you choose, each option simply activates the file_open action.

All KDE actions can be restricted through the Kiosk system by placing appropriate entries in the /share/config/kdeglobals file in a system level directory. We could disable the file open action by adding the following entry:

[KDE Action Restrictions][$i]
action/file_open=false

This change can be visibly seen in Kate's 'File' menu and toolbar which are shown in Figs. 2 and 3.

     <img src="kiosk-lp/unrestricted.jpg" width="250" border="0" height="286" alt="Image of an unrestricted menu and toolbar" />

     <img src="kiosk-lp/restricted.jpg" width="250" border="0" height="287" alt="Image of a restricted menu and toolbar" />

Figure 2.

file_open

unrestricted.

Figure 3.

file_open

restricted.

There are currently over 120 actions that can be restricted in KDE 3.4 and these include all standard file options, editing options, Internet and file browsing actions, the use of bookmarks and access to the help system. A full list can be found in the kdecore/doc/README.kiosk file of the kdelibs package source code for your current KDE version (available from http://developer.kde.org/source/).

Some KDE applications, such as system configuration front ends like KUser, need to be run as the root user. These applications would be unnecessary in an Internet café and they can be disabled with:

[KDE Action Restrictions][$i]
user/root=false

The ability to print documents can be blocked via the action file_print and access to the printing system/backend can be blocked by setting the print/system to false. One can also disable access to the printing properties dialogue, the ability to print more than one copy, etc. These are all referenced in the kdecore/doc/README.kiosk file.

A few other actions that are worthy of individual mention in the context of Internet cafés and similar environments are:

shell_access: Defines whether the user can start a shell for entering commands, whether the "Run Command" option (Alt-F2) can be used to run shell-commands and arbitrary executables and whether executables placed in the user's Autostart folder will be executed.

logout: Defines whether a user will be able to end the KDE session.

lock_screen: Defines whether a user will be able to lock the screen.

run_command: Controls access to the "Run Command" option.

movable_toolbars: Whether or not toolbars may be moved around by the user.

Users of public access terminals and Internet cafés will undoubtedly want to keep their browsing history to themselves. You should carefully consider settings such as the history sidebar, how cookies are handled and whether or not to use a cache. Once you have made your choices, set these options in konquerorrc and mark them as immutable. Also, if you are a regular user of Konqueror then you know that it has a very useful feature in that it remembers the URLs you enter in the "Location" bar. In a public environment, set the action lineedit_text_completion to false so that text boxes do not remember previously entered information.

One may also wish to set the action editable_desktop_icons to false as it defines whether icons on the desktop can be moved, renamed, deleted or added by users. Be sure to either move the desktop directory and/or to make it read-only (usually $HOME/Desktop).

KDE URL Restrictions

The KDE Kiosk system allows system administrators to control access to specific URLs based on the referrer, the protocol, the host and the path through entries in the kdeglobals file. Although some of these tasks may be more appropriate for a proxy server or a firewall, this functionality becomes incredibly useful when you consider the fact that KDE treats all locations as URLs. For blocking access to websites, one might use the following example:

[KDE URL Restrictions][$i]
rule_count=2
rule_1=open,,,,http,*.hotmail.msn.com,,false
rule_2=open,,,,http!,webmail.college.com,,false

The first rule blocks all http and https access to any URL that contains .hotmail.msn.com in the host part. Specifying one protocol will also match similar protocols that start with the same name; so specifying http will also include https. Rule 2 above blocks only http and thus forces the user to use https (assuming it is supported). The above rules could be used as a basis, for example, to block all access to third part web-based e-mail clients and force users to use a company or college provided virus-scanned e-mail account over https. If, for example, an Internet café took sponsorship from a search engine then its system administrators could use similar rules to block access to that search engine's competitors.

The format for URL restrictions is:

rule_N=<action>,<referrer protocol>,<referrer host>,<referrer path>,
    <protocol>,<host>,<path>,<enabled>

Any option that is left blank will match all by default. As we saw in the example above, wild cards may be used for host names. Specifying a path will match all URLs that begin with that path unless an exclamation mark is placed at the end of the path.

As I mentioned, KDE treats all locations as URLs: for example Internet addresses are URLs with the http or https protocol whereas local files on the hard drive are URLs using the file protocol (for a full list of supported protocols, execute the command 'kcmshell ioslaveinfo'). Access to the local filesystem can be restricted using rules such as the following:

[KDE URL Restrictions][$i]
rule_count=6
rule_1=open,,,,file,,,false
rule_2=list,,,,file,,,false
rule_3=open,,,,file,,$HOME,true
rule_4=list,,,,file,,$HOME,true
rule_5=open,,,,file,,$TMP,true
rule_6=list,,,,file,,$TMP,true

These rules will only allow the user to browse and access files stored in their home directory. We also allow access to the temporary directory used by KDE to ensure normal operation. If you are implementing a security policy then these rules should be used in conjunction with other rules such as restricted shell access.

Even in a default KDE setup, KHTML uses this system to warn when following links from untrusted pages (such as HTTP pages) to more local filesystems (e.g. smb or file). To disable this warning, for instance if your intranet has pages with links to smb folders, add this to your konquerorrc:

[KDE URL Restrictions]
rule_count=1
rule_1=redirect,http,,,smb,,,true

KDE Control Module Restrictions

Almost all aspects of the K Desktop Environment can be configured and customized through the "Control Centre". Each "group" of settings, such as "Background", "Colours", "Fonts", etc as shown in Fig. 4, correspond to a control centre module and each of these modules can be locked down through the Kiosk framework.

As an example, a better way of preventing users from customizing their desktop backgrounds than that shown in section 1 would be to lock down that control module:

[KDE Control Module Restrictions][$i]
bell.desktop=false

In fact, the users will not even see an option to configure the background in either the Control Centre or by right-clicking on the desktop. Run the command 'kcmshell --list' for a list of available modules and use the format <module-name>.desktop in the configuration file. In most public access/café environments, one will probably want to lock down almost all control centre modules.

Figure 4. The Control Centre application interface.

Changes in KDE 4.8.n

To see all of the possible control modules use: kcmshell4 --list

Find the name of the module you wish to disable, for example to disable the proxy option in System Settings

Go to

/etc/kde4/share/config/kdeglobals

Using an account with suitable rights add the following to this file

[KDE Control Module Restrictions][$i]
proxy.desktop=false

KDE Resource Restrictions

There are many other resources located under the /share directory that are used by KDE applications such as icons, sounds, wallpapers, etc. Users can override these resources by placing files in the same location under $KDEHOME. The KDE Kiosk system can prevent users from overriding the default resources and the necessary configuration options can be found in the README.kiosk file that was mentioned in section 2.

The KDE Kiosk Tool

The KDE Kiosk Admin tool, see Fig. 5, is a graphical front end to the KDE Kiosk framework and was originally written by Waldo Bastian, a core KDE developer, for Novell's Linux Desktop. As well as provided an interface to the Kiosk framework, it also allows KDE administrators to create default profiles for different groups of users (that is "groups" in the Unix file system sense) far easier than could be accomplished through the configuration files.

  [kiosk-lp/kiosktool.jpg" title="Click for a larger image
     <img src="kiosk-lp/kiosktool-small.jpg" border="0" width="388" height="256" alt="The Kiosk Tool" />
  ]

Figure 5. The KDE Kiosk Admin Tool.

The Kiosk Admin tool is not part of the official KDE distribution as it is under active development and keeping it free from KDE's release schedules allow its developers to incorporate feedback faster. It is, however, included with many Linux distributions. More information and downloads can be found on http://extragear.kde.org/apps/kiosktool/.

As I mentioned, one of Kiosk Tool's strongest assets is the ease at which one can create multiple Kiosk profiles and assign them per Unix group. For example, in an Internet café one might create two groups: customers and admins. It would then be logical to have an increased set of restrictions (such as file system access, shell access, etc) assigned to the customers' account(s) while leaving the administrators' accounts with little or no restrictions.

The Kiosk Admin tool also allows system administrators to maintain all profiles on their local machine and then upload them to another server when profiles are added, deleted or modified.

Closing Remarks

KDE's Kiosk framework is an essential tool for any system administrator who is maintaining or deploying the K Desktop Environment in a multi-desktop/multi-user scenario and/or in an environment where users cannot be trusted. By preventing users from changing default settings and locking down settings that may pose a security risk, a system administrator can significantly reduce the amount of time that will be spent "maintaining and repairing" each desktop as well as ensuring that each user has a common and familiar desktop environment every time they sit down to the computer.