General comment
Security cannot impede service nor detract from your primary mission.
If security concerns create an unspportable configuration they become
an impediment. Security 101 does dictate seperation of roles and
interfaces but a app server database server configuration can be
Doesn't take much
Add in the RKiosk plugin to Firefox
Ubuntu with the Kiosk Admin Tool, i believe you need KDE by default
Auto login enabled for your opac user
Symlink the firefox executable to the users autostart directory
thats about it if I remember correctly, took like an hour one morning
