David Groos wrote:
It seems I've seen in a few places that it isn't important to update the chroot too often, only when doing certain sorts of upgrades (don't ask me what the criteria are, I don't know :))

Steve, what tools/setting do you use when you go about locking down the desktop?

David
Well this isn't necessarily an exhaustive list...

We remove any packages that aren't needed so there's less for students to "fiddle" with.
We use Sabayon (Scott's package) to drastically minimize what's on the menus.
We change permissions on /usr/bin/alacarte, /usr/bin/gnome-desktop-item-edit and /usr/bin/gmenu-simple-editor so that the students can't then alter the menus again (why are there 3 programs that do this?!!!)
We edit gconf directly to adjust some other things...
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /desktop/gnome/file_views/show_backup_files False
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /desktop/gnome/file_views/show_hidden_files False
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type string --set /apps/nautilus/preferences/executable_text_activation display
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /apps/nautilus/preferences/start_with_location_bar False
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /desktop/gnome/lockdown/disable_user_switching True
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --set --type list --list-type string /apps/panel/global/disabled_applets "[OAFIID:GNOME_FastUserSwitchApplet]"
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --set --type list --list-type string /desktop/gnome/peripherals/keyboard/kbd/layouts "[us]"
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type string --set /desktop/gnome/background/picture_filename /usr/share/backgrounds/edubuntu_default.png
We recompile Nautilus to disable the "Show Hidden Files" switch and we run a script that drops a .hidden file in key locations to make most of the filesystem invisible to Nautilus (now that we've disables show hidden).
We disable compiz...
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type string --set /desktop/gnome/applications/window_manager/default /usr/bin/metacity
We hack Firefox to disable browsing the local file system, and lock down proxy settings, export/import bookmarks to network location so they transfer between servers (we have multiple tc servers the students move between) and a few other things (lockdown.js file in /etc/firefox-x.x/pref/ full of various "lockPref(...)" )
We start x11vnc on the clients so that we can observer desktop sessions remotely

Then we run logon scripts to mount their network folders and put it in the places menu and the desktop, redirect OOo default save location to the network home folder (the real home folder is always local to the server otherwise most apps run _really_ slowly, at least with our setup), add printers etc etc.

We use Puppet for all this (http://reductivelabs.com/products/puppet/).  We create the recipes for a lot of this and then we can configure a server pretty quickly.

I know some folks out there will think this is all over the top, but believe me, if you want productive classes where kids stay "on task" as they say, and don't make trouble by being able to break things then everyone is happier!


-- 
Steve Rippl
Technology Director
Woodland Public Schools
360 225 9451 x326



-- 
edubuntu-users mailing list
[email protected]
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/edubuntu-users

Reply via email to