Lock down GNOME with Pessulus - gHacks Tech News

Lock down GNOME with Pessulus

There are many reasons why you might want to lock down a desktop. Say you run an internet cafe and you don't want your users to be able to do certain things. Or what if your Linux box is being used as a kiosk and you don't want users to be able to exit out of the browser or run any unwanted programs or commands. How do you manage this task?

It's actually quite simple. For the GNOME desktop there is a handy tool call Pessulus that allows you to lock down certain aspects of the desktop. I will warn you though, in order to get the most out of this you need to be using the Epiphany web browser as that is the only browser Pessulus supports. Remember, Epiphany is still the official web browser of the GNOME desktop - even though Epiphany isn't installed by default on most distributions (go figure).

Installations

There are two tools you must install: Pessulus and Ephiphany. These are quite simple to install. All you need to do is follow these steps:

  1. Open up your Add/Remove Software tool.
  2. Search for "lockdown" (or "pessulus") - no quotes.
  3. Mark Pessulus for installation.
  4. Search for "epiphany" (no quotes).
  5. Mark Epiphany for installation.
  6. Click Apply to install.

Depending upon your distribution, there may or may not be a need to install any dependencies. If there are, allow this.

Once installed you are ready to begin locking down the desktop.

Use

Figure 1

To use Pessulus click Alt-F2  and then type pessulus. This will open up the main (and only) window for the lockdown tool (see Figure 1). In this window there are four tabs:

General: Here you can disable general features for the GNOME desktop. Most notably is the ability to disable the command line and save to disk. This is ideal for a Kiosk or cafe situation.

Panel: In this tab you can disable force quit, you can lock down the panel, disable logout, and disable specific applets.

Epiphany Web Browser: In this tab you can disable quit, disable arbitrary URL, disable bookmark editing, disable history, disable javascript, disable toolbar editing, force fullscreen, hide the menubar, and disable unsafe protocols.

GNOME Screensaver: In this tab you can disable lock screen, enable lock on activation, allow/disallow logout, allow/disallow user switching.

One of the only issues you might find is that installing Pessulus actually adds a menu entry called "Lockdown Editor". I would suggest you rename that menu entry to some obscure title so the user won't have any idea what it does. If you completely remove the Pessulus menu entry you will have a hard time starting the tool as the disabling of the command line (in Pessulus) also disables the Alt-F2 run dialog. Of course you could opt to not disable command line and still have the option of using the command line to start up the tool. That depends on how secure you want that kiosk to be.

Final thoughts

Locking down the GNOME desktop doesn't have to be a horrible challenge. Instead of going through the Gconf-editor, just use a tool like Pessulus to make sure your GNOME desktop is in a state of lockdown so the users can't do anything you do not want them to do.





  • We need your help

    Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.

    We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats (video ads) or subscription fees.

    If you like our content, and would like to help, please consider making a contribution:

    Comments

    1. Robert said on August 22, 2011 at 9:06 pm
      Reply

      Thanks for this great post. One thing that keeps on bothering me is how to skip epiphany auto recovery. I found a few ideas from my google searches, but nothing works so far.

    2. veronica said on January 12, 2012 at 10:25 pm
      Reply

      I wonder… If you disable the command line, and remove lockdown editor from the menu. But have created a shortcut to launch pessulus, will that work? In short, do shortcuts work while in this kiosk mode?

    3. Matt said on March 26, 2012 at 8:15 pm
      Reply

      Hey great write up here, i was wondering if there is a way to use epiphany to only open up few certain websites to use as a kiosk.

    Leave a Reply