Create guest account with restricted access to applications

Painguy · 2014-09-24 06:00:46

Hi, I'm trying to setup a guest account with very little access to applications aside from internet browsing. I have an account set up, but It has access to the terminal and many other programs that I want restricted. Any help is appreciated.

drcouzelis · 2014-09-24 12:57:03

How does the account have access to the terminal? Is it because you are starting a desktop environment? Then don't start a desktop environment.

I think the word for what you want to setup is a "kiosk" (if that helps): https://www.google.com/#q=kiosk+site:bbs.archlinux.org

Painguy · 2014-09-24 18:51:01

drcouzelis wrote:

How does the account have access to the terminal? Is it because you are starting a desktop environment? Then don't start a desktop environment.
I think the word for what you want to setup is a "kiosk" (if that helps): https://www.google.com/#q=kiosk+site:bbs.archlinux.org

yeah i have gnome 3 installed. I've hidden my login on gdm, but want to have a dummy account in case my laptop gets stolen and launch a reverse ssh tunnel when someone opens that account. I've had a laptop stolen before so I'm pretty paranoid now lol.
Kiosk mode seems interesting, but I don't want automatic login and I also want the thief to be able to connect to his or her network which kiosk mode seems to to restrict.

Last edited by Painguy (2014-09-24 18:51:38)

olive · 2014-09-24 19:19:12

Things are not as simple as other suggests. I am sure it is relatively easy to convince a browser to launch a terminal (associate pdf file with xterm and "open" a pdf file from your browser). It might be tricky but i am sure we can do a lot of evil things by tweaking about:config or by installing an evil extension or plugin. A competent thief will be able to relatively easy bypass all of the suggested restrictions, for example by passing arguments to the kernel command line or by booting from a CD or USB key. If you prevent that with a bio password, then he can remove the hard disk, place it in another computer and modify it from there, which would give him root access. If the thief is not competent, he will probably be clueless in front of a terminal anyway.

If you are more concerned with the data on your computer that with the computer itself, you can encrypt your home folder. A good encryption is very difficult if not impossible to beak.

Last edited by olive (2014-09-24 19:23:35)

drcouzelis · 2014-09-24 19:24:43

Painguy wrote:

yeah i have gnome 3 installed. I've hidden my login on gdm, but want to have a dummy account in case my laptop gets stolen and launch a reverse ssh tunnel when someone opens that account. I've had a laptop stolen before so I'm pretty paranoid now lol.

WHAT?? That's what you want? You probably should have said that from the start.

What is your goal?

If it's to protect your personal data, then the only way is drive encryption. Everything else is just security through obscurity, which is not security.

If it's to be able to get your laptop back, then I have no idea.

Painguy · 2014-09-24 19:38:35

drcouzelis wrote:

WHAT?? That's what you want? You probably should have said that from the start.
What is your goal?
If it's to protect your personal data, then the only way is drive encryption. Everything else is just security through obscurity, which is not security.
If it's to be able to get your laptop back, then I have no idea.

Yeah I hope that by doing a reverse ssh I can figure out who took my laptop (get IP, location, email etc etc) then contact the authorities with the info. I've already written a script that takes care of all that , but I was hoping to create a very restricted user with useradd or something lol.

olive wrote:

Things are not as simple as other suggests. I am sure it is relatively easy to convince a browser to launch a terminal (associate pdf file with xterm and "open" a pdf file from your browser). It might be tricky but i am sure we can do a lot of evil things by tweaking about:config or by installing an evil extension or plugin. A competent thief will be able to relatively easy bypass all of the suggested restrictions, for example by passing arguments to the kernel command line or by booting from a CD or USB key. If you prevent that with a bio password, then he can remove the hard disk, place it in another computer and modify it from there, which would give him root access. If the thief is not competent, he will probably be clueless in front of a terminal anyway.
If you are more concerned with the data on your computer that with the computer itself, you can encrypt your home folder. A good encryption is very difficult if not impossible to beak.

yeah you do have a point I suppose

Well then I guess the only thing left is to figure out how to run the script after a specific user logs in through gdm. Any idea on that? I know gdm has a default file that excutes, but I don't think that is user specific.

Last edited by Painguy (2014-09-24 19:44:15)

olive · 2014-09-24 20:06:33

Running a script at login is relatively easy. Run a script after every user log in and test who has logged in from it. I think gdm run a file called Xsession after the user log in. From there, you can easily test which user has logged (it should be in the $USER environment variable). You can also use /etc/xdg/autostart or /etc/X11/xinitrc.d . I use kdm and KDE so I do not know precisely what gdm and Gnome do but the process is similar for every desktop environment. The man page of xdm is pretty complete and explain in details what is done after a user log in.

Painguy · 2014-09-24 23:20:23

olive wrote:

Running a script at login is relatively easy. Run a script after every user log in and test who has logged in from it. I think gdm run a file called Xsession after the user log in. From there, you can easily test which user has logged (it should be in the $USER environment variable). You can also use /etc/xdg/autostart or /etc/X11/xinitrc.d . I use kdm and KDE so I do not know precisely what gdm and Gnome do but the process is similar for every desktop environment. The man page of xdm is pretty complete and explain in details what is done after a user log in.

I took a look around and found that gdm runs the following after login as root.

/etc/gdm/PostLogin/Default

I have an idea of what you are talking about, but I couldn't find a decent resource on how to go about what you suggest. I'm still pretty new to all this linux stuff so excuse my ignorance
I wrote this Default script to use instead, but I'm not happy with how I'm checking if a user is logged in and if the reverse tunnel connection succeeded.

if [[ "$(users)" = "user user" ]]; then
   while (( "$(netstat -an | grep -E "\:22[ \t]+" | grep ESTABLISHED | wc -l)" < "1" ))
      do
      ssh -fvN -p 22 -R tunnelport:localhost:sshdport user@example.com
      sleep 20
   done
fi

This works, but it's not stable. If for whatever reason the dummy user opens 3 sessions resulting in users = user user user instead of user user then the script fails. I'd much rather do your way if it ensures that the script runs when that specific user logs in.

Kopkins · 2014-09-24 23:59:49

You might be able to use a cron job with syncthing to get close to what you want. I use syncthing with an hourly cron job to check the IP address of my server on my home network in case the address changed for some reason. Use the cron job at whatever interval you want to run your script. Have the script check to see if the guest user is logged in and output the info to a file. Then use syncthing to sync that output file to another computer or some other device that you would have access to. Then once ( if ) your computer gets stolen you just have to wait for the file to be generated and syncthing will pop it over to you in a couple minutes.

Also, could you use the 'who' or 'w' commands instead of $users?

Last edited by Kopkins (2014-09-25 00:01:50)

Painguy · 2014-09-25 02:06:37

Kopkins wrote:

You might be able to use a cron job with syncthing to get close to what you want. I use syncthing with an hourly cron job to check the IP address of my server on my home network in case the address changed for some reason. Use the cron job at whatever interval you want to run your script. Have the script check to see if the guest user is logged in and output the info to a file. Then use syncthing to sync that output file to another computer or some other device that you would have access to. Then once ( if ) your computer gets stolen you just have to wait for the file to be generated and syncthing will pop it over to you in a couple minutes.
Also, could you use the 'who' or 'w' commands instead of $users?

Syncthing sounds interesting, but I dont think its what I'm looking for. Unfortunatley the script half works. The first if statement fails on login. If I remove it then the login screen hangs on the ssh command. The only time the script works is after i've logged in through the gdm. Anyone have ideas on what I can do?

Kopkins · 2014-09-25 04:56:34

You would probably want to do something that doesn't happen at login. If someone is using this laptop for the first time they probably won't be connected to a network when they login to the guest account, so the ssh would fail anyway once if it even worked with a network. If you use cron to have the script run at a certain interval it should work since eventually they would establish a network connection.

You could try something like

#!/bin/bash

if [[ $(w | grep gdm-session-worker | grep user) ]] 
then
	echo "ssh <stuff>"
fi

exit

I think that should check to see if that user is logged in through gdm. w | grep user would probably work too to see it thay are logged in.

Syncthing would just run in the background and sync any changes made to a file or files you specify and would eliminate the need for a reverse ssh connection. That's why I recommended it.

HiImTye · 2014-09-25 05:48:10

you should probably set it to run when the user has a successful connection, since that would be a prerequisite to set up a reverse ssh tunnel

Painguy · 2014-09-25 08:38:18

Kopkins wrote:

You would probably want to do something that doesn't happen at login. If someone is using this laptop for the first time they probably won't be connected to a network when they login to the guest account, so the ssh would fail anyway once if it even worked with a network. If you use cron to have the script run at a certain interval it should work since eventually they would establish a network connection.
You could try something like
#!/bin/bash

if [[ $(w | grep gdm-session-worker | grep user) ]] 
then
	echo "ssh <stuff>"
fi

exit
I think that should check to see if that user is logged in through gdm. w | grep user would probably work too to see it thay are logged in.
Syncthing would just run in the background and sync any changes made to a file or files you specify and would eliminate the need for a reverse ssh connection. That's why I recommended it.

I got the script working with cron job. Out of curiosity how performance intensive would this be if I ran it every 5 minutes? My issue with cron is that it runs no matter who is logged in, and I'd much rather have this script run only when a specific user is logged in. I'm probably just being silly tho Anyway thanks for the help thus far. I REALLY appreciate it. Now that I got this working I'll look into using syncthing as a way to retrieve some vital info.

HiImTye wrote:

you should probably set it to run when the user has a successful connection, since that would be a prerequisite to set up a reverse ssh tunnel

I could do that I suppose. It would be "nicer", but even without doing that the cron job would just try again until finally a ssh connection is finally made.

x33a · 2014-09-25 11:21:55

Painguy wrote:

My issue with cron is that it runs no matter who is logged in, and I'd much rather have this script run only when a specific user is logged in.

There are user specific cronjobs as well.

"crontab -e"

Login as the dummy user, create a cronjob for that user. Now whenever that user is logged in, the cronjob will run (at the specified interval).

Last edited by x33a (2014-09-25 11:22:27)

Arch Linux

#1 2014-09-24 06:00:46

Create guest account with restricted access to applications

#2 2014-09-24 12:57:03

Re: Create guest account with restricted access to applications

#3 2014-09-24 18:51:01

Re: Create guest account with restricted access to applications

#4 2014-09-24 19:19:12

Re: Create guest account with restricted access to applications

#5 2014-09-24 19:24:43

Re: Create guest account with restricted access to applications

#6 2014-09-24 19:38:35

Re: Create guest account with restricted access to applications

#7 2014-09-24 20:06:33

Re: Create guest account with restricted access to applications

#8 2014-09-24 23:20:23

Re: Create guest account with restricted access to applications

#9 2014-09-24 23:59:49

Re: Create guest account with restricted access to applications

#10 2014-09-25 02:06:37

Re: Create guest account with restricted access to applications

#11 2014-09-25 04:56:34

Re: Create guest account with restricted access to applications

#12 2014-09-25 05:48:10

Re: Create guest account with restricted access to applications

#13 2014-09-25 08:38:18

Re: Create guest account with restricted access to applications

#14 2014-09-25 11:21:55

Re: Create guest account with restricted access to applications

Board footer