Ask Slashdot: Ubuntu Lockdown Options? 387
First time accepted submitter clava writes "We have a desktop Java testing application that is going to be administering tests to students on lab computers running Ubuntu 10.x. These computers are used by the students for other purposes and we're not allowed to create special users or change the OS configuration. When the testing app is launched, we need to restrict users from exiting the app so they can't do things like search the internet for answers or use other applications. Is there a good way to put an Ubuntu machine in kiosk mode or something via our application and have exiting kiosk mode be password protected? Any ideas are appreciated."
Depends how locked-down (Score:5, Informative)
I'm afraid if you want it actually locked-down, you're pretty screwed. You can't really disable things like switching to a tty with ctrl-alt-f1 without "changing the OS configuration."
Just use Unity. (Score:5, Funny)
Just use the default Unity desktop bundled with recent Ubuntu releases. It's so fucking unusable in every respect that malicious and benign users alike will want nothing to do with it. They'll use only the Java testing application solely to avoid having to deal with Unity.
You'll never have to worry about them using Facebook, or adding additional users, or installing their own software. Even long-time Unity users have a whole fuck of a lot of trouble doing those things. Many just learn to accept that they never be able to.
Re:Just use Unity. (Score:5, Funny)
Even long-time Unity users have a whole fuck of a lot of trouble doing those things. Many just learn to accept that they never be able to.
There's no such thing as "long-time unity users"
Re:Just use Unity. (Score:5, Funny)
yes there is, Anyone that has used unity for more than 1 hour and has not went on a murderous spree because the interface made them go completely insane.
Re:Depends how locked-down (Score:5, Insightful)
If you ask me, you don't really need to prevent users from doing those things. You just need to tell they're not allowed to, and then have your java app detect if those things have occurred and then take action from there. By "take action," I mean that you could either (a) make some kind of notation in the database so that you can penalize them, or (b) send an SMS message or email or something to the test administrator to alert them of the situation so that they can walk over and determine if the student is attempting to cheat.
Re: (Score:2)
oops, left out a word:
*You just need to tell them they're not allowed to.
Re:Depends how locked-down (Score:5, Informative)
Or if you're feeling extra clever, you could straight up disable the keyboard [stackexchange.com] and rely on the mouse for selecting answers. It would have to be enabled at the beginning for the user to enter his or her credentials, but then you could disable it during the actual test (there's no way to exit fullscreen with only a mouse), and then re-enable it upon completion. The site I linked to explains how to both enable and disable the entire keyboard programmatically. The linked site produces a shell script... In Java, you could run that shell script with: Process.Start(@"./scriptname.sh").
Re:Depends how locked-down (Score:4, Insightful)
you could straight up disable the keyboard and rely on the mouse for selecting answers.
Which doesn't help in cases of 1. answers that aren't multiple choice, or 2. having to accommodate people with mobility impairments where limitation to a mouse imposes an undue hardship.
Re:Depends how locked-down (Score:5, Insightful)
you could straight up disable the keyboard and rely on the mouse for selecting answers.
Which doesn't help in cases of 1. answers that aren't multiple choice, or 2. having to accommodate people with mobility impairments where limitation to a mouse imposes an undue hardship.
Be fair, the restrictions on the implementation are severe: No OS mods one can kind of understand but you also can't create even a "testtaker" user account? As an OS deployment engineer I appreciate the former but I can't think of any justification for the latter.
Anyway, given these handcuffs, a multiple-choice test will just have to do I think. And believe me, you can make some pretty darn hard multiple-choice exams. Go try to get MS or Apple certified some time. 80 adaptive multiple choice questions that nobody is going to do well at unless they studied hard and/or know their stuff.
Re: (Score:3)
here's another ridiculous idea:
watch them..
from behind!
Re: (Score:3, Insightful)
This can be done.
1. Insert a Windows 7 CD, format the drive, install the Windows 7 operating system. Via group policies and TweakUI, disable all settings and applications that you don't want users to access.
2. Take the Ubuntu CD and place it on the desk next the computer.
3. Place hot beverage of choice on Ubuntu CD, which will now be reffered to as the "coaster".
4. Proceed with Java tests.
Re: (Score:3)
Re: (Score:3)
That would violate the 'no new user accounts or OS configuration' rule. troll harder.
Re:Depends how locked-down (Score:5, Informative)
Problem is, Windows' lockdown depends on Windows users being idiots.
Not true. True kiosk mode exists in Windows world. Do some regedits and gedit.msc foo and you'll have replaced explorer.exe with your choice of program (so it's the only program that can run), auto-logged in your user and disabled most of the ctrl-alt-del functions. Lock the bios, boot only from HDD, and padlock the computer, and the end users will have to bring in a set of lockpicks and a live CD to do anything normal with the computer.
Re: (Score:3)
Re:Depends how locked-down (Score:5, Informative)
Re:Depends how locked-down (Score:5, Informative)
Kiosk mode is actually much easier on Linux...
Instead of a full blown desktop environment, simply supply a minimal window manager (or none at all) and the desired application. Remove all unnecessary packages from the system, and ensure any area the user can write to is mounted noexec and gets automatically cleared each time the machine is used.
Re: (Score:3)
Problem is, Windows' lockdown depends on Windows users being idiots.
That was true on Windows 9x (which more or less didn't have any such thing as security to begin with), but not on modern NT-based versions of Windows.
A previous employer of mine asked the I.T. department to lock down the internet. The solution to that problem was to install Firefox. Then I.T. got smart and also banned that.
Google "Software Restriction Policies." On all modern versions of Windows (including XP), you can set up a whitelis
Re: (Score:3, Insightful)
Re: (Score:2)
I can think of one way without changing the OS configuration, setup the DNS for those systems to only return the addresses you want, and remove the root hints during the exam.
Re:Depends how locked-down (Score:5, Informative)
Disabling TTY switching is a pretty simple change, though, and won't affect the general use of the system.
In fact, you might as well use this to your advantage: start up a new X server instance, but don't start up the window manager. Run your java app in this server.
Now all a student can do is take the test -- there's no way to do anything besides take the test unless they can switch using ctrl-alt-F*, which has been disabled.
That's as near to a "kiosk mode" as I can figure.
MOD PARENT UP (Score:3)
Seriously, this is the best answer I have read here so far. It is simple and elegant. No booting custom images, whitelisting sites, or any of that.
Also, gotta love that half of the answers are: just give a different test, who cares about cheating, just install a different operating system, just fail anyone who cheats, yada yada yada. Why do so many Slashdotters always feel like the best answer to a question is "you're doing it wrong"? Sheesh.
Requires things he said he couldn't do (Score:4, Insightful)
This is exactly the solution I would have proposed, except it goes against the users requirements.
Disabling TTY access requires changes to the OS configuration which he is not allowed to make. Furthermore in Ubuntu, you can't just kill the current X session and start a new one from the command line with the application as the window manager, because it will helpfully restart X when it crashes (or is intentionally killed). You would either need to create a special user whose default WM is the application you want to run, or you would need to reconfigure the OS graphical login settings, neither of which he is allowed to do.
User applications are intentionally prevented from locking down a machine, otherwise any old piece of malware could do so. The only way to really lock it down to modify the OS configuration. That is why all the other answers are suggesting round-about ways to achieve the same goal. IMHO adamdoyle [slashdot.org]'s is the best.
Re:Requires things he said he couldn't do (Score:5, Informative)
Why not?
sudo service gdm stop; Xorg -sp security.policy & kiosk-mode-test-program
Probably if you spend more than the two seconds I did thinking about this you can find a more robust version perhaps involving a custom gdm configuration that can restart the X server if the user logs out prematurely etc.
Re: (Score:3)
If I start an X server on display :1 it runs along the :0 instance. No need to do anything to the OS. And if that X server has ctrl-alt-F disabled, well then that's quite well locked up.
http://ubuntuforums.org/showthread.php?t=776098 [ubuntuforums.org] :1
combined with
startx -config your-kiosk-xorg.conf --
yeah, I didn't test it, don't want to lock up my office PC :-)
Re:MOD PARENT UP (Score:5, Insightful)
This happens everywhere on the internets where you ask a question. Ask a Microsoft support website how to do something that "should" be possible, but isn't. (Can't think of an example now) You'll get 10 answers telling you how to "work around" what you asked, and another 20 answers questioning why you or any one else would want to do this thing. What you will never ever get is even 1 person saying "Our product cannot do this thing".
Re: (Score:3)
On most distributions, for security reasons, an unprivileged user cannot run an X server that uses video hardware. For example X servers that use nvidia drivers need to read and write to /dev/nvidia0 which is usually only readable and writable by root and users in the video group. He would need to place his users in the video group (not allowed) or make the X binary suid (not allowed) in order to do what you describe.
When you install distro X at home it probably installed your 1 local non-root user in the a
Re:Depends how locked-down (Score:4, Informative)
Disable gdm
# update-rc.d -f gdm remove
modify
** rc.local - BEGIN
su - username -c startx
reboot
** rc.local - END
add the file
**
#!/bin/sh
**
make the
# chmod u+x
Re:Depends how locked-down (Score:4, Informative)
Why? (Score:4, Insightful)
Why not let them use resources? Similar to what they will have available to them in the workforce.
Re:Why? (Score:4, Insightful)
Because they're supposed to learn and internalize the concepts, not learn how to type search terms into Google or trade answers via IM.
Re: (Score:2)
Re: (Score:2, Insightful)
Because somebody needs to provide those answers you find via Google. They don't just appear out of nowhere.
so people who cram (Score:2)
can pass the test and have no idea on how to use the concepts?
Re: (Score:2)
And from what I've seen,
Re: (Score:3, Interesting)
Not a good idea here. All web searches are logged and (sometimes) reviewed. Management tends to take a dim view about people 'looking things up'.
Stop laughing, that was a serious answer. Yes, managers actually ask 'why do you need to look that up, don't you know how to code?'
Trade answers?
You must be nuts.
See that silo that each and every person and each and every team has built around themselves? That's right, those silos are there to provide Job Protection. After all, if only you know how to run and maint
Re: (Score:3)
Re: (Score:3)
What the fuck are you talking about? I'm pretty sure there are plenty of jobs, right now, where you can not work for a bunch of Nazis. I have one, for one. Others do as well. This has nothing to do with putting up with shit to try to protect your livelihood; it's about avoiding employers you know treat their employees horribly.
Yes, ultimately you have to eat; you might have to take any job you can get. But you can (and should!) at least try to be in a work environment that doesn't make you want to stab your
Re:Why? (Score:5, Insightful)
Firstly the submitter didn't say if this was a programming exam, or what it was. It could be a test on memorising the capitals of African countries.
But more importantly is that allowing access to the internet doesn't just allow things like documentation, and other resources I might have in the workplace, but might allow me to ask my friend to email the entire solution, or even send the question to a guy in India and get the solution back for a fee. It's a comprimise between testing some memorisation and in the cases of some students, testing nothing at all.
Re:Why? (Score:5, Insightful)
I guess you want that EMT to show up at your car crash to just google how to patch you up if he didn't pay attention in class. Better hope he doesn't lose signal to his cell phone.
Re: (Score:3, Informative)
As an EMT, it's rarely the "patching up" that requires reference - after all, cardiology can be explained thusly - "air goes in and out; blood goes round and round; variations are bad."
The trickier aspect is typically pharmacology - drugs people have been prescribed, known toxicity manifestations, drug interactions (polypharmacy and drug potentiation are a crapshoot when most of the public fails to understand that "diabetes" and "the sugar" are the same disorder and that, no, you cannot double a dose to mak
Re: (Score:3)
As a student with a test tomorrow, I would love if my lecturers would do this, because my tech skills would mean I'd get an advantage over most of my peers, so my score would be better.
But really, I'm not sure if it's all its cracked up to be. I certainly don't think 60 minutes, heads down, writing furiously (which I'll have tomorrow) is the best. Especially for a maths exam. However, I know that there is a lot to be said for the ability to easily recall a lot, and to know concepts and definitions back-to-f
Re: (Score:3, Insightful)
My college grades were much better, but only because I learned at my own pace, on my own terms. You think that some Adderall-popping punk who gets good grades forgetting everything they'
Re:Why? (Score:5, Insightful)
However, the professors wouldn't in a million years consider making these tests open-internet. The internet allows answers to be shared, which doesn't allow for testing of individual students. In addition, the internet has a lot more information than in a textbook. A student may be able to find problems almost identical to those on the exam and simply copy the answer verbatim.
There's also a difference between being able to do your work with the assistance of a reference manual, and only being able to do your job if you have access to the internet.
Re: (Score:3)
I do not carry such information in my mind since it is readily available in books. ...The value of a college education is not the learning of many facts but the training of the mind to think.
-- Albert Einstein
Was he a slacker too?
Time spent memorizing stuff is time that could be better used understanding it. Having no access to reference material is a ridiculous limitation.
Re: (Score:3, Insightful)
Re: (Score:3)
It is the most absurd thing to use Einstein to defend willful ignorance.
Only marginally moreso than claiming that decrying "rote memorization" is "defending willful ignorance."
Boot from USB or CD-ROM? (Score:5, Informative)
Create your own custom locked down kiosk boot image and require users to boot from that? Keep in mind that users might take the boot media home with them so they'll have a copy of the test app if you store it locally (as opposed to retrieving it from a website)
Here's an example:
http://jacob.steelsmith.org/content/ubuntu-kiosk-based-910 [steelsmith.org]
(I'm not vouching for this particular implementation, I just found it through a quick google search).
Re:Boot from USB or CD-ROM? (Score:5, Informative)
That's what we do. All our Linux stations boot off the network and use NFS mounts for everything. For government exams, teachers reboot the stations into "Exam Mode" which disables everything possible, launches a bare-bones X11 session with Firefox as the "WM", with all settings locked in, including an add-on that let's you specify a list of sites that are accessible, blocking access to everything else.
Took a few iterations to get the configuration locked down completely, but there's really no better way to find the holes than watch a class of students try to break it. :)
It's not bullet-proof, but we've made it hard enough that it's very obvious when a student is trying to break out of the box that anyone watching the lab will notice. :)
If you can't change the OS config, you can't lock it down.
Re: (Score:2)
LiveCD? (Score:5, Informative)
Chortle! (Score:5, Insightful)
Pull out the Ethernet connection. TADA!
Re: (Score:2)
Re:Chortle! (Score:5, Informative)
Or simply don't expose it to the internet.
Or, if it really needs to talk to the internet for some very special reason, put it behind a very configurable gateway.
Block all traffic types except port 80 http, and then restrict which ip addresses inbound packets can come from. Tada. Can't use google. Instant 404 error.
This won't stop them from playing uhrkan masters using the .deb they smuggled in, assuming they have the user rights to install. (Failing that they could smuggle in a binary blob version) but it would help prevent cheating.
What I had always considered to be ideal for a kiosk system where you don't want users pwning your workstations is to use a minimalist boot kernel on a usb stick, have the workstation tftp a system image to ram, then boot that.
This would make maintenance as easy as turning the system off, and on again, and would centralize maintenance of the system image.
Initial bootup network activity would spike with all the clients pulling the ramdisk volumes, but you could make the actual kiosk as naked as you wanted that way. No internal hdd to hide stuff on, no optical drive, and only 1 usb port that needs the key inserted because it is the boot volume.
If you go a bit further, and make sure the ctrl alt f1 seq can't be pressed at the hardware level from the kiosk, even better.
Re: (Score:2)
What about no USB sticks and running coreboot directly from the metal?
Re: (Score:3)
Pull out the Ethernet connection. TADA!
Yep first thing I thought of was disconnect the Internet connection. Pulling each ethernet cable won't do it especially if you have LAN logins, but making the Internet unreachable should be trivial.
Google??? (Score:5, Informative)
http://lmgtfy.com/?q=ubuntu+lockdown [lmgtfy.com]
maybe this will help you
http://ubuntuforums.org/showthread.php?t=456549 [ubuntuforums.org]
http://users.telenet.be/mydotcom/howto/linuxkiosk/ubuntu01.htm [telenet.be]
http://library.gnome.org/admin/system-admin-guide/stable/menustructure-13.html.en [gnome.org]
Re: (Score:3)
1st result is for Ubuntu 7.4, might be irrelevant by now.
2nd rseults starts with "modify the BIOS? then install from scratch", which he/she cleary rules out
3rd results is about tweaking menus in gnome, which is not even Ubuntu's desktop anymore.
Unluckily, the exams in question will probably not all be about Linux, so Google might actually be able to find relevant info ^^
Re: (Score:2)
those links i provided were from my bookmark list, you would only configure 1 image and roll it out, and need to only update 1 image to rollout.
Make the test application enforce Kiosk mode (Score:3, Insightful)
iptables apparmor (Score:2)
Dont try to stay in one application and prevent access by this . Use iptables and apparmor to prevent everything you dont want the pupils to do. If they find a way to crash the app they are using, it will be no problem.
Don't block UI elements, block low-level access (Score:2)
Don't try to block internet access at the local level, they'll work around it. At the firewall level whitelist specific sites and block everything else. Then even if they fire up a web browser it'll be useless.
And simply uninstall or use user permissions to block access to unwanted applications.
Re: (Score:2)
Whoops, never mind.
Best to inform whoever gave you the restrictions that with those restrictions you would fully expect students to work around any solutions you put in place. The restrictions themselves will give the students loopholes.
Re: (Score:2)
disable UI elements
restrict permissions
internet through proxy
logging
Social Solution (Score:5, Interesting)
No Technology required:
1. Announce anyone caught cheating WILL fail the course.
2. Post exactly ONE proctor at the rear of the room. His job is to catch the FIRST cheat.
3. The first cheat should be escorted from the room, and given the following choice: become the proctor and catch another cheat, or fail. If you catch a cheat, you may retake the test and the cheat becomes the proctor with the same choice.
Lather, Rinse, Repeat.
I recommend you film for future entertainment value.
Red
Re: (Score:2)
that cost more money and time. It also relies on a person being able to detect any cheat.
Re: (Score:2)
This post is full of WIN!
Finally - PROFIT. (Score:4, Insightful)
2. Blatantly cheat and get caught.
3. Become the proctor, and ignore everyone now cheating.
Re: (Score:2)
I'm sure it was satirical. ;)
OTOH, if you really want to pull this off, I'm sure it will work only the first time. You can also profit by giving your customers the info they need on the exam.
Btw, is it Tom, Barbara, or both?
Re: (Score:3)
Actually, it was not.
It's a modified version of a time honored traditional technique I learned while serving in the US Army.
If an instructor caught you nodding off in a class, he would wake you up, put a tear gas grenade in your hand and pull the pin. Your primary mission at that point became catching another troop going to sleep so you could pass the grenade.
Amazing what a live grenade in your hand will do to to keep you alert and focused......
Red
Re: (Score:2)
Terrible idea (Score:2)
Each person caught cheating would have incentive to dob someone else in whether or not they cheat. You would HAVE to tape it just to prove the person actually cheated. It would also be a huge distraction to have people pulled out of the test. If the lab is designed correctly, it should be trivial to make the Internet unreachable. If not, fix it and you're good to go for all future exams.
However all this is a waste of time - all you're testing here is memorisation skills. If that's what you need to test, fin
KDE's Kiosk mode (Score:3)
LTSP (Score:3)
LTSP has support for some lockdown options, and Ubuntu has support for LTSP. It's meant for running classrooms. You can netboot the clients into LTSP when you want to do an exam, and they can run their own install the rest of the time.
Fundamentally incompatible... (Score:2)
You pretty much have two options:
1. Lean on/buy beer for/be real nice to/go over the heads of/whatever it takes the IT s
remove (Score:2)
the network drivers.
disable the network in the bios.
log everything moving through the network.
I mean, really.
Simpler (Score:2)
Remove the network cables, or remove access at the firewall.
That is the ONLY way to remove their internet access without changing the OS configuration that will work. By the way, have I said that it is a stupid requirement to change the way the OS works without changing the OS configuration?
Supervise them? (Score:2)
If you're not going to supervise them, then it doesn't matter how tightly you lock down their computers since they'll just use google/IM from their phones instead.
If you're supervising them closely enough to know that they aren't typing on a phone on their lap, then you should be able to see if they are running a web browser.
Don't look at just the computer... (Score:3)
If you're worried about a user jumping out of your app and then searching the Internet, and you're in a a testing setting, you should be looking at a wholistic approach.
Your students will break your application, it's only a matter of time. Use other approaches to make this a useless option.
1) Don't allow any Internet access from the network layer, at all, this includes DNS servers. Ideally your systems should be on a completely disconnected network, meaning there are absolutely no external network connections.
2) Use SELinux to lock down your system. SELinux uses a mandatory permissions model, meaning you *must* be granted permission to be able to do anything.
3) Lock down alternative means of cheating. Cell phones, paper notes and so forth.
4) Follow through with punishing cheating in an appropriate manner.
5) Listen to the feedback of your users (Instructors and Students). This may seem counter intuitive, but it can help you build a better system.
Setup A VM? (Score:2)
Why don't you setup a VM on each machine that is locked down?
Re: (Score:2)
Why don't you setup a VM on each machine that is locked down?
Even if the VM itself is perfectly locked down, what's to stop the test taker from escaping back to the host operating system and running a browser there?
Re: (Score:3)
You run the VM in another VM, of course.
VMception, it's VM's all the way down, and all that.
Remove the keyboard (Score:2)
Fundamentally, you're trying for the impossible: you are trying to use the app to control the window manager.
This is a bit like google trying to stop you closing a browser window!
BUT: If your test happens to be multiple-choice, you could consider making the app run full-screen maximised (windowless), and then unplugging the keyboard. That would work.
[My dept has some computer systems designed for tracking who is present in the buidling; they solve the lockdown problem with a special keyboard that has only a
Re: (Score:3)
Actually, an easier way to fix this (that will go away on reboot) is:
1. Student logs in as normal, opens the test app.
2. You SSH in and kill -9 the window-manager.
3. Result: your test app is running full-screen, and there is no way to exit.
To restart the WM, you would need a shell, or Alt-F2 [and the latter is usually a feature of the WM]. There is a neater way to make this all happen if you write a shell-script. Create a desktop startup script that does something like:
#!/bin/bash
turn the problem upside down (Score:3, Insightful)
Drivers Ed... (Score:2)
You could maximize the window and tell them if they lose focus on the window (do anything else, open any other programs, surf the web, etc..) they fail the test. Have the app
keep track of window size(full screen) and foregnd (Score:2)
Another option is to disable the network(ipdown?) for the duration of the test and test for it during the exam. if it comes up at any time, shut it down and log it and the processes running to see if a browser or some user action caused it.
LoB
Good option: Fluxbox + browser 'lock-down' (Score:3)
0) install Fluxbox
1) edit the keys file and remove the right-click option (disable the other hotkeys too)
2) have firefox set to launch at startup
3) use the firefox addon 'Kiosk mode' and edit settings
That should protect you against most undesired activity.
Right (Score:2)
KDE and the Kiosk Tool (Score:2)
Install the KDE Desktop (Kubuntu) then use the Kiosk Admin Tool [kde.org].
Someone asked this on StackOverflow a while back (Score:4, Informative)
Someone asked a very similar question on Stack Overflow. It's here [stackoverflow.com]. The short version is: if you're running KDE and can change the window manager configuration, no problem. If you can change which window manager, then sure. (Also, the previous "yank the ethernet cable" or "boot off of live CD/USB" suggestions are quite reasonable. However, it is possible to handle most of it in the application using JNI to write X-Windows code which will capture most all keystrokes. It doesn't get ctrl-alt-backspace, but it appears to get prevent most of the rest.
Ubuntu locked down for a school environment (Score:3, Insightful)
I worked on this project for a Primary school. It's worked well for >2 years for 120 pupils.
http://linuxcentre.net/wiki/ [linuxcentre.net]
The parts about automatically resetting the homedir after reboot is probably of interest to you.
http://linuxcentre.net/wiki/index.php/Detailed_Maverick_Meerkat_OS_Netbook_Customisation [linuxcentre.net] below Home_Directory_Synchronisation
Re:Homework (Score:5, Insightful)
Hey, asshole. Ever occurred to you that, given clava's high UID, he/she isn't a geek and don't know enough of Linux/technology to do this? Look at how this question was redacted: it's obvious that he/she is not in control of the system, and is looking for some info here, where people with knowledge gather. Just answer the question if you can help and don't be pompous.
Re: (Score:3, Insightful)
WTF Man. Maybe they are a math/english/whatever teacher using some sort automated grading system. Maybe they're a good teacher but bad with computers? But NO! Unless you crafted it yourself bit by bit then its tantamount to "cheating".
Re: (Score:2)
Design tests that challenge understanding of the subject and reasoning, not memory.
But that's such a pain! "Test and forget" is so much more simple!
Re: (Score:3)
you forgot: "and design a new test every year, for each class, and different from all tests ever put out by the tens of thousands of universities over the years, coz those will end up on the interwebz".
since you're obviously not mediocre, i guess you're volunteering, genius ?
Re: (Score:3)
More or less, probably the easiest way of doing it would be to boot a CDROM and load the home directory over the network if need be. I haven't gotten it figured out, but you can load ISOs directly from disk using GRUB2 if need be.
http://www.panticz.de/MultiBootUSB [panticz.de]
Re: (Score:2)
Indeed. On my HTPC I have Xbmc running without a window manager, which doesn't allow you to run anything else and logs out if the program exits. But that requires some reconfiguration, and you'll still need to disable the virtual console features so they can't log in and start another X session.
You really can't expect to lock down a system that you can't reconfigure.
Re: (Score:2)
Also: why the hell shouldn't your students be able to search on the internet ?
Making them learn CS stuff like robots is retarded. Searching on the internet *will* be part of their jobs later (of course, almost all CS uni I've seen is doing it wrong too).
Of course, they'll also be able to communicate between them. That's an advantage, not a problem - later on, they'll also need to work with other people.
That leaves the *real* problem: figuring out how to rate them despite the fact they're communicating together. Logging what they do all the way would work - it'll increase the workload of rating them, though.
Why assume it's a CS test? Just because the test is running on computers doesn't mean it's a Computer Science test - I've heard that other departments have started using computers now.
Maybe it's an English Lit test where the test taker is expected to have read the book before the test, not google for answers.
And searching on the internet isn't always an option even in the real world. When I interview a developer, he better be able to write out code to solve a simple problem (I don't care if it's syntactical
Re: (Score:3)
Am I - 13 year long Linux user - missing something here, or isn't it that simple? ... I'm kinda weary, since no one else yet offered that sort of answer.
Please enlighten me if I'm mistaken.
The only thing you're missing is the submitter's requirements:
These computers are used by the students for other purposes and we're not allowed to create special users or change the OS configuration.
It's also likely that the submitter is not technically savvy enough to configure or alter the source code of his Window Manager enough to lock it down securely.