Comments for Sandro Mathys

Comment on FOSDEM 2010 Spacewalk Talk by red_alert

red_alert — Wed, 03 Mar 2010 16:26:47 +0000

Geert: Indeed! Thanks for note, should work now.

Comment on FOSDEM 2010 Spacewalk Talk by Geert

Geert — Wed, 03 Mar 2010 09:57:29 +0000

Slides give a 404

Comment on F12 Beta on Lenovo T400s by red_alert

red_alert — Tue, 10 Nov 2009 21:31:08 +0000

Sound works with GNOME but there seems to be a problem in KDE which we didn’t have the time to debug yet.

Comment on F12 Beta on Lenovo T400s by Seyto

Seyto — Sat, 31 Oct 2009 16:24:36 +0000

No problem with audio?
In my Fedora-11 sound from headphones work good, but not work from speakers. ;(

Comment on F12 Beta on Lenovo T400s by red_alert

red_alert — Wed, 21 Oct 2009 07:19:16 +0000

It’s an Intel Wireless WiFi Link 5300 in ours.

Comment on F12 Beta on Lenovo T400s by Chris

Chris — Wed, 21 Oct 2009 03:26:34 +0000

Do you have the “thinkpad” wifi card or the intel 5100 or 5300? I’ve got a t400s coming in the mail but it is unfortunately with the “thinkpad” wifi (realtek?) card as getting the intel card no longer seems to be an option (at least on Lenovo Canada).

Comment on Safe exams with Fedora by Victor Bogado da Silva Lins

Victor Bogado da Silva Lins — Tue, 06 Oct 2009 17:01:43 +0000

I think that the limitation should be added to the network it self and to the server. The network should have no external link and every computer on the room should only be connected to the server. This way the setup on the client computer would be only to disallow connections to unauthorized networks. This could be achieving bundling no wireless network drivers, no bluetooth, no ppp and etc.

I am a strong believer that security should be concentrated on the server side, the web server could make some checks to verify that the client is running the correct version of the browser, for instance using a https connection and a client side certificate.

Another thing, why use a window manager at all, if you are controlling the server you should be able to limit everything to a single browser window, just start a “maximized” browser with no window manager.

Comment on Safe exams with Fedora by Stephen Smoogen

Stephen Smoogen — Tue, 06 Oct 2009 16:51:19 +0000

The biggest issue is going to be that they are bringing their own laptop. Dealing with various wireless and video issues will probably make any liveboot an issue (even if it were netbooting windows).

Not insurmountable but probably the biggest cost issue to look at since most of the things you are asking for are in xguest as bochecha says.

Comment on Safe exams with Fedora by bochecha

bochecha — Tue, 06 Oct 2009 15:17:56 +0000

BTW, you’ll also want to add the following rule:
- the user can’t execute anything in his $HOME or in /tmp

xguest already does that ;)

Comment on Safe exams with Fedora by bochecha

bochecha — Tue, 06 Oct 2009 15:10:52 +0000

That system MUST:
- Be Fedora based :)

That one is easy :P

- Disallow the user to do any network traffic except to that one server (on ports 80/443 only) – the system itself should of course be able to do DHCP, DNS, et al.

SELinux confines the xguest user so that Firefox is the only application running in his session that can access the network.

Set up a filtrating proxy that only allows the ports 80 and 443 to this one web server only (Squid is pretty easy to setup to do that).

- Disallow any networking over anything but Ethernet

IPTables will be your friend here.

- Disallow access to any local storage (HDDs, SSDs, USB-keys/-disks)

Not sure how to do that. Maybe with some Udev rules you can prevent the devices to be created, and thus they won’t be mounted.

- Disallow the user to run anything but Firefox (even when Firefox prompts to open anything) – or a more secure gecko based browser(?)

The easiest would probably be to extend the xguest user to do that.

- Use matchbox-window-manager
- Have as little software as necessary

Just choose the installed RPMs in your kickstart.

- (Be easily update-/upgradeable)

This one is easy, provided you make all your modifications available as RPMs.

« Oh, and what’s the best way to bring all this onto a live media? »

Like I said, everything in RPM, then a kickstart file, then pungi/livecd-creator to create the image.