I run a small business and would like to use Linux for its free naturet. Is there a way to lock down linux using software or a whole distro that would prevent people from doing pretty much anything other than opening a web browser similar to Windows or ChromeOS. I would use ChromeOS, had it not been made by Google as I am not super keen on using something made by big tech.
Edit: This would be for employees and is exclusively about endpoint security, mot enforcing staying on task.
cordlessmodem ( @cordlessmodem@kbin.social ) 15•1 year agoIf you’re looking for a pure kiosk experience check out porteus kiosk, it’s a very stripped down distro that lets you choose Firefox or chrome and by default uses private browsing.
I’m sure if you need a whole desktop experience that’s also possible but i don’t know how
MyMulligan ( @MyMulligan@lemmy.one ) 1•1 year agoPorteus is cool. I messed around with it when trying to set up an idiot proof browsing pc for a relative.
l3mming ( @l3mming@lemmy.fmhy.ml ) 10•1 year agoWould this locked-down distro be used by customers or by employees? If it is being used by employees, there is no faster way to be hated than putting unnecessary restrictions on their logins. You don’t want that kind of workplace.
I simply do this:
-
Make sure they don’t get sudo/root privileges.
-
Remote mount their home directories (nfs).
-
Don’t add any restrictions beyond that. It is a waste of time and money.
-
Control the rest through company policy, usually clauses under the ‘Misuse of company network’ section.
-
Who cares if employees are browsing tik-tok or whatever if they’ve done all their work? That’s a work-allocation issue. If they haven’t done all their work then that’s already a solved problem. Either motivate them or performance manage them slowly towards the door.
-
Who cares if they want to install xyz software [in their home directory]? Chances are it’ll be a free boost for performance and/or morale.
UrbenLegend ( @UrbenLegend@lemmy.ml ) 8•1 year agoAll good points. Who the heck cares as long as your employees deliver their promised work on time?
I should add that you should however restrict data storage, mandate disk encryption, etc.
l3mming ( @l3mming@lemmy.fmhy.ml ) 1•1 year agoAgreed. I manage both of these transparently beyond the employee’s view. All the employee knows is that they have xyz free space to use on their profile.
dango ( @dango@fedia.io ) 4•1 year agoWho cares if they want to install xyz software [in their home directory]? Chances are it’ll be a free boost for performance and/or morale.
This /really/ depends on your threat model. “xyz software in their home directory” could easily be “exfil tool that uploads all data employee X has access too, disguised as a meme template generator”
I was more worried on the cybersecurity side rather than the work allocation issue.
-
ChojinDSL ( @ChojinDSL@discuss.tchncs.de ) 7•1 year agoBack when internet cafés were still a thing, a common practice was to have a bunch of thin clients that would have no local storage and have them boot over the network. The environment would get wiped every time someone logged off.
You could do something similar. Cheap machines with no local storage. Bios settings that prevent any sort of booting from usb sticks and protect the bios with a password.
Projects like LTSP are designed for this.
You could boot the machines in a read only mode and just have the browser available. Perhaps also only allowing sharing of files through something like nextcloud where you could theoretically also lock down what type of files are allowed. Or at least be able to inspect the files that people are storing.
nicman24 ( @nicman24@kbin.social ) 7•1 year agoYou will need to configure secure boot with your own keys, efistub and create a user with no sudo.
After that any selinux or apparmor distro will do.
What you are concerned about here is physical security so you will need to lock the bios, cut off the CMOS reset pins and probably solder the 3.3 battery.
Thank you!
auth ( @authed@lemmy.ml ) 6•1 year agoChromeOS sucks… I think its the worst OS I ever used
tom42 ( @tom42@kbin.social ) 5•1 year agoAlmost agree, just Windows RT is worse.
blackstrat ( @blackstrat@lemmy.fwgx.uk ) 5•1 year agoI’ve found the gold standard to be the NCSC Guidelines. This covers everything around proper deployment of end user devices in an organization. https://www.ncsc.gov.uk/collection/device-security-guidance
They have clamp down configurations for Windows and Ubuntu, plus others. This is the Ubuntu page, but there’ll be lots of cross over to other distros https://www.ncsc.gov.uk/collection/device-security-guidance/platform-guides/ubuntu-lts
Their security configuration packs are hosted on GitHub so you can vet them first if you want https://github.com/ukncsc/Device-Security-Guidance-Configuration-Packs
user_disagreement ( @user_disagreement@kbin.social ) 5•1 year agoI think avoiding ChromeOS is wise, that just puts Google in charge of your IT systems and leave you at the mercy of their data harvesting abomination of Linux loaded with proprietary software.
ctr1 ( @ctr1@fl0w.cc ) English4•1 year agoI’m sure there’s a better solution, but SELinux is an option. It can be difficult to customize, but it’s capable of locking down the system entirely. You could theoretically block all actions taken by the user except for a select few
mozilla_t
actions and others necessary for login. l3mming ( @l3mming@lemmy.fmhy.ml ) English5•1 year agoBut how will they have time to learn SELinux and run a business?
ctr1 ( @ctr1@fl0w.cc ) English1•1 year agoHaha. Yeah it takes time to learn how to do even the most basic things with it. Just how I would approach the situation
Brkdncr ( @Brkdncr@kbin.social ) 3•1 year agoI’m a huge proponent of Linux but unless your business is locking down linux you’re better off getting an off-the-shelf OS that’s simple to maintain so you can make money with your core business. ChromeOS is your best bet.
readwallah ( @readwallah@programming.dev ) 2•1 year agoLiveCD? Take a look at that as a number of distributions give you a read only experience.
ᗺark dor ( @barkdoor@infosec.pub ) 2•1 year agoFedora Silverblue is locked down desktop linux
frozen ( @frozen@lemmy.frozeninferno.xyz ) 2•1 year agoopenSuse Aeon with a non-admin user. It’s an immutable distro that uses Flatpaks for apps and automatically updates in the background. I use it on my laptop and it’s great.
pfr ( @pfr@lemmy.sdf.org ) 2•1 year agoNixOS
tom42 ( @tom42@kbin.social ) 1•1 year agoGood choice, just a little to sophisticated for a user coming from ChromeOS.
My apologies for the miscommunication; I wasn’t coming from ChromeOS, I was skating it as the only viable alternative, though undesirable.
itchy_lizard ( @itchy_lizard@feddit.it ) 2•1 year agoYou don’t want to do this.
hiyaaaaa23 ( @hiyaaaaa23@kbin.social ) 2•1 year agoNgl I know you don’t want to use big tech but I think chromeOS is probably your best bet.