How to secure my computer for guests?

June 30, 2007 8:52 PM

Is there a method/program for limiting a guest's access to my computer to -only- a web browser (no start menu, programs, file directories, etc.)?

I don't like giving people unfettered access to my personal computer. I have way too many client and personal files on it to give access to someone who through error might damage anything. Is there an effective way when a house guest simply wants to check their email or read the news to make it so that they can only use the web browser? I'm envisioning something like the full screen function on FireFox but with no way to turn it off or acess any other functionality on the computer.

This isn't necessarily to hide anything... I realize a determined user could use the web browser as a file broweser... this is more to keep stupid people from breaking anything.

posted by JFitzpatrick to computers & internet (10 answers total)

What OS do you have in mind? Most (all?) modern OSes allow different user accounts, so you could create a guest account with little/nothing on the Start menu and no access to any important files.
posted by JMOZ at 9:05 PM on June 30, 2007

A linux live CD?
There are kiosk-oriented ones, which will limit the user to a browser, but it sounds like even a standard ubuntu disk could be your answer.
posted by pompomtom at 9:07 PM on June 30, 2007

Kiosk will be a useful term; maybe one of these Firefox extensions, none of which I've tried. A quick scan says they should achieve your stated goal even if not entirely secure.
posted by Abiezer at 9:08 PM on June 30, 2007

If it's windows you could force the guest user to use firefox.exe as their explorer shell.

Log on as your guest user then:

1) open regedit (start menu > run, and type in regedit).
2) go to: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
3) add a new string value (Edit > New > String Value) called shell. and set the value to the path of the new shell e.g C:\firefox\firefox.exe
4) log out and log back in.

(non tested directions) (found via google)
http://www.google.com/search?hl=en&q=change+windows+shell&btnG=Search
posted by mattdini at 9:10 PM on June 30, 2007

For Mac, I did a Google search for

mac os x kiosk mode

and got plenty of results for different browsers.
posted by The Deej at 9:19 PM on June 30, 2007 [1 favorite]

(Your mention of "start menu" means Windows. Consider my answer for posterity, when Mac users find this thread on a search.)
posted by The Deej at 9:31 PM on June 30, 2007

Microsoft offers the freely downloadable Windows SteadyState for this, on Windows XP.
posted by paulsc at 9:34 PM on June 30, 2007 [1 favorite]

@paulsc - I've haven't used SteadyState yet, but I'm way more experienced with the Shared User Toolkit it's replacing than I'd like to be, and it's probably more configuration than the OP wants. If it's easier to use now, great, it's about time.

Option 1 (a straight answer to your question)
For Windows:
*Use Fast User Switching with a GOOD password on your account (8+ characters, though 10+ is better)

*Create a second account that is only a "user" user (not a Power User or an Admin). The most harm this type of user can cause is to themself, not anyone else and not the PC itself.

*Install a Firefox kiosk extension (something like this one should be fine, sorry I can't recommend one since I haven't tried any personally). Since there's a bunch, I'd say find one you like (to give a little user-friendly opinion here, I'd say choose an extension that still would let you do what you'd want to be able to do on a friend's PC).

*Most importantly, set Firefox to auto-launch for that user account by putting the appropriate shortcut in the the Startup folder under Start -> All Programs -> Startup. For the above linked kiosk extension, it's "firefox.exe -chrome chrome://kiosk1/content/kiosk1.xul"

Options 2
Strange as it may sound, I'd actually not recommend anything I wrote above. A much smaller headache for you would be a second cheap PC. Buy something 10 years old from a garage sale and put a Kiosk CD in it (the older the PC the better for graphics card compatibility). That means you'll never want to use your PC when your friend is on it. Also, there's virtually no part of this solution that can ever break (short of actual hardware failure, which is quite rare when you exclude the hard drive, which you won't need).
posted by mysterious1der at 11:04 PM on June 30, 2007 [1 favorite]

There are commercial products that do exactly this, if you want to go that route - this is one of the ones I'm most aware of.
posted by jbickers at 7:03 AM on July 1, 2007

just switch to a guest account, that's what it's made for.
posted by Mr. Gunn at 9:32 AM on July 1, 2007 [1 favorite]