Comments on: How to secure my computer for guests?

Question: How to secure my computer for guests?

JFitzpatrick — Sat, 30 Jun 2007 20:52:51 -0800

Is there a method/program for limiting a guest's access to my computer to -only- a web browser (no start menu, programs, file directories, etc.)?

I don't like giving people unfettered access to my personal computer. I have way too many client and personal files on it to give access to someone who through error might damage anything. Is there an effective way when a house guest simply wants to check their email or read the news to make it so that they can only use the web browser? I'm envisioning something like the full screen function on FireFox but with no way to turn it off or acess any other functionality on the computer.

This isn't necessarily to hide anything... I realize a determined user could use the web browser as a file broweser... this is more to keep stupid people from breaking anything.

By: JMOZ

JMOZ — Sat, 30 Jun 2007 21:05:58 -0800

What OS do you have in mind? Most (all?) modern OSes allow different user accounts, so you could create a guest account with little/nothing on the Start menu and no access to any important files.

By: pompomtom

pompomtom — Sat, 30 Jun 2007 21:07:00 -0800

A linux live CD?
There are kiosk-oriented ones, which will limit the user to a browser, but it sounds like even a standard ubuntu disk could be your answer.

By: Abiezer

Abiezer — Sat, 30 Jun 2007 21:08:33 -0800

Kiosk will be a useful term; maybe one of these Firefox extensions, none of which I've tried. A quick scan says they should achieve your stated goal even if not entirely secure.

By: mattdini

mattdini — Sat, 30 Jun 2007 21:10:53 -0800

If it's windows you could force the guest user to use firefox.exe as their explorer shell.

Log on as your guest user then:

1) open regedit (start menu > run, and type in regedit).
2) go to: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
3) add a new string value (Edit > New > String Value) called shell. and set the value to the path of the new shell e.g C:\firefox\firefox.exe
4) log out and log back in.

(non tested directions) (found via google)
http://www.google.com/search?hl=en&q=change+windows+shell&btnG=Search

By: The Deej

The Deej — Sat, 30 Jun 2007 21:19:13 -0800

For Mac, I did a Google search for

mac os x kiosk mode

and got plenty of results for different browsers.

By: The Deej

The Deej — Sat, 30 Jun 2007 21:31:29 -0800

(Your mention of "start menu" means Windows. Consider my answer for posterity, when Mac users find this thread on a search.)

By: paulsc

paulsc — Sat, 30 Jun 2007 21:34:27 -0800

Microsoft offers the freely downloadable Windows SteadyState for this, on Windows XP.

By: mysterious1der

mysterious1der — Sat, 30 Jun 2007 23:04:04 -0800

@paulsc - I've haven't used SteadyState yet, but I'm way more experienced with the Shared User Toolkit it's replacing than I'd like to be, and it's probably more configuration than the OP wants. If it's easier to use now, great, it's about time.

Option 1 (a straight answer to your question)
For Windows:
*Use Fast User Switching with a GOOD password on your account (8+ characters, though 10+ is better)

*Create a second account that is only a "user" user (not a Power User or an Admin). The most harm this type of user can cause is to themself, not anyone else and not the PC itself.

*Install a Firefox kiosk extension (something like this one should be fine, sorry I can't recommend one since I haven't tried any personally). Since there's a bunch, I'd say find one you like (to give a little user-friendly opinion here, I'd say choose an extension that still would let you do what you'd want to be able to do on a friend's PC).

*Most importantly, set Firefox to auto-launch for that user account by putting the appropriate shortcut in the the Startup folder under Start -> All Programs -> Startup. For the above linked kiosk extension, it's "firefox.exe -chrome chrome://kiosk1/content/kiosk1.xul"

Options 2
Strange as it may sound, I'd actually not recommend anything I wrote above. A much smaller headache for you would be a second cheap PC. Buy something 10 years old from a garage sale and put a Kiosk CD in it (the older the PC the better for graphics card compatibility). That means you'll never want to use your PC when your friend is on it. Also, there's virtually no part of this solution that can ever break (short of actual hardware failure, which is quite rare when you exclude the hard drive, which you won't need).

By: jbickers

jbickers — Sun, 01 Jul 2007 07:03:28 -0800

There are commercial products that do exactly this, if you want to go that route - this is one of the ones I'm most aware of.

By: Mr. Gunn

Mr. Gunn — Sun, 01 Jul 2007 09:32:51 -0800

just switch to a guest account, that's what it's made for.