Ubuntu kiosk based on 9.10

Updated 05/24/2011: Click here for the newest kiosk build based on Ubuntu 10.04.1.

Below is a the link for a kiosk build of Ubuntu based on 9.10. This build is a specific configuration of Ubuntu that will automatically login as a kiosk user. The kiosk user's xsession consists only of a single Firefox Window.

Be sure to see the FAQ at the bottom.

It has been designed so that the kiosk user can only use this Firefox window. I have taken every measure I could think of to disable the opening of other windows and closing of others. If the Firefox window is closed, the session ends and restarts gdm.

Instructions
-----------
1). Boot to CD room. Press enter to boot to the live CD.

2). At the automatic login prompt, click cancel until a list of users appears. Click on itadmin and enter the following password:

changeme

3). Double click on prep-kiosk. This generates the SSH keys (lost during the remastersys process) and disables vt switching. At this point, it will restart gdm, so get ready to login again.

4). If you are using a wireless environment, double click on setup-wireless-network and follow the prompts. Network manager is not installed.

5). If you would like, install acrobat reader using the script install-acrobat, but be warned, it's not been tested.

6). Change the password for itadmin by double clicking on change-password.

At this point you are done. To have a seamless experience, double click lock-kiosk (but READ the following warning).

The script lock-kiosk will disable the login prompt. The machine will boot straight into the kiosk user's account to a full screen Firefox. The only way to manage the kiosk without "unlocking" it at this point is through ssh to port 22022 of the kiosk.

To unlock the kiosk, boot to the live CD, login as itadmin with the default password, and double click the unlock-host script (not unlock-kiosk). Boot to the disk, and you should again get the login prompt.

ubuntu-9.10-kiosk-public-r1.iso

MD5 hash: 6d86af9f0fd449013f3a31b3f2a60180

Thank you to my employer (Everett Community College) for allowing me to develop this, and thanks Alex for hacking it.

FAQ
----
How do I change the home page for the kiosk user?

To change the home page, change the associated settings in /home/kiosk/.mozilla/firefox/obw0c5n2.default/user.js. The three settings are towards the top and are browser.startup.homepage, browser.startup.homepage_override_url, and browser.startup.homepage_welcome_url. I have made note to create a script that does this.

Can the wallpaper be changed?

For the itadmin account, yes. Not for the kiosk user. The kiosk user's xsession only loads metacity and firefox, not gnome.

How do I restrict web browsing to only one or a few websites?

See http://jacob.steelsmith.org/content/blocking-websites-using-dansguardian

Comments

Thanks for your hard work on this! I'm using this to turn old PC's into thin clients for VDI. Thanks again!

thanks, this is very usefull, i am using on my personal project, a children helper kiosk.

Hi,

I was asked to build a kiosk-pc for a yachtclub for doing boatreservations in the match race center. They wanted to restrict the sites people could access to guarantee that
the pc wasn't used for anything else than the purpose it was meant for.

I installed your brilliant kiosk build and then installed squid (proxy-server). I configured squid only to forward request to the sites people where supposed be able to access. I created an startpage/homepage saying that only the below listed sites are allowed. The startpage/homepage was also squids ERR_ACCESS_DENIED file (the page shown if you try to access a "forbidden page"). I edited Firefox's user.js file for the kiosk user to force all traffic to go via the proxyserver on localhost:3128

Also made a backup of the installation using remastersys backup.
Unfortunately it didn't fit on a CD anymore, but it works fine
from a bootable USB-stick also. I also disbled booting from anything else than the HDD and password protected the BIOS.

The people who wanted the kiosk-pc just picked it up a while ago. I'm dying to hear their feedback. In my own opinion my solution was quite neat!

Thanks Jacob for a brillian kiosk build!

With kind regards,

Pontus

I have downloaded the ubuntu-9.10-kiosk-public-r1.iso and booted an older computer with it. I tried to chose the "itadmin" user at the login screen, but my computer is too slow. It takes too much time to build up the login screen. It is not possible for me to choose the itadmin-user, because the default user will start up even before the login screen is operational on the screen.

I tried to login via SSH on port 22022. This port seems to be opened, but I didn't manage to login.

Perhaps I can login via an other screen. Can you tel me how to get a longer time before the kiosk user will login automatically?

If not, I could perhaps put the harddisk in a faster computer for the installation process, and then put it back.

Martin

Try clicking on the cancel button over and over again until the two users show (itadmin and kiosk). Then click on itadmin. I saw a similar behavior when testing this on a virtual machine. It may take 5 or 6 times. Every time you click, the time r is reset. Let me know if this works.

The system will not draw the cancel button, but continue the login process. Finally, I putted the hard disk in a faster computer for the installation process.

Then, I followed the steps from 1) to 6). But with these steps, the system will not be installed on the hard disk. When I boot the computer without the CD, there is still my old system on the hard disk.

Finally, I booted from the CD, and typed "install" at the beginning. With this, the installation process started up after booting. I had to choose the french language, Cameroon time zone, french keyboard layout. I gave my name and a password. But then, the installation process stopped at something between 60 and 72%. Even the mouse cursor didn't move any more. I tried this several times.

I tried also to boot up the CD, getting in to the user "itadmin", and double-clicked on the icon "ubiquity-gtkui.desktop". With this, there is also an installation process starting up (after a question if I am trusting this program), but with no better result.

When starting the itadmin-user, there is always an error after some time, saying "Sorry, the program 'gvfsd-metadata' closed unexpectedly".

I checked the CD at boot menu, there seems to be no error on the CD.

For the moment, I don't have other ideas what to do to install your system on my computer.

I tried another time, while writing this, with the "ubiquity-gtkui.desktop"-icon. This time, I left the English language, changed only the keyboard layout, and the time zone. The installation process went up to 81%, "configuring system locales…" and got stuck.

Martin

When starting the itadmin-user, there is always an error after some time, saying "Sorry, the program 'gvfsd-metadata' closed unexpectedly".

Don't worry about that.

I'm not sure what the problem with that machine may be, but it could be a hardware issue.

This looks to be just what I need.
Not being an xwindows/gnome/xfce/kde expert (I'm a cli server man myself), can you tell me what you need to change to launch an app different to firefox - I'd like a kiosk that fires up a terminal services client (/usr/bin/tsclient) to create a kiosk thin-client setup.

Many thanks
David

In /home/kiosk/.xsession, edit line that calls /usr/bin/firefox and call the program of your choice. You will probably need to either edit /home/kiosk/.devilspie, or comment the line devilspie & in .xsession to prevent devilspie from closing all non-firefox windows.

Hi,
I'm trying to fire up a wine program.
In /home/kiosk/.xsession I've added
/usr/bin/wine 'c:/Program Files/path....', commented /usr/bin/firefox
and devilspie&, but doesn't work!

Solved.
The problem was the path.
/usr/bin/wine 'c:/Program Files/path....'
become
/usr/bin/wine /home/user_name/.wine/path_to_program...

This looks great, and I am downloading it right now, but I was hoping that you or someone could shed light on a few things.

Should I be updating/upgrading anything after this is installed? Or will that break the functionality?

Also, someone mentioned using Squid to create a whitelist of allowed websites, and I was wondering just how one might go about doing this.

Also if you could give me any other tips/tricks that might make things go smoother that would be great.

I always do updates on my test kiosk and reboot several times and use flash, java, etc. before updating my production kiosks. The worse that will happen is you will need to use the iso to reinstall.

We used dansguardian, via a post here: http://www.pilpi.net/journal/item-985.php to block all websites except for the ones we wanted. To blanket block, edit /etc/dansguardian/lists/bannedsitelist and uncomment ** under Blanket Block. To add the acceptable sites, use /etc/dansguardian/lists/exceptionsitelist and to edit the blocked page, edit the file /etc/dansguardian/languages/ukenglish/template.html, depending on your language choice.

Hi Jacob,

Great this kiosk version you made, I have it running here and it is absolutely fantastic. A user just can't screw up anything.

Just one question: what if a user needs to open a document (say a PDF or a DOC)? The screen asking if the file should be opened is supressed, so you will not be able to open it. Any suggestions?

Best regards and keep on the good work!

Sergio

There is a script called "install-acrobat" that will do just that, install acrobat reader. This is probably a security risk and may compromise the kiosk as the user may be able to save the document and, when choosing where to save, open other files on the system. It just hasn't been tested, and we had no need for it.

One major issue may be, if a user can open the kiosk's .xsession file and edit it, they will be able to start gnome-session instead of just firefox, giving them a full working PC.

Hi Jacob,

I tried the script, but it has the same problem; once in kiosk mode, you need to enter the pop up screen asking what you would like to do with the document, but this screen is not displayed (well actually it is for less then a second). I ofcourse agree with you that this is a security risk. I am at this moment trying some solutions for this problem.

A "normal" user usually does not know linux and does not even know the excistence of the .xsession file ;-)

Best regards,

Sergio

If commenting out the line in /home/kiosk/.xsession that says devilspie& doesn't work, then it's the rkiosk extension installed in Firefox. You can alter the same .xsession file and put --safe-mode after the call to firefox to disable the rkiosk extension.

Hello!
First of all, let me say that your edited distro is great! it really helped me a lot! now i have some problems to sort out, but i don't understand much about linux...i'm a newbie.

So, i have installed your distro in a hard drive in order to make some changes for kiosks live cd's. I have managed to edit the homepages, the keyboard languages/layout but i have a problem here. When using the kiosk mode in portuguese keyboard layout, i lose the secondary symbol keys, like @ , § {} for example, since this symbols are made by using the altkey+number. But when entering ubuntu in administration mode everything works great.

The second problem is that i need to run a background program, like vnc server, in kiosk mode, so the machine can be remotely restarted, or shutdown. how can i do this?

Really hope you can help me.

Best regards,
David Oliveira

The alt keys are disabled in the first two xmodmap commands in /home/kiosk/.xsession . If you enable the alt keys, A kiosk user can easily get out of firefox using the alt shortcut and minimize the browser, rendering the kiosk useless until the power button is pressed.

A side note; right click is disabled using the information in this blog http://blog.burlock.org/ubuntu/140-disabling-the-mouse-scroll-wheel-left... .

I would look into using ssh on port 22022 from another machine to restart or shutdown the machine. From your desktop, assuming your kiosk IP is 192.168.1.101:

ssh -p 22022 itadmin@192.168.1.101

Hit enter and wait for the password prompt. Once you're in the kiosk, use:

sudo reboot

or
sudo shutdown -h now

Hello,

Thanks for this great build. Is there any way to allow the kiosk to print?

I have a printer attached to my kiosk and from the Itadmin account I can print just fine, but when I click the print button (I added the print button to the browser)from the autologin kiosk, it will not print. It does (for a split second)flash the print page (where you would normally select your printer). I noticed that the printer was not listed when it did this though. The only option was print to file.

Any assistance would be greatly appreciated.

Thanks
Paul

You will probably need to either edit /home/kiosk/.devilspie, or comment the line devilspie & in .xsession to prevent devilspie from closing all non-firefox windows.

You will want to add the printer as itadmin. It will (hopefully) be available for the kiosk user. If not, check the user rights when logged in as itadmin.

If a user can open the kiosk's .xsession file and edit it, they will be able to start gnome-session instead of just firefox, giving them a full working PC.

Jacob,

Thanks for putting this build together. Was very useful in getting Kiosks up and running as needed in our environment.

One thing I could not figure out how to code was the devilspie settings for allowing a print dialog box. I could not seem to find anywhere what the application name for printing would be.

I was about to use printing by just commenting out the devilspie line as you stated in your post, but was wondering if there was a better way to do this that I was missing?

Again, thanks for everything you did and thanks for you help.

Chris

Hi Paul,

I would love to know how you enabled the print icon, I cant seem to find the setting in the user.js file..

Thanks,
Iain

Thanks for a great build.

One question: Is it possible to redirect the browser to its homepage after some x time of inactivity?

I know about one add-on that does that (Refresh2Page). Maybe it's possible to allow only this one add-on?

Many thanks,
Finnur

You can edit the /home/kiosk/.xsession file and comment out the line that calls firefox and add gnome-session. Once you are booted to a full desktop for kiosk, use the shell to start firefox in safe mode (firefox --safe-mode) and disable the rkiosk extension. Start firefox normally, add the Refresh2Page extension, then reverse the steps above.

We are testing this out to replace our card catalog only pcs. So far it is working a lot better than the Windows XP boxes. Is there a way to disable the power save options and add a screen saver?

Thanks.

The power management options should be configurable by logging in as itadmin and using "Power management" under the System -> Preferences menu.

To configure the screensaver, you can edit the /home/kiosk/.xsession file as itadmin, and comment out the line that calls firefox and add gnome-session. Log out, then let the kiosk user log in. You should get a full desktop. The screen saver can be configured under System -> Preferences -> Screensaver.

Staff really likes the Kiosk system. We are still having issues with the power management and the scrensaver. We unlocked and edited the /home/kiosk/.xsession file then logged in as kiosk and made the changes. Logged out and back in as itadmin and edited the /home/kiosk/.xsession back but when you reboot as kiosk it appears that it didn't save any of the changes. Is there another step we need to do? Thanks.

Hi, I have been having the same problem and I think this may help you.
gksudo gedit /etc/X11/xorg.conf
-run this from the itadmin account and paste this into the file:

Section "ServerFlags"
Option "BlankTime" "0"
Option "StandbyTime" "0"
Option "SuspendTime" "0"
Option "OffTime" "0"
EndSection

I still can't change the screensaver but at least now the screen doesn't go blank.

not exist solution to set up screensaver ?

This looks like an excellent tool. However, the iso download isn't working for me?

I have installed your ubuntu image with kiosk. When i go in firefox to a website with login screen. the login screen disappear to the backgrond and i can t login. I can t find de parameter to change this behavior

Have you suggestions

See the comment below about disabling devilspie. If that doesn't work, then it's the rkiosk add-on for firefox. You'll want to start a full session (See below) for the kiosk user and remove that add on.

Hi Jacob, great job.

I'm need to activate a 3G modem with the kiosk. So I installed the network-manager and usb-modeswitch on the itadmin account, but is not working yet. I also need to activate it on the kiosk account but is asking for a password wich I can't find. Any suggestions?

Cheers.

You can use the itadmin account to change the password for the kiosk user. I don't remember what I set it to. =) At the command line, type:

$ sudo passwd kiosk

And you should be prompted to enter the new password.

I'm not sure about the hardware. If it works with a live CD, that would be very strange. I didn't do anything that would affect hardware use, that I know of.

Hi ,

This tool is excellent . Question though , how does one build the image like this, or other words , can I install sth like office or another daemon and then make it into an alternate CD ?

ta,
gabliver

You will want to look into remastersys. This is what I used to build the kiosk image.

This tool is excellence! Will you create 10.4 lts version in the future?

Yes, I am planning on working on a version based on 10.04.1. You can try upgrading the kiosk, and if it fails, just reinstall from the iso.

The tool is great, baut i have some problems. I'd like to draw shutdown button so user kiosk can just restart firefox or shutdown pc. I have some problem to install Huawei e1550 for 3g. I try to install network-manager-gnome, but it does not recognise my usb key.

Hello. You did great! But I have a question. How can I allow window to pop up. I am having certificate issue in Firefox. How can I add an exception for certificates. I it not allowing the pop up window for adding exceptions. Thanks in advance.

You will probably need to either edit /home/kiosk/.devilspie, or comment the line devilspie & in .xsession to prevent devilspie from closing all non-firefox windows.

Hi,
great tool but i too am have a similiar problem that i cannot resolve.
Basically for our application, we need the pdf function to work.
We have an internal site that links to a folder with pdf's and we want firefox to display the pdfs. I am using apache to serve the page and localhost is the url. It works great in itadmin with adobe reader but in kiosk mode, only a blank page is displayed. I think adobe is trying to run for the first time but i cannot see any windows other then firefox in kiosk mode so i cannot permit the adobe box from doing its first startup procedure. i have tried commenting out the line in .xsession and no luck.
do you have any advice on how i could achieve this?
Thanks

The certificate issue might be solved by adding a security exception while logged in as itadmin, then copy the exception from the cert_override.txt file in

/home/itadmin/.mozilla/firefox/h47srl69.default/cert_override.txt

and paste it into the bottom of

/home/kiosk/.mozilla/firefox/obw0c5n2.default/cert_override.txt

Hello,

Is there a way to install a root certificate for the kiosk user ?

Best Regards

Hi Jacob,

Very good job! Great project! I install it in a restaurant! :)

Works wireless.

2 tiny questions for you :

1) How can add language pack to the already installed kiosk?

2) How to deny web site (like porn, sexual content,..) for the kiosk?

Thanks and waiting your answers.

1). I believe you would install language-pack-*language* where *language* is the two character representation of your language.

2). Try opendns.com for the easiest solution.

Hi Jacob,

I was able to setup a Squid/Dansguardian/iptables solution.

Working fine.

Link : www.zephyrsoft.net/files/linux-filtering-monitoring-howto.pdf

I am working on the language pack. :)

I am having fun with that. I will experiment more.

Thanks you very much.

Simon

Hi,
I have a Web Kiosk machine
and one Key on the keyboard to simulate ALT + shift(change the language)
Well, when the ALT key is disabled,this button does not work and user can not change language.
What solution do you recommend?

And I don't remember off hand how I did it. I will reply again and let you know how I disabled it and how to enable it.