Lean and Mean

FluxBox Minimalistic Desktop PC


This is part of an experiment to use Linux as a kiosk system. 'Kiosk System' can mean a couple of things, but here we assume that it's a computer that runs just one application , a web browser, or a limited, well defined number of applications. That way, the computer can be left unattended, e.g. in public places (public libraries, ... ) or be used as a thin client to a (web) Application server or a Remote Desktop / Terminal Services server.

Although you can run GUI apps without a Window manager or a Desktop environment, I usually add Fluxbox window manager to provide some window management, menus, etc. which sometimes comes in handy for troubleshooting, and to keep the user away from the shell (both for userfriendliness and as a security measure).
Fluxbox is pretty lightweight and easily configurable. Its main purpose in our kiosk configurations will be to provide a simple menu to let the user restart a hung application or shutdown or restart the system, and to have autostart on the main application. And set screensaver preferences.

Install a windowing system

On a minimal Debian or Ubuntu system :

	## install window system	### requires ubuntu 'universe' repo for fluxbox ! ###
	apt-get update
	apt-get -y install xorg fluxbox

You may want or need a screensaver (eg to lock the screen after an inactivity time-out) :

    apt-get install xscreensaver xscreensaver-data screensaver-data-extra

You may also want some extra tools that contribute to an agreeable user experience :

    apt-get install numlockx		# can be used for 'numlock on by default'

configuring the software

As is usual on Linux, applications come with config files that contain default values. A copy of those will end up in the user home directory, in a hidden directory (such as ~/.fluxbox or ~/.mozilla). To force a configuration upon the user, you can

On top of that, you want to prevent the user from modifying the configuration, so you'll make these files read-only or r-x (not writable), or replace them with links to readonly files, mount a read-only directory to the user's home directory, and so on. This might break some applications if they expect to write to the user home (eg firefox). A mechanism to replace the user home directory with a virgin copy at every startup / login might be in order

fluxbox configuration

All user-specific fluxbox configuration is in /home/user/.fluxbox. This could be a link to a read-only directory elseware, eg /etc/kiosk/fluxbox.
The .fluxbox directory should exist at least contain the following files :

startup
Script that runs when fluxbox starts. It sets a number of configuration settings, and can be used to start applications - especially those that you want running in the background (&).
init
basic configuration + references to other config files. You could use this to point to config files outside the user home.
keys
meant to contain keymappings. By making it an empty file, the system defaults are overwritten and no key mappings are active.
slit
defines and configures side bars on the desktop. We make it an emty file, but as the file exists, it overrides the system defaults. The result is : no side bars.
style
defines the "style", "theme" or "look" of the desktop. A style file is created by copying a sample style from the /usr/share/fluxbox/style directory and referencing the copy from the init file. You can then apply changes to it at will.
menu
Defines the main "start" menu that appears when you click anywhere on the desktop. Edit it so it only contains those apps you want the kiosk user to have access to.
windowmenu
Defines the window menu that appears when you click a window's title bar and offers items to close / moce / ... the window. Replace it with an emty file to disable the menu and limit the user's ability to mess with the windows (eg if you want to impose 1 application on 1 window with fixed size and position): lege file om windowmenu te disablen (move, close, ...). Althoug you can hide the title bar by setting the application (in apps) with [Deco]{NONE}, the menu remains available if the user clicks at the edge of the window, so if you want to disable it, you need to have this empty file.

creating default files for a fluxbox kiosk environment

These commands create "empty" files so as to disable the corresponding features :

	echo -e "[begin]\n[end]" > .fluxbox/overlay
	echo -e "[begin]\n[end]" > .fluxbox/slitlist
	echo -e "[begin]\n[end]" > .fluxbox/windowmenu

The fuxbox init file initializes the window manager. You can start with a partial file that contains only the settings you definitly want to have; the rest will be completed with system defaults. You use this file to point to the location of other config files, and to set a default theme.

	session.appsFile:	~/.fluxbox/apps
	session.keyFile:	~/.fluxbox/keys
	session.menuFile:	~/.fluxbox/menu
	session.styleFile:	/usr/share/fluxbox/styles/BlueNight 
	session.screen0.toolbar.visible:	false

autostart (starting an application as soon as fluxbox starts) can be implemented in .fluxbox/startup script of via the [startup] sectie in /fluxbox/apps
Here are sample menu and apps files, eg for a kiosk where you want to run Firefox Web browser

menu file

	[begin] (Fluxbox)
   		[exec] (Firefox Web Browser) {firefox} </usr/share/pixmaps/firefox.xpm>
   		[exit] (Exit)
	[end]

apps file

	[startup] {firefox}
	[app] (firefox)
		[Dimensions]  (WINCENTER) {1024 768}
        	[Position]    {0 0}
		[Deco] {BORDER}
	[end]

the "keys" files can be replaced by something minimal such as

[begin]
# click on the desktop to get menus
OnDesktop Mouse1 :HideMenus
OnDesktop Mouse3 :RootMenu

# current window commands
Mod1 F4 :Close
Mod1 F9 :Minimize
Mod1 F10 :Maximize
Mod1 F11 :Fullscreen


# shutdown by Ctrl-Alt-Del
Control Mod1 Delete :ExecCommand sudo /sbin/shutdown -hP now
[end]

Apply some common sense : on a system where you don't want users to shutdown, dont provide the Ctrl-Alt-Del command.

to change ownership on the fluxbox files chown -R kiosk:kiosk .fluxbox.
This might be required to make things work under the given 'kiosk' user account. So you may also need to consider a Deepfreeze mechanism.

install and configure xdm ?

At this point, you also need to consider the use of a display manager.

The display manager (or 'dm') is the app that provides a login prompt (or "greeter"). It's main purpose is to force a login with a normal, non-root user account after the system has gone through its startup, as you don't want the kiosk session to start under the root account.

install xdm - it's a pretty simple and straightforward display manager.

Applications

Set preferences to the applications and try to lock them by setting their config files not writable. This may break some applications. Eg. Firefox expects the ~/.mozilla directory and certain files in it to be writable, and it will fail to start otherwise.

Some examples :

system administration

If you have installed an ssh server (see baseline), you can do your system administration from a remote workstation, by ssh. This should allow you at least a shell session, but you can also set it up so that you can work in a graphical environment remotely (see Remote Desktops).

Alternatively, you can change the default runlevel to 3 (in /etc/inittab) and disable the X startup scripts in rc2.d (runlevel 2). Now, the system will automatically boot to runlevel 3 for the end users - root can boot init 2 for a command prompt and no worries. However, this requires you review /boot/grub/menu.list to make sure the boot menu is visible and allows you to specify boot parameters. You then also require a grub password to prevent other users from doing the same.

You might consider removing the tty's from /etc/init.tab so that a user can not drop to a console by pressing ALT F1, F2, .... setting the login shell to /bin/true might also be a good idea to prevent shell access. Make sure you can still do system administration (eg via ssh).

example

A locked-down Firefox on a minimal FluxBox desktop, used as an Online Public Catalogue browser (OPAC) for a Public Library.
fluxbox and firefox as a, online public catalogue for the Antwerp Public Library

Bits And Pieces

edit the screensaver settings. This is easiest by running screensaver -> settings (from the fluxbox menu)

Check Out


Koen Noens
June 2007