shutdown menu option

[nigel barker]

Dear All,

Where is the setting that prevents a skolelinux user from having the
option to shut down a workstation instead of just confirming the
logout? I have kids who just log out of laptops and then leave them
switched on.

Thanks
Nigel


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Jonas Smedegaard]

On Mon, Nov 09, 2009 at 12:33:20PM +0900, Nigel Barker wrote:
>Where is the setting that prevents a skolelinux user from having the
>option to shut down a workstation instead of just confirming the
>logout? I have kids who just log out of laptops and then leave them
>switched on.

I believe that what you are talking about is related to membership of
the group powerdev.  Or in newer systems is instead tied to consolekit.

Above the powerdev/consolekit level are tools like GDM, lxsession and
whatever is the name of the similar tool in KDE, which presents a dialog
for choosing e.g. logout/suspend/poweroff and greying out the options
that the underlying mechanism do not allow this particular user.

Below is probably some PAM settings which applies to all users.


I guess that you want to disable ability to logout, allowing only
shutting down, right?

In principle the most reliable approach is to attack the problem at the
bottom - i.e. not just configure KDE to do the right thing - because
that lasts only until the students discover some other fun tool on their
system that allows them to circumvent your KDE-specific lock-down.

Problem is, that powerdev/consolekit only really manages access to
shutting down the system, as that is fundamentally a privileged
operation.  Killing your own X11 session while leaving the rest of the
machine still running - is *not* a privileged operation, so is not
governed by the underlying mechanisms.

It is a human right to commit suicide, so to speak, but requires special
access to hit the big red Doomsday-machine button.

So the challenge is to protect something that is unprotected by
underlying design of the system. :-/

Step 1 is to disable CTRL+ALT+BACKSPACE in xorg config.  Then figure out
how to configure the obvious mechanisms to silent the non-privileged
logout routine while still presenting the shutdown (and remember to also
disable restart, as that is just a delayed logut).  Then you need to
hunt down all methods of quitting or killing the running processes and
make them difficult for ordinary users to invoke.

I certainly see the relevancy of this, seen from a school perspective,
but expect it to be difficult at best to implement.

Good luck ;-)


  - Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: [phone]  Website: http://dr.jones.dk/

  [x] quote me freely  [ ] ask before reusing  [ ] keep private

[nigel barker]

2009/11/9 Jonas Smedegaard <dr@...>:

> On Mon, Nov 09, 2009 at 12:33:20PM +0900, Nigel Barker wrote:
>>
>> Where is the setting that prevents a skolelinux user from having the
>> option to shut down a workstation instead of just confirming the logout? I
>> have kids who just log out of laptops and then leave them switched on.
>
> I believe that what you are talking about is related to membership of the
> group powerdev.  Or in newer systems is instead tied to consolekit.
>
> Above the powerdev/consolekit level are tools like GDM, lxsession and
> whatever is the name of the similar tool in KDE, which presents a dialog for
> choosing e.g. logout/suspend/poweroff and greying out the options that the
> underlying mechanism do not allow this particular user.

The login manager in KDE control centre didn't fix it. Thats why I
thought there must be a skolelinux setting.

>
> Below is probably some PAM settings which applies to all users.
>
>
> I guess that you want to disable ability to logout, allowing only shutting
> down, right?


That would be excellent, but just the default debian behaviour would
be fine - a choice of "end current session, shutdown, restart, cancel"

>
> In principle the most reliable approach is to attack the problem at the
> bottom - i.e. not just configure KDE to do the right thing - because that
> lasts only until the students discover some other fun tool on their system
> that allows them to circumvent your KDE-specific lock-down.
>
> Problem is, that powerdev/consolekit only really manages access to shutting
> down the system, as that is fundamentally a privileged operation.  Killing
> your own X11 session while leaving the rest of the machine still running -
> is *not* a privileged operation, so is not governed by the underlying
> mechanisms.

But its normal debian behaviour to allow users to shut down the
machine on logout. At least on laptops it is.

>
> It is a human right to commit suicide, so to speak, but requires special
> access to hit the big red Doomsday-machine button.
>
> So the challenge is to protect something that is unprotected by underlying
> design of the system. :-/
>
> Step 1 is to disable CTRL+ALT+BACKSPACE in xorg config.  Then figure out how


I wouldn't do this. There are several cases where it is a good thing -
frozen session, student hit lock instead of logout and walked away,
projector not detected and the Fn-key toggle doesn't work, ...
I have had to re-enable this feature on the one remaining ubuntu
machine we have in school.

> to configure the obvious mechanisms to silent the non-privileged logout
> routine while still presenting the shutdown (and remember to also disable
> restart, as that is just a delayed logut).  Then you need to hunt down all
> methods of quitting or killing the running processes and make them difficult
> for ordinary users to invoke.
>
> I certainly see the relevancy of this, seen from a school perspective, but
> expect it to be difficult at best to implement.
>
> Good luck ;-)
>

But not to me, because this stuff is way too hard for me. However,
your message has had me thinking about this and the more I do, the
more I wonder why we don't allow shutdown of workstations in
skolelinux? Apart from a local login to an ltspserver, in what other
case would it be bad for a user to shut down the machine instead of
logging out? Perhaps only if someone else is about to use it. In my
school many workstations are left on overnight. Perhaps this would be
improved if shutdown were a logout option?

My suggestion is for normal debian behaviour, except on ltspservers.

cheers
nigel


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Petter Reinholdtsen]

[Nigel Barker]
> In my school many workstations are left on overnight. Perhaps this
> would be improved if shutdown were a logout option?

Are you aware of the shutdown-at-night package, which will turn off a
unused machine at night if its hostname (output from uname -n) is
listed as a host member of the shutdown-at-night-hosts netgroup or if
the host have the file /etc/shutdown-at-night/shutdown-at-night?  It
can even turn it on again if the machine is supported by nvram-wakeup
or from a server using wake-on-lan.

Happy hacking,
--
Petter Reinholdtsen


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Holger Levsen-2]

Hi,

On Dienstag, 10. November 2009, Petter Reinholdtsen wrote:
> Are you aware of the shutdown-at-night package, which will turn off a
> unused machine at night ...?  It
> can even turn it on again if the machine is supported by nvram-wakeup
> or from a server using wake-on-lan.

it would be great to have this documented at
http://wiki.debian.org/DebianEdu/Documentation/Lenny/HowTo/Administration

Any takers? :-)


regards,
        Holger

[nigel barker]

2009/11/10 Holger Levsen <holger@...>:

> Hi,
>
> On Dienstag, 10. November 2009, Petter Reinholdtsen wrote:
>> Are you aware of the shutdown-at-night package, which will turn off a
>> unused machine at night ...?  It
>> can even turn it on again if the machine is supported by nvram-wakeup
>> or from a server using wake-on-lan.
>
> it would be great to have this documented at
> http://wiki.debian.org/DebianEdu/Documentation/Lenny/HowTo/Administration
>
>

It would be great to have it built in already. I don't fancy the
propsect of installing and configuring it 30 or 40 times for all our
workstations.
Which brings up another question: is there a way to centrally manage
the software on skolelinux computers?  Currently I just leave them for
a few years, then re-clone with a fresh install or convert them to
thin clients. I'm sure you guys do something clever that I don't know
about, right?

cheers
nigel

ps. I would still like to know why I have a shutdown option on debian,
but not on skolelinux.


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Petter Reinholdtsen]

[Nigel Barker]
> It would be great to have it built in already.

It is built into the Lenny version.  The shutdown-at-night package is
installed by default.  To enable it, you need to make sure the
netgroup exist in LDAP and add hostnames to it using lwat.

Happy hacking,
--
Petter Reinholdtsen


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[RalfGesellensetter]

Am Monday, 9. November 2009 schrieb Nigel Barker:
> Where is the setting that prevents a skolelinux user from having the
> option to shut down a workstation instead of just confirming the
> logout? I have kids who just log out of laptops and then leave them
> switched on.
>

I failed as well trying to enable direct shutdown on Workstations
(stable=Sarge), but thought this was done by kiosk tweaks.

The good thing about it: I had only 1 Sarge workstation,
the others are 5 years old Pre-Sarge installations or
thin clients.

Regards
Ralf


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Ronny Aasen-4]

Nigel Barker wrote:

> 2009/11/10 Holger Levsen <holger@...>:
>  
>> Hi,
>>
>> On Dienstag, 10. November 2009, Petter Reinholdtsen wrote:
>>    
>>> Are you aware of the shutdown-at-night package, which will turn off a
>>> unused machine at night ...?  It
>>> can even turn it on again if the machine is supported by nvram-wakeup
>>> or from a server using wake-on-lan.
>>>      
>> it would be great to have this documented at
>> http://wiki.debian.org/DebianEdu/Documentation/Lenny/HowTo/Administration
>>
>>
>>    
> It would be great to have it built in already. I don't fancy the
> propsect of installing and configuring it 30 or 40 times for all our
> workstations.
> Which brings up another question: is there a way to centrally manage
> the software on skolelinux computers?  Currently I just leave them for
> a few years, then re-clone with a fresh install or convert them to
> thin clients. I'm sure you guys do something clever that I don't know
> about, right?
>
> cheers
> nigel
>
> ps. I would still like to know why I have a shutdown option on debian,
> but not on skolelinux

Personally i use FAI
http://wiki.debian.org/DebianEdu/HowTo/FaiInstallDebianEdu

Ronny


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[nigel barker]

I am going to re-address my original question

2009/11/11 RalfGesellensetter <rgx@...>:

>
> I failed as well trying to enable direct shutdown on Workstations
> (stable=Sarge), but thought this was done by kiosk tweaks.
>

I can't find anything in kiosk admin tool

I did stumble upon
/etc/kde3/kdm/kdmrc
while fixing something else, and I discovered a bunch of stuff in
there about who is allowed to shutdown the machine and from where,
that got me excited.
However, no matter how hard I try, I can't get a shutdown option from
the logout confirmation, even as root. This frustrates me hugely,
because debian has a shutdown option for everyone by default.

ps. to Ralf - you still have Sarge workstations in your school? Are
you enjoying browsing with mosaic and managing your home with mc? I
like the way you refer to it as stable. ;)

nigel


--
To UNSUBSCRIBE, email to debian-edu-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...