Locking down Raspbian to only allow limited features

Question

In a public environment a computer can get a lot of abuse, leading to system failures, viruses, compromised security, etc. In many schools, the computers are setup to only allow basic features to be used, causing an error if someone tries to do something a little as opening a game.

I plan to put a Raspberry Pi in a public environment to allow people to be able to feel the "Raspberry Pi Experience" without owning a Raspberry Pi themselves. This poses a major security problem, being able to use the Raspberry Pi with no limits.

Is there a way that I can lock down the advanced features of the Raspberry Pi so that a user playing with it cannot mess it up beyond repair?

Answer 1

Linux is a multi-user environment by default. Each user has his own folder in /home/TheUserName

Users are highly restricted outside that folder. They only have read access to most things.

By default, the Raspberry Pi comes with a single user called pi. This user has a home directory called /home/pi/. The catch: By default the pi user has the ability to access anything through sudo, which executes commands as root.

The solution

Make a new user. By default, new users don't have sudo access.

sudo adduser guest

Now, when logging in (assuming terminal mode): Just enter guest as a username, enter your password, then type startx to get into the GUI. This user will not be able to modify anything outside /home/guest.

You may also want to change the default "Pi" password, execute this as pi:

sudo passwd pi

Now your guest user will only be able to destroy their own /home/guest directory without damaging the rest of your Raspberry Pi.

Extra

You may also want to backup the fresh /home/guest. So that in case a guest messes the guest user up, you can simply recover it from the backup.

execute this as pi:

mkdir /home/pi/backup
sudo cp /home/guest /home/pi/backup/guest

To recover the guest account:

sudo rm -f -r /home/guest #Remove the guest folder.
sudo cp /home/pi/backup/guest /home/ #Copy the backup to where the guest folder used to be.
sudo chown -R guest /home/guest #Give "guest" ownership of the new guest folder.

If you want the guest account to always reset on startup, make sure that same script always executes on boot by putting it in /etc/rc.local.

Answer 2

Hello World has an excellent answer here. However, I'd like to take it one step further. I asked in a comment under his answer:

"Can you take it one step further? How do you keep user "guest" from being able to read, write, or execute the other home directories, while still allowing sudoers the ability to read, write, and execute guest's directories and files?"

Here's how: run these commands:

sudo adduser guest 
sudo chmod g+w /home/guest
sudo chmod o-rwx /home/* 
sudo usermod -aG guest pi

Short description

• sudo adduser guest = Add a new user called "guest"
• sudo chmod g+w /home/guest = Add Group 'w'rite access to /home/guest so that anyone in the group now has full privileges to this folder. To be sure they truly get full privileges, you could also use sudo chmod g+rwx /home/guest instead.
• sudo chmod o-rwx /home/* = Subtract 'o'ther user 'r'ead, 'w'rite, and e'x'ecute access to all directories inside the /home/ folder so that no basic user, such as "guest", can access another user's files.
• sudo usermod -aG guest pi = 'a'dd user "pi" to the "guest" 'G'roup so that he now gets the above group privileges (rwx) to the /home/guest folder.

Done! User "guest" can no longer view other users' folders at all, while user "pi" can still have full access over all of "guest's" home files and folders inside "/home/guest".

Long description:

1. Add a new user called "guest": sudo adduser guest. Note that this also creates a home folder for guest called "/home/guest"

2. Let's move to the "/home" folder now to look at some stuff. cd /home. View the permissions of the folders: ls -l Example output:

   drwxr-xr-x 22 guest guest 4096 Dec 6 23:16 guest
   drwxr-xr-x 43 pi pi 4096 Dec 10 10:39 pi

   • This output tells us a lot of information. Read here for more info (https://www.linode.com/docs/tools-reference/linux-users-and-groups).
   • The first line ("drwxr-xr-x") tells us it is a 'd'irectory, with 'r'ead/'w'rite/e'x'ecute (rwx) permissions for the User, 'r'ead and e'x'ecute (r-x) permissions for the Group, and 'r'ead and e'x'ecute (r-x) permissions for Other users.
   • "guest guest" tells us the User this folder belongs to is "guest", and the Group this folder belongs to is also "guest." (User is listed first, Group is listed second).
   • The last "guest" at the end of the first line is the name of the folder inside the "/home/" directory that these permissions apply to.
3. Notice that the Other users have r-x permissions to both the "guest" home folder and the "pi" home folder. We don't want this, as it means that "guest" can read and execute files inside of the "pi" home folder, "pi" can read and execute files inside of the "guest" home folder, and any other users you may make in the future can read and execute files inside of both home folders! We do, however, want members of the "guest" group to have full privileges to /home/guest, so we will give them write privileges. Hence, sudo chmod g+w /home/guest adds the write (w) permission to the 'g'roup permissions for this directory, and sudo chmod o-rwx /home/* subtracts the rwx permissions from 'o'ther users for all directories inside the "/home" folder, including both "/home/pi" and "home/guest". ls -l now shows:

   drwxrwx--- 22 guest guest 4096 Dec 6 23:16 guest
   drwxr-x--- 43 pi pi 4096 Dec 10 10:39 pi

4. Now, user "guest" can NOT view the /home/pi files anymore since it is part of the /home/pi "Other" users, and "Other" users have no permissions on it anymore! However, user "pi" can also NOT view the /home/guest files anymore since it is part of the /home/guest "Other" users, and "Other" users have no permissions on this directory anymore either. We'll fix this next:

5. Lastly, now that members of the "guest" Group have full privileges (rwx) over the /home/guest directory, we need to add user "pi" to the "guest" group, so that "pi" can access and use the /home/guest directory fully. That's what sudo usermod -aG guest pi does. To verify that it worked, run groups pi and you'll see a printout of all the groups user "pi" belongs to. I see this:

   pi : pi adm dialout cdrom sudo audio video plugdev games users input netdev spi i2c gpio guest

   • Notice the "guest" group listing at the very end. That means user "pi" is now a member of group "guest".
   • Also notice that if you run groups guest you'll see that user "guest" is only a member of group "guest." This is good, as it means he is a basic user. If he was a member of the "pi" group, he would now have r-x privileges over /home/pi, which we do NOT want, and if he was a member of the "sudo" group he would be a super user (administrator, like user "pi"), capable of changing all of these permissions and doing whatever he wanted! That would also be bad.

6. Final notes:

   • to prove to yourself that user "guest" cannot access /home/pi, you can switch to the guest user via the 's'witch 'u'ser command: su guest. It will ask for the guest password. Once entered, do cd /home/pi and you'll see the following:

     pi@raspberrypi3:/home $ su guest
     Password:
     guest@raspberrypi3:/home $ cd /home/pi
     bash: cd: /home/pi: Permission denied
     guest@raspberrypi3:/home $

   • If you try to run any sudo command as the "guest" user, you'll get this error:

     guest is not in the sudoers file. This incident will be reported.

   • To see the report of these types of security incidents, switch to the "pi" user (su pi), then run sudo cat /var/spool/mail/mail (source).

Done!

Cheers,
Gabriel Staples
www.ElectricRCAircraftGuy.com

Background References:

• Locking down Raspbian to only allow limited features
• *****https://www.linode.com/docs/tools-reference/linux-users-and-groups
• https://www.raspberrypi.org/documentation/linux/usage/users.md
• https://stackoverflow.com/questions/527876/how-to-restrict-a-linux-user-to-be-only-able-to-read-home-user-and-nothing-else
• https://superuser.com/questions/1153827/how-to-i-use-linux-groups-to-restrict-read-write-execute-access-by-other-users
• https://superuser.com/questions/1154043/linux-permissions-users-groups-others-white-list-or-black-list-and-help-sha
• https://www.cyberciti.biz/faq/understanding-etcgroup-file/
• https://askubuntu.com/questions/88356/changing-ownership-of-home-folders/88396#88396
• https://unix.stackexchange.com/questions/29570/how-do-i-remove-a-user-from-a-group
• https://stackoverflow.com/questions/13546933/where-are-sudo-incidents-reported

Answer 3

This answer is about problem workaround and it's recommended only for lazy or very busy administrators

For more professional/better approach see another answer(s)

I had similar problem with PC computers available for guests in my uncle motel.

In Windows there is "Guest" user and "Guests" group. This is pretty well designed to limit user rights to minimum, however we still had some problems with mess on desktop, browser histories, browser bars and addons, people accidently saving their passwords in browser, kids doing stupid jokes with desktop screenshot set as wallpaper and icons turned off etc.

After few "computer repairs" related with these problems I decided to allow everything and restore whole hard disk to "clean state" after every reboot.

After I did that - never had to go there and fix anything.

Guests are very happy too, because they can do anything - install their camera drivers, some software from USB stick etc. If they mess up - reboot that takes 5 minutes fixes everything.

I think that method may work for you too.

Answer 4

This does not secure the public computer from crash, but you are ready to quickly set it up running again if you have some copys of the boot-SD. This way nobody can break into your OS.

Here is how you clone your current OS:

You need a SD card reader and nothing else put in the USB. Put a micro-SD into the card reader (or SD card adapter).

IMPORTANT: It has to be of same size as the boot-SD and same brand bought at same time. Because all superblocks get overwritten, All metadata about its hardware get overwritten! If hardwares differ the SD is lost.

sudo fdisk -l
umount /dev/sda1
mount

Be sure that any partitions will show up as sda1, sda2, ... Repeat 'umount' for each /dev/sd*#

See the output from 'fdisk' and be sure if=FROM and of=TO

sudo dd if=/dev/mmcblk0 of=/dev/sda iflag=nofollow oflag=noatime
sync; sync #to be sure it has flushed all data to disk

That's it!

To see the progress you send a signal through another terminal:

pid=$(pgrep -x dd)
sudo kill -USR1 $pid

And if it stucks as it did for me at first time (bad SD):

sudo kill -9 $pid