Streamlining user management

[Frazer]

Hi

I am building a laptop installation on a collection of refurbished laptops to be used in a secondary Physics education environment. The core build and applications are in place but I can't figure out how to manage non-admin users in any sort of realistically efficient manner. I was hoping that there might be an application by application checkbox option that would enable permissions to be set up but I can't find anything like that. I have looked at System Settings but configuration options are sparse and I have not found any useful documentation online so far.

Requirements are as follows.

1. Three user accounts; admin, teacher and student.
2. All setup should be from the admin login. There should not be any need to go into individual user logins to separately configure each one.
3. Mix of Linux native applications and Windows applications running under Play On Linux/Wine (all tested and running OK in admin user).
4. Wine configurations should be undertaken in admin login and then made accessible for non-admin users. Any admin changes should appear for non-admin users when they log in.
4. All users have the same desktop at start-up and any changes to non-admin desktops are lost/reset at next login.
4. Non-admin users cannot install any applications or access terminal/command line.
5. Ideally some software applications and tools should not even appear on the Application Launcher for non-admin users.

We are able to do all of the above in a Windows environment but have significant issues with cost of licensing and central IT management of older kit so would really like to go with Linux if possible.

[vinnywright]

I think you are looking for stuff like this , https://userbase.kde.org/KDE_System_...k/Introduction

VINNY

[oshunluvr]

How identical are the laptops? You might be able to set it up once, then use clonezilla to duplicate the first install.

Hi
I am building a laptop installation on a collection of refurbished laptops to be used in a secondary Physics education environment. The core build and applications are in place but I can't figure out how to manage non-admin users in any sort of realistically efficient manner. I was hoping that there might be an application by application checkbox option that would enable permissions to be set up but I can't find anything like that. I have looked at System Settings but configuration options are sparse and I have not found any useful documentation online so far.

Requirements are as follows.

1. Three user accounts; admin, teacher and student.
2. All setup should be from the admin login. There should not be any need to go into individual user logins to separately configure each one.
3. Mix of Linux native applications and Windows applications running under Play On Linux/Wine (all tested and running OK in admin user).
4. Wine configurations should be undertaken in admin login and then made accessible for non-admin users. Any admin changes should appear for non-admin users when they log in.
4. All users have the same desktop at start-up and any changes to non-admin desktops are lost/reset at next login.
4. Non-admin users cannot install any applications or access terminal/command line.
5. Ideally some software applications and tools should not even appear on the Application Launcher for non-admin users.

We are able to do all of the above in a Windows environment but have significant issues with cost of licensing and central IT management of older kit so would really like to go with Linux if possible.

You can do this for sure, but it's not pre-packaged. Much of what you ask for is already there - like non-admin users can't install software. That's a default. Any user should be able to run a program that has the proper permissions. The wine stuff might be a problem due to Windows insecure nature, but there's way's around that. You could edit the menu of the student account and remove anything they shouldn't see. Groups and permissions and pam access can control most else.

Admin user is the first to set up, then add teacher(s) next as a non-admin users, then you want the students to basically have a "guest" account that also has an immutable desktop? You might try building the user session the way you want then saving it, then set it to restore on log in. I don't know if that would cover everything.

You can lock down settings with an immutable marker that will prevent changes. You could wipe the user account with exit scripts and/or use permission to prevent writing files to the computers. I assume you'd want USB access for the students so they could save things off the system.

You can hide the admin user from the login screen so the temptation to "hack" is reduced and you can set the student account to not need a password to log in.

I don't see any road blocks here, but here's some work ahead of you.