Skip to content

Commit e8148a1

Browse files
agnetemoosagnetemoos
authored
Merge pull request #9 from OS2borgerPC/7-tilføj-anbefalede-sikkerhedsscripts-fra-pc-image-iso-byg
7 tilføj anbefalede sikkerhedsscripts fra pc image iso byg
2 parents 32f5068 + dcee6ea commit e8148a1

20 files changed

+494
-0
lines changed

Diff for: ‎allow_superuser_to_manage_cups.md

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
title: "Tillad superuser at redigere indstillinger"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/allow_superuser_to_manage_cups.sh
5+
parameters:
6+
compatibility:
7+
- "22.04"
8+
- "BorgerPC"
9+
included_in_image: true
10+
---
11+
12+
## Beskrivelse
13+
Beskrivelse
14+
15+
Dette script er indbygget i image 5.2.0 og fremover.
16+
17+
Specifikt giver kørsel af dette script superuser tilladelse til at kunne redigere diverse printerindstillinger,
18+
såsom at tilføje printere, eksempelvis fra en browser via CUPS' webinterface, der er tilgængelig på følgende adresse fra selve maskinen:
19+
http://localhost:631
20+
21+
22+
## Parametre
23+
Ingen
24+

Diff for: ‎apt_get_config_set_dpkg_lock_timeout.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "xxxx"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/apt_get_config_set_dpkg_lock_timeout.sh
5+
parameters:
6+
- name: "Aktiver?"
7+
type: "boolean"
8+
default: null
9+
mandatory: false
10+
compatibility:
11+
- "22.04"
12+
- "BorgerPC"
13+
included_in_image: true
14+
---
15+
16+
## Beskrivelse
17+
Todo!
18+
19+
## Parametre
20+
1. Sæt hak for at aktivere.
21+

Diff for: ‎apt_get_config_set_fix_broken.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "xxxx"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/apt_get_config_set_fix_broken.sh
5+
parameters:
6+
- name: "Aktiver?"
7+
type: "boolean"
8+
default: null
9+
mandatory: false
10+
compatibility:
11+
- "22.04"
12+
- "BorgerPC"
13+
included_in_image: true
14+
---
15+
16+
## Beskrivelse
17+
Dette script installerer numlockx og slår numlock til når computeren når til loginsiden.
18+
19+
Dette script er blevet testet og virker på Ubuntu 22.04.
20+
21+
## Parametre
22+
1. Sæt hak for at aktivere.
23+

Diff for: ‎dconf_disable_gnome_remote_desktop.md

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
title: "Bloker for GNOME Remote Desktop (Fjernskrivebord)"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/dconf_disable_gnome_remote_desktop.sh
5+
parameters:
6+
- name: "Blokér for GNOME Remote Desktop?"
7+
type: "boolean"
8+
default: null
9+
mandatory: false
10+
compatibility:
11+
- "22.04"
12+
- "BorgerPC"
13+
included_in_image: true
14+
---
15+
16+
## Beskrivelse
17+
Dette script blokerer for GNOME Remote Desktop.
18+
Inden kørsel af dette script, kan GNOME Remote Desktop aktiveres, hvis Indstillinger ikke er blokeret.
19+
Indstillinger er dog blokeret for Borger i alle OS2borgerPC images siden 3.1.0.
20+
21+
Scriptet er ikke relevant for OS2borgerPC Kiosk.
22+
23+
## Parametre
24+
1. Sæt hak for at blokere for Remote Desktop i Gnome, fjern for at tillade.
25+

Diff for: ‎dconf_disable_lock_menu.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "Desktop: Fjern lås fra menuen"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/dconf_disable_lock_menu.sh
5+
parameters:
6+
compatibility:
7+
- "22.04"
8+
- "BorgerPC"
9+
included_in_image: true
10+
---
11+
12+
## Beskrivelse
13+
Dette script er i kategorien "Udfases", da fjernelsen af lås fra menu allerede er indbygget i image 5.0.0 og senere,
14+
og også fordi låsning pt. giver nogle problemer ift. rydning af hjemmemappen.
15+
16+
Fjerner muligheden for at "låse" computeren fra menuen oppe til højre,
17+
og den relaterede genvejstast CTRL-l fjernes også.
18+
19+
Dette script er blevet testet og virker på Ubuntu 22.04.
20+
21+
## Parametre
22+
Ingen
23+

Diff for: ‎dconf_disable_user_switching.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "Desktop - Fjern brugerskifte fra menuen"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/dconf_disable_user_switching.sh
5+
parameters:
6+
compatibility:
7+
- "22.04"
8+
- "BorgerPC"
9+
included_in_image: true
10+
---
11+
12+
## Beskrivelse
13+
DDette script er i kategorien "Udfases", da fjernelsen af brugerskifte allerede er indbygget i image 5.0.0 og senere,
14+
og også fordi brugerskifte pt. giver nogle problemer ift. rydning af hjemmemappen.
15+
16+
Fjerner muligheden for at skifte bruger fra menuen oppe til højre.
17+
Brugerskifte kan derved kun ske ved logud.
18+
19+
Dette script er blevet testet og virker på Ubuntu 22.04.
20+
21+
## Parametre
22+
Ingen
23+

Diff for: ‎lightdm_fix_boot_error.md

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
title: "Fix Light Display Manager Opstarts-fejl"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/lightdm_fix_boot_error.sh
5+
parameters:
6+
- name: "Aktivér fix?"
7+
type: "boolean"
8+
default: null
9+
mandatory: false
10+
compatibility:
11+
- "22.04"
12+
- "BorgerPC"
13+
included_in_image: true
14+
---
15+
16+
## Beskrivelse
17+
Scriptet fikser en opstartsfejl i OS2borgerPC, relateret til Light Display Manager (LightDM).
18+
Fejlen opleves ved, at maskinen ikke kan boote, og ender i terminalen, typisk kort efter installationen.
19+
20+
Typisk ses en eller flere af disse fejlbeskeder i terminalen:
21+
22+
"Failed to start Detect the available GPUs and deal with any system changes"
23+
"Failed to start Light Display Manager"
24+
"Bluetooth: hci0: Malformed MSFT vendor event: 0x02"
25+
26+
## Parametre
27+
1. Sæt hak for at aktivere fikset. Udelad hak for at deaktivere fikset.

Diff for: ‎lightdm_greeter_setup_scripts.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
title: "Login - Slå scriptkørsel ved login til"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/lightdm_greeter_setup_scripts.sh
5+
parameters:
6+
- name: "Slet alle tidligere gemte login scripts fra computeren"
7+
type: "boolean"
8+
default: null
9+
mandatory: false
10+
compatibility:
11+
- "22.04"
12+
- "BorgerPC"
13+
included_in_image: true
14+
---
15+
16+
## Beskrivelse
17+
Dette script er i kategorien "Udfases" da det er indbygget i image 5.0.0 og senere.
18+
19+
Slår kørslen af scripts ved loginskærmen til
20+
21+
Dette script er en forudsætning for at NumLock aktiveres allerede fra loginskærmen med scriptet:
22+
Desktop - Sæt NumLock-tilstand
23+
24+
OBS: Kræver genstart før de nye indstillinger træder i kraft.
25+
26+
Dette script er blevet testet og virker på Ubuntu 22.04.
27+
28+
## Parametre
29+
1. Sæt hak for at fjerne alle tidligere gemte login scripts fra computeren, eller lad stå tomt for at lade dem være.

Diff for: ‎remove_new_release_message.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: "Desktop - Fjern besked om opdatering / opgradering"
3+
parent: "Anbefalede sikkerhedsscripts"
4+
source: scripts/remove_new_release_message.sh
5+
parameters:
6+
compatibility:
7+
- "22.04"
8+
- "BorgerPC"
9+
included_in_image: true
10+
---
11+
12+
## Beskrivelse
13+
Dette script er i kategorien "Udfases" da det er indbygget i image 5.0.0 og nyere.
14+
15+
Dette script fjerner popup om ny LTS-version.
16+
17+
Dette script er blevet testet og virker på Ubuntu 22.04.
18+
19+
## Parametre
20+
Ingen.

Diff for: ‎scripts/allow_superuser_to_manage_cups.sh

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#! /usr/bin/env sh
2+
3+
usermod -aG lpadmin superuser

Diff for: ‎scripts/apt_get_config_set_dpkg_lock_timeout.sh

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#! /usr/bin/env bash
2+
3+
# This script is used to add or remove the setting dpkg lock timeout "300" from the apt-get configuration
4+
# It takes a single boolean parameter: whether to add the setting or remove it
5+
6+
ACTIVATE=$1
7+
8+
APT_CONFIG_FILE=/etc/apt/apt.conf.d/local
9+
10+
# Always start by trying to remove the line to prevent duplicate entries
11+
sed --in-place '/Dpkg::Lock/d' $APT_CONFIG_FILE
12+
13+
if [ "$ACTIVATE" = "True" ]; then
14+
cat << EOF >> $APT_CONFIG_FILE
15+
Dpkg::Lock {Timeout "300";};
16+
EOF
17+
fi

Diff for: ‎scripts/apt_get_config_set_fix_broken.sh

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#! /usr/bin/env bash
2+
3+
# This script is used to add or remove the setting fix-broken "true" from the apt-get configuration
4+
# It takes a single boolean parameter: whether to add the setting or remove it
5+
6+
ACTIVATE=$1
7+
8+
APT_CONFIG_FILE=/etc/apt/apt.conf.d/local
9+
10+
# Always start by trying to remove the line to prevent duplicate entries
11+
sed --in-place '/Fix-Broken/d' $APT_CONFIG_FILE
12+
13+
if [ "$ACTIVATE" = "True" ]; then
14+
cat << EOF >> $APT_CONFIG_FILE
15+
Apt:Get {Fix-Broken "true";};
16+
EOF
17+
fi

Diff for: ‎scripts/dconf_disable_gnome_remote_desktop.sh

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#! /usr/bin/env sh
2+
3+
set -x
4+
5+
if get_os2borgerpc_config os2_product | grep --quiet kiosk; then
6+
echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine."
7+
exit 1
8+
fi
9+
10+
# Change these three to set a different policy to another value
11+
POLICY_FILE="/etc/dconf/db/os2borgerpc.d/00-remote-desktop"
12+
POLICY_LOCK_FILE="/etc/dconf/db/os2borgerpc.d/locks/00-remote-desktop"
13+
14+
ACTIVATE=$1
15+
16+
if [ "$ACTIVATE" = 'True' ]; then
17+
# Disable GNOME Remote Desktop VNC + RDP (and also lock to "View Only" which should be superfluous when they can't be
18+
# enabled, but...)
19+
cat > "$POLICY_FILE" <<-END
20+
[org/gnome/desktop/remote-desktop/rdp]
21+
enable=false
22+
view-only=true
23+
[org/gnome/desktop/remote-desktop/vnc]
24+
enable=false
25+
view-only=true
26+
END
27+
28+
# Tell the system that the values of the dconf keys we've just set can no
29+
# longer be overridden by the user
30+
cat > "$POLICY_LOCK_FILE" <<-END
31+
/org/gnome/desktop/remote-desktop/rdp/enable
32+
/org/gnome/desktop/remote-desktop/vnc/enable
33+
/org/gnome/desktop/remote-desktop/rdp/view-only
34+
/org/gnome/desktop/remote-desktop/vnc/view-only
35+
END
36+
else
37+
rm --force "$POLICY_FILE" "$POLICY_LOCK_FILE"
38+
fi
39+
40+
# Incorporate all of the text files we've just created into the system's dconf databases
41+
dconf update

Diff for: ‎scripts/dconf_disable_lock_menu.sh

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#! /usr/bin/env sh
2+
3+
# Removes lock screen from the menu - also removes the related keybind as an intended side effect
4+
5+
set -x
6+
7+
if get_os2borgerpc_config os2_product | grep --quiet kiosk; then
8+
echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine."
9+
exit 1
10+
fi
11+
12+
# Change these three to set a different policy to another value
13+
POLICY_PATH="org/gnome/desktop/lockdown"
14+
POLICY="disable-lock-screen"
15+
POLICY_VALUE="true"
16+
17+
POLICY_FILE="/etc/dconf/db/os2borgerpc.d/00-$POLICY"
18+
POLICY_LOCK_FILE="/etc/dconf/db/os2borgerpc.d/locks/00-$POLICY"
19+
20+
21+
cat > "$POLICY_FILE" <<-END
22+
[$POLICY_PATH]
23+
$POLICY=$POLICY_VALUE
24+
END
25+
# Tell the system that the values of the dconf keys we've just set can no
26+
# longer be overridden by the user
27+
cat > "$POLICY_LOCK_FILE" <<-END
28+
/$POLICY_PATH/$POLICY
29+
END
30+
31+
# Incorporate all of the text files we've just created into the system's dconf databases
32+
dconf update

Diff for: ‎scripts/dconf_disable_user_switching.sh

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#! /usr/bin/env sh
2+
3+
# Removes user switching from the menu
4+
5+
set -x
6+
7+
if get_os2borgerpc_config os2_product | grep --quiet kiosk; then
8+
echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine."
9+
exit 1
10+
fi
11+
12+
# Change these three to set a different policy to another value
13+
POLICY_PATH="org/gnome/desktop/lockdown"
14+
POLICY="disable-user-switching"
15+
POLICY_VALUE="true"
16+
17+
POLICY_FILE="/etc/dconf/db/os2borgerpc.d/00-$POLICY"
18+
POLICY_LOCK_FILE="/etc/dconf/db/os2borgerpc.d/locks/00-$POLICY"
19+
20+
cat > "$POLICY_FILE" <<-END
21+
[$POLICY_PATH]
22+
$POLICY=$POLICY_VALUE
23+
END
24+
# Tell the system that the values of the dconf keys we've just set can no
25+
# longer be overridden by the user
26+
cat > "$POLICY_LOCK_FILE" <<-END
27+
/$POLICY_PATH/$POLICY
28+
END
29+
30+
# Incorporate all of the text files we've just created into the system's dconf databases
31+
dconf update

Diff for: ‎scripts/lightdm_fix_boot_error.sh

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#! /usr/bin/env sh
2+
3+
set -x
4+
5+
if get_os2borgerpc_config os2_product | grep --quiet kiosk; then
6+
echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine."
7+
exit 1
8+
fi
9+
10+
ACTIVATE="$1"
11+
12+
CONF="/etc/lightdm/lightdm.conf.d/login-check-graphical.conf"
13+
14+
if [ "$ACTIVATE" = "True" ]; then
15+
16+
cat << EOF > $CONF
17+
[LightDM]
18+
logind-check-graphical=true
19+
EOF
20+
21+
else
22+
rm --force $CONF
23+
fi

0 commit comments

Comments
 (0)