administrative security
Hi guys. Just a quick question: I haven't tinkered with the XO on an admin level, and it's something I don't plan to do as it's not my forte, but are mechanisms in place to prevent students from installing unauthorized apps, or malware? Basically stuff that will destabilize their productivity? (malware - linux is not a silver bullet for security, simplest point of failure is always peopleware - social engineering. It's so much easier to hack and program people than inorganic machines.) Anyway, default installation of XO OS gives easy access to admin controls. This just a G1G1 thing, or is this something that's disabled by default? Best, -Naz -- Carlos Nazareno http://twitter.com/naz404 http://www.object404.com -- interactive media specialist zen graffiti studios http://www.zengraffiti.com -- User Group Manager Phlashers: Philippine Flash ActionScripters Adobe Flash/Flex User Group http://www.phlashers.com -- if you don't like the way the world is running, then change it instead of just complaining. ___ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel
Re: administrative security
Physical access to the system gives full access, especially once the developer key is obtained, to install applications that their teachers or government had not considered. The system considers the user to be the authorisation authority. If specific applications are not welcome in a deployment, they should be checked for. (At my primary school it became illegal to use green or red pens. But they could never stop us, we just bought them from shops or each other.) -- James Cameronmailto:qu...@us.netrek.org http://quozl.netrek.org/ ___ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel
Re: administrative security
On Mon, Jan 12, 2009 at 12:00 PM, qu...@laptop.org wrote: Physical access to the system gives full access, especially once the developer key is obtained, to install applications that their teachers or government had not considered. The system considers the user to be the authorisation authority. so does that mean that XO OS ships with all the kids having admin accounts? If specific applications are not welcome in a deployment, they should be checked for. how about after deployment? like setting user permissions to prevent kids from installing unauthorized apps? thx -n -- Carlos Nazareno http://twitter.com/naz404 http://www.object404.com -- interactive media specialist zen graffiti studios http://www.zengraffiti.com -- User Group Manager Phlashers: Philippine Flash ActionScripters Adobe Flash/Flex User Group http://www.phlashers.com -- if you don't like the way the world is running, then change it instead of just complaining. ___ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel
Re: administrative security
Hi Carlos, Anyway, default installation of XO OS gives easy access to admin controls. This just a G1G1 thing, or is this something that's disabled by default? We intentionally give admin controls to children; we are trying to encourage them to explore, create, and solve problems with their machines. If they break something, the school can keep a USB key available for quick reflashes via holding down all four game keys, or the student can hold down the O key to boot into their previous build from olpc-update. I hope we will soon have a key to hold down at boot that restores you to the root filesystem as it was before your modifications, too, as an undo button. The children do not, in fact, regularly get malware, hacked, or stop their machine from booting through installing unauthorized software, so I don't think this is a large problem -- certainly not one worth crippling the machines from being able to install new software for. The undo button functionality or olpc-update's boot into previous build are sufficient to mitigate the sort of problems you're thinking of, though. Personally, I'd encourage deployments to continue to give root access to their children: there are other laptops that are designed to be locked-down and restricted, but this one is not one of them, and the combination of totally open-source software and restrictions on installing or modifying software do not mix well together. Thanks, - Chris. -- Chris Ball c...@laptop.org ___ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel
Re: administrative security
On Mon, Jan 12, 2009 at 12:28:41PM +0800, Carlos Nazareno wrote: so does that mean that XO OS ships with all the kids having admin accounts? In deployments, the XO ships in a locked state with an activation security system for theft reduction. The operating system builds used by a deployment team are up to them, they may customise, but if they base it on the OLPC builds then the Terminal activity grants them full access (a root prompt), and the virtual text console does the same. You can verify this by running the OLPC builds yourself. If specific applications are not welcome in a deployment, they should be checked for. how about after deployment? like setting user permissions to prevent kids from installing unauthorized apps? I specifically mean in the context of a deployment in progress, which includes support and ongoing monitoring by the deployment team. Deployment involvement for a child would end when they leave school. After deployment, if the child keeps the laptop, they would have full authority over it, and presumably no longer be cared for by the deployment monitoring systems. -- James Cameronmailto:qu...@us.netrek.org http://quozl.netrek.org/ ___ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel
Re: administrative security
On Jan 11, 2009, at 11:28 PM, Carlos Nazareno wrote: On Mon, Jan 12, 2009 at 12:00 PM, qu...@laptop.org wrote: Physical access to the system gives full access, especially once the developer key is obtained, to install applications that their teachers or government had not considered. The system considers the user to be the authorisation authority. so does that mean that XO OS ships with all the kids having admin accounts? If specific applications are not welcome in a deployment, they should be checked for. how about after deployment? like setting user permissions to prevent kids from installing unauthorized apps? You use the term authorized without defining it. What constitutes an authorized application? OLPC itself has steered clear of this job, since it is a political minefield. Governments are certainly an option, but this also makes censorship a major concern. The teachers at an individual school are probably less likely to engage in mass censorship, but also lack a lot of the technical knowledge and time to deal with these kinds of issues. The children themselves are probably the best place to determine this, but they also (moreso at first) will lack much of the technical sophistication to really know what is malware and what isn't. Bitfrost was always supposed to provide at least some form of a barrier, but I think it hasn't really fulfilled its original design in a lot of ways. So we are left with the status quo; users have final say, but the default policy for most things is accept. --Noah PS: Questions like this are probably better suited to the security list. ___ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel
Re: administrative security
... are mechanisms in place to prevent students from installing unauthorized apps, or malware? That is a social issue - how can kids be motivated to do acceptable things, and forgo immoral ones ?? I am much more concerned about how to prevent *adults*. The original thought was that if an OLPC were stolen, it would eventually de-activate unless refreshed by the school's server. But lately, OS on a stick have become available for the OLPC. If I were in an armed gang (and authority were weak), I would hold up a school, confiscate all the OLPCs, reload them with software that did not have security features, then sell those systems for cash. mikus ___ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel
