diff --git a/allow_superuser_to_manage_cups.md b/allow_superuser_to_manage_cups.md new file mode 100644 index 0000000..0a7f852 --- /dev/null +++ b/allow_superuser_to_manage_cups.md @@ -0,0 +1,24 @@ +--- +title: "Tillad superuser at redigere indstillinger" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/allow_superuser_to_manage_cups.sh +parameters: +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Beskrivelse + +Dette script er indbygget i image 5.2.0 og fremover. + +Specifikt giver kørsel af dette script superuser tilladelse til at kunne redigere diverse printerindstillinger, +såsom at tilføje printere, eksempelvis fra en browser via CUPS' webinterface, der er tilgængelig på følgende adresse fra selve maskinen: +http://localhost:631 + + +## Parametre +Ingen + diff --git a/apt_get_config_set_dpkg_lock_timeout.md b/apt_get_config_set_dpkg_lock_timeout.md new file mode 100644 index 0000000..5d7943a --- /dev/null +++ b/apt_get_config_set_dpkg_lock_timeout.md @@ -0,0 +1,21 @@ +--- +title: "xxxx" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/apt_get_config_set_dpkg_lock_timeout.sh +parameters: + - name: "Aktiver?" + type: "boolean" + default: null + mandatory: false +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Todo! + +## Parametre +1. Sæt hak for at aktivere. + diff --git a/apt_get_config_set_fix_broken.md b/apt_get_config_set_fix_broken.md new file mode 100644 index 0000000..fe5b2f2 --- /dev/null +++ b/apt_get_config_set_fix_broken.md @@ -0,0 +1,23 @@ +--- +title: "xxxx" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/apt_get_config_set_fix_broken.sh +parameters: + - name: "Aktiver?" + type: "boolean" + default: null + mandatory: false +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Dette script installerer numlockx og slår numlock til når computeren når til loginsiden. + +Dette script er blevet testet og virker på Ubuntu 22.04. + +## Parametre +1. Sæt hak for at aktivere. + diff --git a/dconf_disable_gnome_remote_desktop.md b/dconf_disable_gnome_remote_desktop.md new file mode 100644 index 0000000..29541c8 --- /dev/null +++ b/dconf_disable_gnome_remote_desktop.md @@ -0,0 +1,25 @@ +--- +title: "Bloker for GNOME Remote Desktop (Fjernskrivebord)" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/dconf_disable_gnome_remote_desktop.sh +parameters: + - name: "Blokér for GNOME Remote Desktop?" + type: "boolean" + default: null + mandatory: false +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Dette script blokerer for GNOME Remote Desktop. +Inden kørsel af dette script, kan GNOME Remote Desktop aktiveres, hvis Indstillinger ikke er blokeret. +Indstillinger er dog blokeret for Borger i alle OS2borgerPC images siden 3.1.0. + +Scriptet er ikke relevant for OS2borgerPC Kiosk. + +## Parametre +1. Sæt hak for at blokere for Remote Desktop i Gnome, fjern for at tillade. + diff --git a/dconf_disable_lock_menu.md b/dconf_disable_lock_menu.md new file mode 100644 index 0000000..b636e15 --- /dev/null +++ b/dconf_disable_lock_menu.md @@ -0,0 +1,23 @@ +--- +title: "Desktop: Fjern lås fra menuen" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/dconf_disable_lock_menu.sh +parameters: +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Dette script er i kategorien "Udfases", da fjernelsen af lås fra menu allerede er indbygget i image 5.0.0 og senere, +og også fordi låsning pt. giver nogle problemer ift. rydning af hjemmemappen. + +Fjerner muligheden for at "låse" computeren fra menuen oppe til højre, +og den relaterede genvejstast CTRL-l fjernes også. + +Dette script er blevet testet og virker på Ubuntu 22.04. + +## Parametre +Ingen + diff --git a/dconf_disable_user_switching.md b/dconf_disable_user_switching.md new file mode 100644 index 0000000..96e3d74 --- /dev/null +++ b/dconf_disable_user_switching.md @@ -0,0 +1,23 @@ +--- +title: "Desktop - Fjern brugerskifte fra menuen" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/dconf_disable_user_switching.sh +parameters: +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +DDette script er i kategorien "Udfases", da fjernelsen af brugerskifte allerede er indbygget i image 5.0.0 og senere, +og også fordi brugerskifte pt. giver nogle problemer ift. rydning af hjemmemappen. + +Fjerner muligheden for at skifte bruger fra menuen oppe til højre. +Brugerskifte kan derved kun ske ved logud. + +Dette script er blevet testet og virker på Ubuntu 22.04. + +## Parametre +Ingen + diff --git a/lightdm_fix_boot_error.md b/lightdm_fix_boot_error.md new file mode 100644 index 0000000..a421dff --- /dev/null +++ b/lightdm_fix_boot_error.md @@ -0,0 +1,27 @@ +--- +title: "Fix Light Display Manager Opstarts-fejl" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/lightdm_fix_boot_error.sh +parameters: + - name: "Aktivér fix?" + type: "boolean" + default: null + mandatory: false +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Scriptet fikser en opstartsfejl i OS2borgerPC, relateret til Light Display Manager (LightDM). +Fejlen opleves ved, at maskinen ikke kan boote, og ender i terminalen, typisk kort efter installationen. + +Typisk ses en eller flere af disse fejlbeskeder i terminalen: + +"Failed to start Detect the available GPUs and deal with any system changes" +"Failed to start Light Display Manager" +"Bluetooth: hci0: Malformed MSFT vendor event: 0x02" + +## Parametre +1. Sæt hak for at aktivere fikset. Udelad hak for at deaktivere fikset. diff --git a/lightdm_greeter_setup_scripts.md b/lightdm_greeter_setup_scripts.md new file mode 100644 index 0000000..27dd582 --- /dev/null +++ b/lightdm_greeter_setup_scripts.md @@ -0,0 +1,29 @@ +--- +title: "Login - Slå scriptkørsel ved login til" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/lightdm_greeter_setup_scripts.sh +parameters: + - name: "Slet alle tidligere gemte login scripts fra computeren" + type: "boolean" + default: null + mandatory: false +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Dette script er i kategorien "Udfases" da det er indbygget i image 5.0.0 og senere. + +Slår kørslen af scripts ved loginskærmen til + +Dette script er en forudsætning for at NumLock aktiveres allerede fra loginskærmen med scriptet: +Desktop - Sæt NumLock-tilstand + +OBS: Kræver genstart før de nye indstillinger træder i kraft. + +Dette script er blevet testet og virker på Ubuntu 22.04. + +## Parametre +1. Sæt hak for at fjerne alle tidligere gemte login scripts fra computeren, eller lad stå tomt for at lade dem være. diff --git a/remove_new_release_message.md b/remove_new_release_message.md new file mode 100644 index 0000000..11b0ba4 --- /dev/null +++ b/remove_new_release_message.md @@ -0,0 +1,20 @@ +--- +title: "Desktop - Fjern besked om opdatering / opgradering" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/remove_new_release_message.sh +parameters: +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Dette script er i kategorien "Udfases" da det er indbygget i image 5.0.0 og nyere. + +Dette script fjerner popup om ny LTS-version. + +Dette script er blevet testet og virker på Ubuntu 22.04. + +## Parametre +Ingen. diff --git a/scripts/allow_superuser_to_manage_cups.sh b/scripts/allow_superuser_to_manage_cups.sh new file mode 100755 index 0000000..75a7aae --- /dev/null +++ b/scripts/allow_superuser_to_manage_cups.sh @@ -0,0 +1,3 @@ +#! /usr/bin/env sh + +usermod -aG lpadmin superuser diff --git a/scripts/apt_get_config_set_dpkg_lock_timeout.sh b/scripts/apt_get_config_set_dpkg_lock_timeout.sh new file mode 100755 index 0000000..2ae3b3c --- /dev/null +++ b/scripts/apt_get_config_set_dpkg_lock_timeout.sh @@ -0,0 +1,17 @@ +#! /usr/bin/env bash + +# This script is used to add or remove the setting dpkg lock timeout "300" from the apt-get configuration +# It takes a single boolean parameter: whether to add the setting or remove it + +ACTIVATE=$1 + +APT_CONFIG_FILE=/etc/apt/apt.conf.d/local + +# Always start by trying to remove the line to prevent duplicate entries +sed --in-place '/Dpkg::Lock/d' $APT_CONFIG_FILE + +if [ "$ACTIVATE" = "True" ]; then + cat << EOF >> $APT_CONFIG_FILE +Dpkg::Lock {Timeout "300";}; +EOF +fi \ No newline at end of file diff --git a/scripts/apt_get_config_set_fix_broken.sh b/scripts/apt_get_config_set_fix_broken.sh new file mode 100755 index 0000000..7c9990a --- /dev/null +++ b/scripts/apt_get_config_set_fix_broken.sh @@ -0,0 +1,17 @@ +#! /usr/bin/env bash + +# This script is used to add or remove the setting fix-broken "true" from the apt-get configuration +# It takes a single boolean parameter: whether to add the setting or remove it + +ACTIVATE=$1 + +APT_CONFIG_FILE=/etc/apt/apt.conf.d/local + +# Always start by trying to remove the line to prevent duplicate entries +sed --in-place '/Fix-Broken/d' $APT_CONFIG_FILE + +if [ "$ACTIVATE" = "True" ]; then + cat << EOF >> $APT_CONFIG_FILE +Apt:Get {Fix-Broken "true";}; +EOF +fi diff --git a/scripts/dconf_disable_gnome_remote_desktop.sh b/scripts/dconf_disable_gnome_remote_desktop.sh new file mode 100755 index 0000000..fc494aa --- /dev/null +++ b/scripts/dconf_disable_gnome_remote_desktop.sh @@ -0,0 +1,41 @@ +#! /usr/bin/env sh + +set -x + +if get_os2borgerpc_config os2_product | grep --quiet kiosk; then + echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine." + exit 1 +fi + +# Change these three to set a different policy to another value +POLICY_FILE="/etc/dconf/db/os2borgerpc.d/00-remote-desktop" +POLICY_LOCK_FILE="/etc/dconf/db/os2borgerpc.d/locks/00-remote-desktop" + +ACTIVATE=$1 + +if [ "$ACTIVATE" = 'True' ]; then + # Disable GNOME Remote Desktop VNC + RDP (and also lock to "View Only" which should be superfluous when they can't be + # enabled, but...) + cat > "$POLICY_FILE" <<-END + [org/gnome/desktop/remote-desktop/rdp] + enable=false + view-only=true + [org/gnome/desktop/remote-desktop/vnc] + enable=false + view-only=true + END + + # Tell the system that the values of the dconf keys we've just set can no + # longer be overridden by the user + cat > "$POLICY_LOCK_FILE" <<-END + /org/gnome/desktop/remote-desktop/rdp/enable + /org/gnome/desktop/remote-desktop/vnc/enable + /org/gnome/desktop/remote-desktop/rdp/view-only + /org/gnome/desktop/remote-desktop/vnc/view-only + END +else + rm --force "$POLICY_FILE" "$POLICY_LOCK_FILE" +fi + +# Incorporate all of the text files we've just created into the system's dconf databases +dconf update diff --git a/scripts/dconf_disable_lock_menu.sh b/scripts/dconf_disable_lock_menu.sh new file mode 100755 index 0000000..75d9911 --- /dev/null +++ b/scripts/dconf_disable_lock_menu.sh @@ -0,0 +1,32 @@ +#! /usr/bin/env sh + +# Removes lock screen from the menu - also removes the related keybind as an intended side effect + +set -x + +if get_os2borgerpc_config os2_product | grep --quiet kiosk; then + echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine." + exit 1 +fi + +# Change these three to set a different policy to another value +POLICY_PATH="org/gnome/desktop/lockdown" +POLICY="disable-lock-screen" +POLICY_VALUE="true" + +POLICY_FILE="/etc/dconf/db/os2borgerpc.d/00-$POLICY" +POLICY_LOCK_FILE="/etc/dconf/db/os2borgerpc.d/locks/00-$POLICY" + + +cat > "$POLICY_FILE" <<-END + [$POLICY_PATH] + $POLICY=$POLICY_VALUE +END +# Tell the system that the values of the dconf keys we've just set can no +# longer be overridden by the user +cat > "$POLICY_LOCK_FILE" <<-END + /$POLICY_PATH/$POLICY +END + +# Incorporate all of the text files we've just created into the system's dconf databases +dconf update diff --git a/scripts/dconf_disable_user_switching.sh b/scripts/dconf_disable_user_switching.sh new file mode 100755 index 0000000..c26abd9 --- /dev/null +++ b/scripts/dconf_disable_user_switching.sh @@ -0,0 +1,31 @@ +#! /usr/bin/env sh + +# Removes user switching from the menu + +set -x + +if get_os2borgerpc_config os2_product | grep --quiet kiosk; then + echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine." + exit 1 +fi + +# Change these three to set a different policy to another value +POLICY_PATH="org/gnome/desktop/lockdown" +POLICY="disable-user-switching" +POLICY_VALUE="true" + +POLICY_FILE="/etc/dconf/db/os2borgerpc.d/00-$POLICY" +POLICY_LOCK_FILE="/etc/dconf/db/os2borgerpc.d/locks/00-$POLICY" + +cat > "$POLICY_FILE" <<-END + [$POLICY_PATH] + $POLICY=$POLICY_VALUE +END +# Tell the system that the values of the dconf keys we've just set can no +# longer be overridden by the user +cat > "$POLICY_LOCK_FILE" <<-END + /$POLICY_PATH/$POLICY +END + +# Incorporate all of the text files we've just created into the system's dconf databases +dconf update diff --git a/scripts/lightdm_fix_boot_error.sh b/scripts/lightdm_fix_boot_error.sh new file mode 100755 index 0000000..eb07ac3 --- /dev/null +++ b/scripts/lightdm_fix_boot_error.sh @@ -0,0 +1,23 @@ +#! /usr/bin/env sh + +set -x + +if get_os2borgerpc_config os2_product | grep --quiet kiosk; then + echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine." + exit 1 +fi + +ACTIVATE="$1" + +CONF="/etc/lightdm/lightdm.conf.d/login-check-graphical.conf" + +if [ "$ACTIVATE" = "True" ]; then + +cat << EOF > $CONF +[LightDM] +logind-check-graphical=true +EOF + +else + rm --force $CONF +fi diff --git a/scripts/lightdm_greeter_setup_scripts.sh b/scripts/lightdm_greeter_setup_scripts.sh new file mode 100755 index 0000000..ba22d3f --- /dev/null +++ b/scripts/lightdm_greeter_setup_scripts.sh @@ -0,0 +1,47 @@ +#!/bin/sh + +# DESCRIPTION +# This script will enable running scripts when lightdm reaches greeter setup +# All scripts in the SCRIPT_DIR will be run. +# +# PARAMETERS +# 1. Checkbox. If checked empties the SCRIPT_DIR + +CLEANUP_LIGHTDM_GREETER_SETUP_SCRIPTS_DIR=$1 + +if get_os2borgerpc_config os2_product | grep --quiet kiosk; then + echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine." + exit 1 +fi + +LIGHTDM_DIR="/etc/lightdm" +LIGHTDM_CONF="$LIGHTDM_DIR/lightdm.conf" +SCRIPT_DIR="$LIGHTDM_DIR/greeter-setup-scripts" + +mkdir --parents "$SCRIPT_DIR" + +# This script executes all scripts in SCRIPT_DIR when called +GREETER_SETUP_SCRIPT="$LIGHTDM_DIR/greeter_setup_script.sh" +cat << EOF > $GREETER_SETUP_SCRIPT +#!/bin/sh +greeter_setup_scripts=\$(find $SCRIPT_DIR -mindepth 1) +for file in \$greeter_setup_scripts +do + ./"\$file" & +done +EOF + +# Set the correct permissions +chmod 700 $GREETER_SETUP_SCRIPT +chmod --recursive 700 "$SCRIPT_DIR" + +if [ "$CLEANUP_LIGHTDM_GREETER_SETUP_SCRIPTS_DIR" = "True" ]; then + rm --force "$SCRIPT_DIR"/* + echo Emptied directory "$SCRIPT_DIR" +fi + +# Idempotency: First delete any line with session-cleanup-script +sed --in-place "/greeter-setup-script=*/d" $LIGHTDM_CONF +echo "greeter-setup-script=$GREETER_SETUP_SCRIPT" >> $LIGHTDM_CONF + +echo "Enabled running of scripts in $SCRIPT_DIR on lightdm greeter setup" diff --git a/scripts/remove_new_release_message.sh b/scripts/remove_new_release_message.sh new file mode 100755 index 0000000..7535b1d --- /dev/null +++ b/scripts/remove_new_release_message.sh @@ -0,0 +1,13 @@ +#!/usr/bin/env bash + + +release_upgrades_file=/etc/update-manager/release-upgrades + +# Simple backup +if [ ! -f $release_upgrades_file.org ] +then + cp $release_upgrades_file $release_upgrades_file.org +fi + +# Replace Prompt with never value +sed -i 's/Prompt=.*/Prompt=never/' $release_upgrades_file diff --git a/scripts/set_user_as_default_lightdm_user.sh b/scripts/set_user_as_default_lightdm_user.sh new file mode 100755 index 0000000..2d19c2c --- /dev/null +++ b/scripts/set_user_as_default_lightdm_user.sh @@ -0,0 +1,25 @@ +#! /usr/bin/env sh + +# Inspiration: https://askubuntu.com/questions/59199/can-i-set-a-default-user-in-lightdm + +if get_os2borgerpc_config os2_product | grep --quiet kiosk; then + echo "Dette script er ikke designet til at blive anvendt på en kiosk-maskine." + exit 1 +fi + +ACTIVATE=$1 +USER=user +FILE=/var/lib/lightdm/.cache/unity-greeter/state + +mkdir --parents "$(dirname "$FILE")" + +if [ "$ACTIVATE" = 'True' ]; then + cat <<- EOF > "$FILE" +[greeter] +last-user=$USER +EOF + chown --recursive lightdm:lightdm /var/lib/lightdm/ + chattr +i $FILE +else + chattr -i $FILE +fi \ No newline at end of file diff --git a/set_user_as_default_lightdm_user.md b/set_user_as_default_lightdm_user.md new file mode 100644 index 0000000..8ba45ba --- /dev/null +++ b/set_user_as_default_lightdm_user.md @@ -0,0 +1,30 @@ +--- +title: "Login - Sæt Borger som standard ved login" +parent: "Anbefalede sikkerhedsscripts" +source: scripts/set_user_as_default_lightdm_user.sh +parameters: + - name: "Slå numlock til" + type: "boolean" + default: null + mandatory: false +compatibility: + - "22.04" + - "BorgerPC" +included_in_image: true +--- + +## Beskrivelse +Dette script er i kategorien "Udfases", da det er indbygget i image 5.0.0 og fremover. + +Script der sætter "Borger" som standard ved login. + +Inputparametre: +1: Sæt hak for at sætte Borger som standard. Lad stå tom for at den forvalgte konto altid er den, der senest aktivt har logget ind. + +"Aktivt" vil sige, at der er logget ind ved at klikke på brugeren, fremfor alene autologin via timeout. Dvs. hvis der senest er logget ind på superuser, vil superuser stadig være forvalgt, selv efter autologin til Borger. + +Dette script er blevet testet og virker på Ubuntu 22.04. + +## Parametre +1. Sæt hak for at sætte Borger som standard. Lad stå tom for at den forvalgte konto altid er den, der senest aktivt har logget ind +