Kiosk Accounts

[franton]

Hi all,

Does anyone have any experience in setting up a "kiosk" type user account?

I have a requirement for an easy to access user account that is completely locked down apart from a web browser. The browser itself we only want to allow access to one or two internal websites only and possibly also prohibit access to any other part of the computer too.

Can I do this through Configuration Profiles or should I investigate MCX in more detail?

[CasperSally]

I know this doesn't answer your question, but ChromeOS (chromeboxes and chromebooks) just added kiosk mode support in the last month or so. We've tested it, and I hope to place ChromeOS devices in areas where we were using macs and setting up auto login, etc. Sure is cheaper.. and gets the macs more in the hands of students versus lookup type stations.

[franton]

Thanks but it's not an option. This is something for password resets to be applied across our entire mac estate.

[mscottblake]

I have a couple of these. What I did was create a user account with parental controls. The important part is to use the simple finder, specify the apps that are allowed to run, and set which websites your users are allowed to visit. I did set a Configuration Profile for these machines that turns the display sleep down to 3 hours, but that's obviously not required.

I also set this account to automatically login (for the sake of my staff) so if anything goes wrong, the machine just needs to be restarted and it's back to fresh.

If you would like, I can come up with some detailed screenshots of the steps I took.

[franton]

I've got the settings i'd like, it's capturing them is the issue. We still have JSS issues with being unable to upload plist files.

[Bukira]

I can build you a full screen browser that locks and hides menu bar and dock and auto sizes to the screen and works on dual screens, you can then auto login as a user and get this to load, you can then have buttons for the websites you wish the user to use.

There are APIs to display full screen without dock and menu bars and prevent auto quit etc, i use this to lock my screen, but the app can be a browser etc

[spalmer]

We use a WebKit based browser called wKiosk. The company and app have changed names to Adnx and xStand. The URL is http://www.adnx.com. It has lots of customizations including modifying the look and has full screen kiosk mode that can disable the Menubar, Apple Menu, Force Quit, and will auto relaunch if it crashes. You can also blacklist/whitelist URLs, prevent downloads and printing. Combined with the previously mentioned parental controls, you can lock it down fairly tight. For my next major kiosk build I will also be using Deep Freeze to help keep the kiosks clean and locked down.

We have been using the older wKiosk version on our Kiosks for about 10 years. For the life of the app there were free updates including major version upgrades. Back when we bought it there were also educational discounts. I am not sure what their purchasing policies are now though. I was a bit disappointed that the name change requires purchasing the app again, but hey we got 10 years worth of free upgrades.

We have encountered a few issues and have always gotten a quick response when reporting bugs. Usually after reporting bugs we got test builds within a few days and full point releases a week or two later.

The only major problems we have had are due to the fact that it is a WebKit based browser that can be affected by Safari updates. Recently we got bit by the fact that one of Apple's 10.6 security updates (which we still use as these Macs are quite old) secretly installed a Safari update that caused all fields on a webpage in wKiosk to render black. A quick downgrade to a previous version of Safari easily fixed it though.

[franton]

I can forget buying anything: they're just not shelling out for anything right now. I have to do this through MCX or I tell them it's not practical.

I've tried config profiles ... and they conflicted with existing MCX and hosed the computer until I removed them.
I've tried creating a whole mess of MCX settings and they didn't all apply properly.
I've now exported out a copy of the kiosk account's local MCX and imported into another account. While that works, I can't customise it further. For example, i've tried to include a setting to force Safari's homepage to something other than apple.com and that isn't being composited back in.

[rockpapergoat]

also check out chrome for kiosk mode or this:

http://barbariangroup.com/2012/07/plainview

both are free. awhile back, i setup kiosk accounts with just mcx and plainview. works fine.

[franton]

It's a real pain but the IT pages i'm dealing with don't play nicely with Chrome, especially over Access Manager.

What i'm trying to do is to create a kiosk account that will be available across our entire mac estate. There's a similar project going on with our Windows team. The account will be extremely locked down and basically it's there so people can reset their passwords and other misc tasks should they be locked out of their computers. (Does happen fairly regularly here).

Catch is we've macs in some sensitive areas so the account has to be locked down. The browser has to be restricted to certain webpages and pretty much only allow a browser or log out. Parental Controls would seem an ideal way to do this.

[Bukira]

HI, ill build you a full screen web kit browser just like the one from wkiosk for free if you want, cmyers@uclan.ac.uk

[FastGM3]

Here's another alternative. http://icab.de/ This browser has a great kiosk mode and you can set it up to only go to specified web sites. Put it in the startup items of the preferred user account. It is shareware but you can purchase a site license fairly cheap, and it includes a mobile device browser as well that also supports kiosk mode.

Chuck

[myronjoffe]

@Bukira Any chance you could help me with a wkiosk ?

[dwaterbury]

A little late to this, but hopefully it will help others. I’ve been using ecrisper Kiosk browser for the past year and find it incredibly easy. It’s $79 per computer. Downside is no site license or discount. But it is a one time cost. It has been working great for our 4 Library circulation computers.

https://ecrisper.com/