Configuration of SCS Public Kiosks

At boot time, an SCS public kiosk is configured to forgo the normal Windows logon process and immediately provide a perpetual FireFox web browser for a visiting user but no other functions. This includes denying the user any means to store data or change the system state of the kiosk terminal.

Special Computer Configurations

All SCS public kiosk terminals are members of the CS-GENERAL domain in the CSCF Active Directory. As such, any maintainer not only should have local Administrator access to the kiosk PC but also domain rights such that he can make the kiosk a member of the CS-GENERAL domain and subsequently place the terminal into the appropriate OU within that domain: CS\Special Computers\Kiosk Computer

This OU has three GPOs applied to it which supply machine members (such as the kiosks) with appropriate software and access rights.

• CS Software Adobe Reader
• CS Software FireFox 2.0
• CS Kiosk Computer
  • User logon rights:
    • Domain Administrators
    • CS-GENERAL\cscf-kiosk, see the "Special User" section of this page.
  • Install the cscf_kiosk package.
    A locally developed software package used for managing the kiosk web browser(s).

Once assigned to the appropriate OU, there are a few more setup steps for an SCS kiosk. These can be applied to any Windows XP system regardless of whether it is a CSCF Standardized PC or not.

• Although a kiosk is essentially a Windows PC computer it is always assigned to a thin client subnet (59-net) to ensure restricted internet access.
• Ctrl-Alt-Del logon option must be disabled in the User Accounts applet (Advanced section) in the Windows Control Panel.
• The non-nil password requirement must be turned off in the same applet. This is the default state but it pays to check its status anyways.
• The username cscf-kiosk must be specified for all the default account entries in the Winlogon part of the terminal registry.
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
• For the same registry key, CS-GENERAL must be specified for all default domain entries.
• The Remote Desktop feature should be enabled in the System applet of the Windows Control Panel. This feature is handy for remote management of the kiosk terminal, especially for reboots and software upgrades (where necessary). It is advisable however to NOT grant the cscf-kiosk account remote logon rights when the kiosk goes into production.

If The Kiosk Has Two Screens

SCS has the following kiosks equipped with a main (touch) and alternate (upper) screen.

• scspc147 (scskiosk02)

Most video adapters supply an additional video applet in the Windows Control Panel on top of the standard Windows Display applet. Adapters which are capable of handling multiple screens will often allow the user to specify which screen an application should launch upon. When an SCS kiosk has two screens, we "create" a special web browser executable that the video adapter can be configured to recognize and launch only on the alternate screen. This special web browser is just a copy the web browser application (firefox.exe) which is then stored within the web browser's installation directory with an alternate name (firefox-upper.exe). Thus the kiosk's video display can be configured to recognize the alternate executable file and launch it on the alternate screen.

The presence of the alternate browser executable will also serve as a flag for the browser driver application (see 'Special Software Package' section of this page) to attempt to launch a second web browser for the alternate screen.

As a standard procedure we also place the alternate screen above and to the left of the terminals main display - normally the touch screen. This way, all items on the alternate or upper screen will have negative display co-ordinates. This adjustment is performed in the Display applet of the Windows Control Panel.

Special User Account

In the CS-GENERAL domain there is a special user account named cscf-kiosk which was created for the specific purpose running the kiosk user environment. It is a very different account from other user accounts in that it has the following user characteristics.

• The account password is blank.
  • Domain password complexity rules must be temporarily disabled before a blank password can be set. This password never expires and cannot be changed by the user.
• The account may only logon to specific systems within the CS-GENERAL domain.
  Because cscf-kiosk has a nil password its usage of other domain services must be restricted otherwise anyone could use this account to access domain services. These restrictions are set using the Log On To... button on the Account tab for the cscf-kiosk account properties in the Active Directory. cscf-kiosk may only logon to the following systems.
  • scspc022 (scskiosk01)
  • scspc147 (scskiosk02)
  • services106 (smb-files.cs)
• Customized Windows shell.
  Which is to say, it does not use Explorer.exe
  • The shell programme is a locally developed launcher application which starts the kiosk browser and ensures that the browser restarts in the event it fails. There is more information on this topic in the 'Special Software Package' section of this page.
• Strong restrictions on permitted applications and Windows utilities.
  • The account is permitted to run only certain specific applications, like the web browser. And it is forbidden from running other applications, such as Windows Explorer or any Control Panel applets.
  • These restrictions are controlled by the CS Kiosk User Account GPO which is applied to the OU where the cscf-kiosk account is maintained.
    CS\Special Accounts\Kiosk User
• Special Web Browser (FireFox) Configuration.
  • Kiosk configuration of the web browser is retained in the FireFox profile for the specific cscf-kiosk user and is not a machine wide configuration. The FireFox profile for any user is within the Windows profile for the user account.
    Follow the details outlined in Section 4 of the HOWTO page http://jadoba.net/PLUG/kiosks/howto for developing a FireFox kiosk. Special add-ons are applied to the cscf-kiosk user's FireFox profile. These add-ons are obtained through searching the Mozilla web site (http://www.mozilla.org/) or located from the Add-Ons item in the Tools menu of the FireFox browser. The requisite add-ons are as follows.
    • Stealther
      • Disables Browsing History, Cookies, Downloaded Files History, Disk Cache, Saved Form Information, Sending of Referrer Header.
    • Auto Reset Browser
      • Closes all the windows and open a new browser window after a specified time of inactivity.
        We've set this timeout period to be 5 minutes.
    • Public Fox
      • For blocking users from downloading unwanted files plus password protection of browser Add-ons, Preferences, 'about:config' settings, Bookmarks and can block unwanted web sites.
    • R-Kiosk
      • Defaults the browser to full screen, disables all menus, toolbars, key commands and right button menus.
      • Using the 'about:config' page of the web browser, we have enabled the navigation bar which R-Kiosk disables by default.
    • UI Tweak
      • This one is not mentioned in the Kiosk HOWTO page. It is necessary in order to hide the close and minimize buttons on the web browser interface.
  • Browser home page is set to be http://www.cs.uwaterloo.ca/kiosk
  • If the kiosk has two screens then cscf-kiosk will have a second FireFox profile which will be a near copy of the user's default FireFox profile. This cloned second profile is normally called upper and it has only a couple of differences from the default FireFox profile.
    • The browser home page is http://www.cs.uwaterloo.ca/kiosk/upper.shtml
      This is a special link-less web page which provides announcement information to users and the surrounding area around the kiosk terminal.
    • The R-Kiosk add-on is configured to hide the browser navigation bar. Thus the user cannot change the web location of the upper browser.

Special Software Package (cscf_kiosk)

Inspite of the kiosk add-ons provided by Mozilla, should the FireFox application terminate, there is nothing to restart it. Given the restrictive design of SCS's public kiosks, there is no way for a user to restart the browser or reboot the kiosk on his own. Thus we wrote a driver programme which launches FireFox and monitors it's operation such that if it terminates, FireFox will be immediately restarted.

cscf_kiosk.exe is written in Visual Basic and is used as the shell programme (as opposed to Explorer.exe) for the cscf-kiosk user account. This customized shell is specified in the CS Kiosk User Account GPO. That is, this programme is run immediately upon logon of the cscf-kiosk account. cscf_kiosk.exe will then start the appropriate web browser (as specified in its config file) and wait until the browser terminates. Where upon, cscf_kiosk.exe will restart the browser.

If the kiosk has two screens, cscf_kiosk.exe will also start a browser for the alternate kiosk screen utilizing the upper browser profile as describe in the 'Special User Account' section of this page. cscf_kiosk.exe will know of the alternate screen through the detection of a firefox-upper.exe in the browser installation directory. firefox-upper.exe is just a copy of firefox.exe but it is recognized by the kiosk's video drivers to be launched only within the terminal's alternate (upper) display.

Kiosk Proxy service

• KioskProxyService - describes the software written by Elad to allow the kiosk to display a local page when the network is down