[KLUG Members] Drive Shield/Deep Freeze for Linux

[Mike Williams]

>
> From:
> Adam Tauno Williams <adam at morrison-ind.com>
>
>
> DEEP FREEZE
>  
>
>>> Deep Freeze instantly protects and preserves original computer 
>>> configurations. Completely invulnerable to hacking, Deep Freeze 
>>> makes computing environments easier to manage and maintain. 
>>> Each restart eradicates all changes and resets the computer to 
>>> its original state, right down to the last byte.
>>> Protect a single, hundreds, or thousands of computers across a 
>>> distributed LAN, WAN or over the Internet.
>>    
>>
>
>I think translucent filesystems will work for you.  Mount the parition read-only
>and then mount a RAM disk over it?
>  
>
Translucent filesystems?  I think I understand conceptually how that 
would work, but I've never heard of such a thing.  Can you explain how 
one would implement that?  What the heck would the /etc/fstab entries 
look like?

>Or just use VMware which does snapshotting exactly like what you describe.
>
>  
>
As long as you've got enough horsepower to run vmware and the Windows 
underneath it.  And are willing to shell out the licenses.  Not trying 
to shoot down your solution, just pointing out that it's unlikely to be 
an ideal one in a lot of environments.

>>> Jeremy NOTE:
>>> The question assumes that M$ Window's problems are Linux problems.
>>> Maybe better stated that the question assumes that M$ Window's 
>>> vulnerabilities are Linux vulnerabilities.  File permissions in Linux take
>>> care of most of this.
>>    
>>
>
>
>Windows provides very robust file permissions (assuming you are using NTFS).  It
>is *NOT* Bill's fault that most ding-bat users add themselves to the
>Administrators group and then go merrily on their way.
>
>  
>
Two problems with that (at least before we have to take this over to 
advocacy):  1) In most cases you CAN install stuff on a Windows box 
without being an administrator, 2) A few applications (admittedly, most 
of them are games) won't run without administrator rights, so the users 
do have to be administrators, and it doesn't fix anything if they're not..

----  in a fit of self-censorship, I'm redirecting the rest of this to 
advocacy, as it's getting long and ranty.