IP-TEC - Infopeople Technical Service Archive: Re: Fortres for Win 95

Re: Fortres for Win 95

Norman de Groot (ndegroot@mcn.org)
Thu, 11 Jul 1996 08:33:34 -0700

At 06:55 AM 7/9/96 -0700, Bill Mosley wrote:
>Fortres has been discussed a number of lists lately, so this is posted to a
>number of lists. Sorry for the duplications in your mailbox.
>
>I came across some problems in testing Fortres 101 for Windows 95, and I
>thought this list would be a great place to get some feedback. I didn't
>have a lot of time to check the program out, so excuse me if I missed
>something obvious.

-----------------------

At the Fort Bragg library I have taken a different approach to protecting
Windows 95 and associated software on the computer. Using the System Policy
Editor, the machine is username and password protected to three levels of
access:

Library public. For this class of user, the desktop is absolutely clean; it
has nothing on it except the Start button. Pressing that button allows a
patron to click on three functions: access to our service provider; run
netscape; and access to our county free net. Nothing else. The Program
button exists on the start menu, but the program list is empty. Same for
the Documents list, empty. The Help command is still there, but one can
only read - the buttons within a help screen that lead to locations such as
the control panel are not allowed. The Find and Run commands do not appear.
It is only possible to shut down entirely, or to exit to the login screen.
Pressing Cancel or Esc to avoid the requirement for a pass word in the login
screen results in a start menu that doesn't even have the program options
that the library patron has.

Library staff. This class of user has the public user options and
restrictions, but allows the Eudora mail program. Again, a totally clean
desktop except for start button.

Administrator. This guy (me) gets to do anything: I have access to all
Windows functions and all the software that is loaded into the machine.

The principal flaw in his scheme is that Netscape does allow one to monkey
with files. In most cases this doesn't matter and the critical files can be
hidden so Netscape won't see them.

One wonders how far it is really necessary to indulge our paranoia. As of
now, if the machine begins to act up and operate in an abnormal way I do
what I did with the 3.11 setup: reformat the hard disk, install the DOS
version of our tape backup, and do a full hard disk restore.

The thing I haven't figured out how to accomplish is to restrict public
users so that they can only save to a floppy and not the hard drive. We
tell them if they save to the hard drive the file is gone, we won't try to
find it for them. That seems to work OK, but it would be nice to have
things restricted so that even an innocent mistake is not possible. I don't
know if it possible to change the windows save window so that the C: drive
is not available - so far it appears that such a change is not feasible, but
I could be wrong.

On one of the machines there is a color printer. Considering the cost of a
full page color print we want to have good control of that function and I
think password control of printer access is possible with Win 95.

All of the foregoing is in the context of no third party special software,
just Win 95 itself.

As always, a suitably knowledgeable person with malicious intent and a
little time could probably screw up the machine. Since we control access on
a patron by patron basis such a circumstance would be quickly evident and we
would just take the machine out of service until a full hard disk
restoration from tape was done.

Norman de Groot
Fort Bragg Library Community Volunteer

Norman de Groot
Mendocino, CA USA
ndegroot@mcn.org
TEL (707) 964 6516
FAX (707) 961 1126