Re: Lockdown stuff

[Ian Peters <itp ximian com>]

On Wed, 2003-10-08 at 10:49, Matt Keenan wrote:
> Alexander Larsson wrote:
> 
> 
> > To be able to agree on any key at all I need to know what types of
> > lockdown we're aiming for so i can judge wether the keys introduced:
> > a) helps implementing such a lockdown
> > b) are on the right level
> 
> I don't think you can simply refine this down to just two levels or even
> 3/4/5 levels for that matter... Different sysadmins all require something
> different in their setup, so by simply providing them with a very specific
> set of lockdown profiles is something that I reckon could be a nightmare
> to try and conceive...:)

We won't know until we try.  I wouldn't be surprised to find that needs
are generally more consistent than not.

Regardless, by collecting enough information, we can try to identify the
highest level of granularity that is realistically needed, rather than
starting out with the assumption that every feature needs to be
individually toggled.

> Sounds like we need to take a step back change the task approach I was
> taking which may have been too specific as in per application, and rather
> take the view over the entire desktop.
> 
> Answer tasks such as :
> 
>     - I want to restrict terminal access
>     - I want to stop a user from manipulating desktop icons etc...
>     - I want to stop a user from adding/removing/changing location of their panel
>     - etc...
> 
> Anyone want to add to this list...

We could make this list all day long, but I'm not convinced it will help
us as much as collecting existing use cases, requirements, wish lists
from potential users, etc.

One thing I can try to do is pick some brains at Novell -- I'm sure this
is a problem they've addressed multiple times in various ways, and I'm
sure I can find some people willing to talk far longer than I could
listen about what they've learned.

Doing some research into what other platforms offer would definitely be
worthwhile, too.  Unless there are any Windows experts lurking about, I
can definitely do some research there at some point soon.

Ian