Forgive me if I haven't done quite as much digging trying to solve this on my own as I could have: I'm currently in Zambia, and my internet access is unpredictible and slow when it's working.
I'm working with a small school, trying to set up some hardware and a basic IT policy that will let their non-power-user staff keep their machines working efficiently for as long as possible. I am not a sys-admin. I use osX in most of my own computing, but I'm comfortable with the shell and kind of know what I'm doing.
The computers are laptops, which will be available for checkout by both students and faculty.
Basically, I want to have two user accounts, 'student' and 'teacher'. I want both of these accounts to have the following restrictions:
- no write access outside of ~/
- no modification of system preferences
- no modification of menus or appearance of the desktop
- no adding or removing packages
- no way of running downloaded / new executables?
- anything else you smart people can think of that would make this a more painless experience?
I want users to be able to save files, but I want a fairly painless way for saved data to be regularly wiped. I'm not sure if it would be easier to have somebody use a clonezilla thumbdrive to restore the computers, or if it would be easier to just have someone log in to the admin account and delete / recreate the user accounts? Could I achieve this last task with a shell script and cron?
thanks for your time, and I apologize if I'm overdoing the shotgun approach.