Porteus Kiosk Edition

Porteus Kiosk Edition is a specialized distribution of Linux that provides users with a locked down computing environment, designed to be deployed on public libraries, Internet Cafes or any other business establishment that provides Internet access to their clients.

Allows users to build their own Kiosk flavors of Porteus Linux

Porteus Linux is known for booting very fast, supporting various languages, allowing users to install, remove or update system packages and applications from a custom Software Center app, as well as for its unique, dependency-resolving package manager.

The Kiosk edition is different for the other Porteus flavors, mainly because it is not distributed as a predefined ISO image. Instead users need to built their own Kiosk flavor of Porteus Linux, using the unique Kiosk Wizard (see the dedicated download page for an external link).

Getting started with Porteus Kiosk Edition

First you will need to set the passwords for the root (system administrator) and guest accounts, which are usually used when connecting to the Kiosk system through SSH. In addition, you can also set a password for the Mozilla Firefox web browser’s configuration.

Next, you must select a connection type (Wi-Fi or wired), specify the network configuration type (DHCP or manual), as well as to choose if you want to filter certain IP addresses, block specific websites, enable the firewall, and set the hostname.

Being the only web browser used in Porteus Kiosk Edition, the wizard includes a special section for it, from where users can set a homepage, configure proxy settings, restart an idle instance, set file protocols, as well as to customize the navigation bar.

Furthermore, you can choose if you want to compress data in RAM using the zRAM compression algorithm, enable or disable the Copy to RAM function, enable or disable SWAP memory, set the timezone, keyboard layout, wallpaper, mouse cursor, screen resolution, brightness and refresh rate, shutdown function, screensaver, DPMS, and a few other power settings.

Lastly, users can add some extra features to their Kiosk edition, such as Adobe Flash Player, Java, extra fonts, PXE support, SSH support, and VNC support. The entire building process should take somewhere between 10-15 minutes.

The final result will be a standard or hybrid ISO image that supports both 64-bit and 32-bit hardware platforms and will have under under 50MB in size for a default configuration. Its size can increase depending on how many extra components you add.

What is new in this release:

• Porteus Kiosk changes including Cloud and ThinClient variants:
• Added support for refreshing browser webpage with defined time interval. This is useful for digital signage purposes.
• Its possible to explicitly set the shutdown options which should be present in the kiosk shutdown menu. You can allow the users to e.g. reboot the kiosk or restart the session but they wont be able to shutdown the PC fully.
• Screen rotation function has been split from more complex 'screen_settings' parameter. Handy if you want to just rotate the screen on different kiosk setups and want to avoid providing other screen attributes like vide output name, screen resolution, refresh rate or position.
• Enabled "DRI3" and "TearFree" features on Intel DDX driver by default which should result in a smooth video playback and scrolling on rotated screens.
• USB devices (e.g. smart cards) are redirected to Citrix session by default.
• Added vorbis and speex codecs so Citrix Receiver can use them for compressing audio and lowering network usage.
• ".ica" files are associated with Citrix Receiver in the Chrome browser. Standalone Citrix app opens now automatically after clicking on the ".ica" file.
• Kiosk wizard: do not ask for the client ID, SSH and VNC details when pointing kiosk to existing remote config hosted on Porteus Kiosk Server. These details does not matter at the installation stage as kiosk will be reconfigured anyway as per remote config settings. Installation of multiple clients is much faster now.
• Default to first proxy IP in case when multiple proxies are returned by the proxy PAC files.
• 'haveged' daemon is started by default to remedy low-entropy conditions.
• Latest 'freerdp' package allows connecting to recently upgraded Windows systems over RDP protocol.
• System upgrade/reconfiguration notification is be visible all the time so users are aware that there is an action happening in the background.
• Kernel config: enabled touchpad compatibility layer for older hardware, added support for DM-Crypt so its possible to encrypt partitions or files with cryptsetup, enabled retpoline support.
• Enabled flashplayer by default for Chrome browser when 'screensaver_url=' parameter is used.
• Replaced '--start-fullscreen' with '--kiosk' flag for Chrome screensaver to get rid of 'Press F11 to exit fullscreen' notification.
• Made 'Cancel' button the same size as other buttons in the shutdown menu so its easier to press this button on touch monitors.
• Kiosk wizard: repeat calibration twice for touch devices with swapped axes. This is needed to get accurate calibration data.
• Unblock 'Ctrl + left mouse click' during installation so its possible to select multiple devices for calibration.
• Kill old VNC connections before restarting vnc service.
• Always rotate touch input if at least one screen is rotated.
• Make stunnel daemon aware of 'proxy_exceptions=' parameter when connecting to PK Server.
• Fixed 'managed_bookmarks=' parameter being ignored in the PCID section of remote config.
• List SDIO devices in the debug report.
• Other fixes and improvements.
• Porteus Kiosk Server version "Premium" changes:
• Implemented 'Send notification' action in the Administration Panel so its possible to send a message to multiple clients. You can define if notification message should disappear automatically after 5 seconds, only after an user click or be displayed in a loop until the kiosk is restarted. Its also possible to play a sound when notification appears on the screen.
• 'Wake On LAN' function should also wake the kiosks which are in different subnets than Porteus Kiosk Server.
• Added 'History' function to the 'Custom command' action so its possible to rerun previously executed commands.
• Its possibile to insert additional info to the 'offline client' notification email.
• Added option to export client list (with last stored data also for offline clients) to a CSV file.
• Default firewall rules can be changed in the firewall editor.
• Keep selected settings persistent in the screen configuration utulity.
• Added 'Restore default resolution' button to the screen setup utility.
• Fixed a bug which prevented creating and editing kiosk configs containing the 'Save' string.
• Remove scripts from persistent storage related to server parameters as these parameters may be are no longer active in case when server was reconfigured.

What is new in version :

• Major software upgrades in this release include: Linux kernel 4.14.13, Mozilla Firefox 52.5.3 ESR and Google Chrome 63.0.3239.132. Packages from the userland are upgraded to portage snapshot tagged on 20180114.
• Refreshing the client list in the Administration Panel is up to 10 times faster. Porteus Kiosk Server should be able to handle 5000 clients and more depending on it's hardware specification.
• Porteus Kiosk Server gained support for real time monitoring of the client resources. Following data can be pulled from the clients: current usage of the CPU, RAM, swap, root (virtual filesystem), persistent partition, CPU temperature, downloaded/uploaded data and client uptime. Data are presented in the Administration Panel and updated every 2 seconds. Its possible to sort the client list by specific categories, e.g. highest CPU usage and select which clients and resources should be monitored.
• VNC daemon can display a popup window prior to establishing a VNC connection and ask the kiosk user if incoming conneciton should be allowed, reject or allowed in a view-only mode. This is required in countries where unnoticed VNC connection are prohibited by law.
• First run wizard has the ability to run virtual keyboard (xvkbd) which helps to configure the system for touchscreens or when no real keyboard is attached to the PC during the installation.
• When battery capacity reaches 10% then system plays a notification sound and displays a popup window which must be clicked to disappear.
• Intel and AMD microcodes are compiled directly into kernel so they loaded early in the booting process. This is a requirement for never CPUs.
• Full persistence works now when kiosk is installed on NVME devices.
• Switched i915 Mesa (3D) driver from gallium to classic version as gallium one causes Firefox tabs to crash on Intel Alviso (gen3) GPUs on certain websites.
• Other bugfixes and improvements.

What is new in version 4.5.0:

• Added support for EAP over LAN (802.1x) authentication on wired connections.
• VNC and SSH daemons can be limited to listening on localhost interface. This is useful from security point of view as nobody can access the kiosk on public network interface. Mind that you'll have to use another service: Porteus Kiosk Server, Guacamole, NoVNC, etc in order to tunnel VNC or SSH traffic to kiosk's localhost interface.
• Its possible to calibrate multiple touchscreen devices which are connected to kiosk.
• Cloud and ThinClient systems no longer expose shutdown options by default. Its required to explicitly enable shuttdown menu in kiosk configuration in order to allow restarting or powering off the PC by the users.
• WPA supplicant will run on all available wireless network interfaces and not only the first one. This is handy if primary wifi card does not work properly (hardware failure, unstable connection, mising driver/firmware) and you want to use wifi dongle as replacement.
• Tunneling service to Porteus Kiosk Server is started as a daemon rather than a script. When demonized the tunelling process can survive Xorg session restart and system runlevel change.
• Added support for email notifications to Porteus Kiosk Server. For now the only supported notification is when client goes offline for specific time period.
• Its possibe to sort client list by categories (system/kernel version, browser, last connected time, etc) in the view settings of the Administration Panel.
• Other bugfixes and improvements.

What is new in version 4.4.0:

• Linux kernel 4.9.30, Mozilla Firefox 52.1.2 ESR and Google Chrome 58.0.3029.110.
• Packages from the userland are upgraded to portage snapshot tagged on 20170526.
• Online or local webpage can be used as the screensaver.
• Swap partition has been replaced with more flexible swap file.
• Its possible to set custom printer name in the system.
• Added support for hosting SSL certificates directly on Porteus Kiosk Server.
• Enabled CloudPrinting by default for Porteus Kiosk Cloud/ThinClient variants utilizing Chrome browser.
• All plugins for Chrome are enabled by default including "Widevine Content Decryption Module" so its possible to watch e.g. Netfilx movies.
• Create virtual mode on headless kiosks so its possible to connect to them through the VNC service.
• Compiled 'nvme' driver directly into kernel so our systems can be booted from the NVME devices.
• Other bugfixes and improvements.

What is new in version 4.3.0:

• paramter 'client_id=automatic' will automatically asign the client ID to the kiosk - no need for manual configuration per device. This parameter makes client installation easier and faster especially for large deployments.
• activated 'serial' backend for CUPS printing service by default. Some usb printers require it for direct connection.
• if kiosk installation fails then debug info will be displayed in the browser in order to help identifying the problem, e.g. I/O errors on target device
• added warning when there may be not enough RAM available on the PC to perform system installation. Kiosks with 512MB of RAM may fail the installation if large components (e.g. Java) are enabled in the wizard.
• system reconfiguration/upgrade will be skipped if ISO is burned on non writable media
• system reconfiguration/upgrade will eb skipped if ISO was manually burned on a partition (e.g. /dev/sda1) while it should be burned on a device (e.g. /dev/sda)
• added OpenDNS as secondary DNS server in the installation wizard for static IP configurations. It will be used as a fallback to Google DNS.
• if bookmark name is not defined in the 'managed_bookmarks=' parameter and the page title is not available then default to the raw URL for the bookmark name
• set hostname before starting rsyslog so proper kiosk hostname is saved in the logs
• dropped obsolete Chrome policies: DisableSpdy, DnsPrefetchingEnabled from default Chrome configuration
• rotate /var/log/x11vnc.log every day so it wont grow in size too much
• other fixes and improvements

What is new in version 4.2.0:

• Upgraded all system components to latest version from Gentoo stable branch including Linux kernel 4.4.36, Xorg Server 1.18.4, Mozilla Firefox 45.5.1 and Google Chrome 54.0.2840.100. Full list of packages used for creating this release can be found under this link.
• Client files: wallpaper, screensaver slideshow images, browser preferences, proxy pac config can be hosted directly on Porteus Kiosk Server - no need to use 3rd party web hosting service anymore. Clients must be configured with relevant parameters and utilize 'server://file_name' parameter value syntax.
• Its possible to toggle between browser tabs at specific time interval. This feature is available only when navigation bar of the browser is disabled (kiosk works in digital signage mode).
• Screensaver slideshow can display images in random order instead of alphabetic order.
• 'C++' and 'C--' keyboard shortcuts are deactivated when 'disable_zoom_controls=yes' parameter is used.
• Fixed 'vga_driver=modesetting' parameter which works properly now.
• Recompiled xf86-video-intel driver without DRI3 support as it causes issues on older Intel Alviso (gen3) GPUs.
• Make sure the SSH tunnel connection is established fully before trying to download remote config from Porteus Kiosk Server.
• Other fixes and improvements.
• Porteus Kiosk Server changes:
• allow rotating Server logs more often than once in a day
• use Conky to monitor Server resources: CPU, RAM, storage and network utilization
• removed 'grep' alias from /etc/bash/bashrc as grep applet from bysybox does not support '--colour=auto' option
• make possible editing of the remote config through the Administration Panel
• added parcellite utility which works as clipboard manager

What is new in version 4.1.0:

• Upgraded all system components to latest version from Gentoo stable branch including Linux kernel 4.4.19, Mozilla Firefox 45.3.0 and Google Chrome 52.0.2743.116. Full list of packages used for creating this release can be find under this link.
• In this release we have introduced two new spins of our Porteus Kiosk system: variant Cloud and variant ThinClient
• Kiosk config can be hosted directly on Porteus Kiosk Server - no need to use 3rd party web hosting service anymore. Clients must be configured with 'kiosk_config=' parameter and utilize 'server://config_name' protocol.
• Its possible to define custom persistence level for the guest's home folder.
• When enabled, password manager allows remembering logins and passwords to the websites.
• Default search engine for the browser has been changed to the Google although its still possible to set DuckDuckGo if privacy is the top priority.
• Linux kernel used in our system can be tweaked with the help of additional kernel parameters.
• Its possible to control the slide duration (time between loading new image) for the screensaver slideshow.
• Managed bookmarks allows to define the bookmark name.
• DMPS is no longer forced to turn off the monitor after 10 minutes of inactivity and you may define the time after which the monitor goes off.
• Session idle parameter will restart whole session (Xorg) for the variants Cloud and ThinClient.
• Wizard: Added option to preserve persistent partition, perform a quick format or completely erease the hard drive before the installation.
• Enabled bootsplash by default for the post installation ISO.
• Clients behind the proxy can connect to Porteus Kiosk Server properly.
• Rsyslog replaced metalog as default logging daemon - its more configurable and supports logging to remote destinations.
• If association with Porteus Kiosk Server is enabled then bind remote rsyslog port locally (over SSL tunnel). System logs in severity warning and above will be logged on the Server side - this is useful for proactive support.
• Screensaver slideshow will sort the pictures according to their filename
• Session idle: notify the user in case when activity was detected and session wont be restarted.
• If hostname is not specified and if Kiosk Server association is enabled then use client_id as hostname.
• Automatically eject optical disc after successful installation.
• Add '--disable-pinch' to Chrome flags if 'disable_zoom=yes' parameter is used.
• Kiosk config can be hosted on FTP servers.
• List touch devices in debug report.
• If SSH service is enabled then allow login to Porteus Kiosk Server as kiosk user only from localhost interface (force using SSL tunnel).
• When multiple homepages are defined and 'homepage_check=' parameter is enabled then query only first homepage to prevent "homepage is not available" message.
• Fixed 'scheduled_actions=' parameter not working correctly when hour or minute was staring with '0' number (e.g. 09:04).
• Make sure that authorized_keys file was copied correctly from Porteus Kiosk Server.
• Fixed character conversion issue for Citrix Receiver.
• Stunnel: reduced logging level from "warning" to "critical" to get rid of warning entries flooding the log when remote server is down.
• Block 'Ctrl+p' key combination if printing component is not enabled.
• Update DNS settings properly when dialup connection is used.
• Session idle: prevent very first browser restart if no user activity is detected.
• Blocked Shift+Enter key combination by default as it was opening a new Firefox window when user clicked on download link and then pressed Shift+Enter.
• Do not mount removable device and start the browser if session is locked by the "session password" window.
• Recompiled hplip package with scanner and fax support.
• Make sure that ssh tunnel was established properly before forwarding client's data to the Server. This is to avoid 'password not found' error which could appear when establishing VNC connection from Administration Panel to the client.
• Escape '?' character for Firefox's whitelist/blacklist functions so URLs containing this characters are handled correctly.
• Do not start splash screen if 'debug' kernel parameter is used.
• Disabled geolocation and OCSP services for Firefox as they make troubles for kiosks which uses proxies with authentication (long wait for a timeout when connecting to Mozilla services).
• Keep cron logs in a separate file so they wont be flooding main system log.
• Added following new packages: c_rehash, hicolor-icon-theme, json-c, libestr, liblogging, net-snmp, rsyslog, sane-backends, startup-notification.
• Enabled new busybox applets: eject, mktemp.
• Other fixes and improvements.
• Porteus Kiosk Server changes:
• added 'Remote Management' tab to the Administration Panel for handling kiosk configs through the Server
• added second tab for logging system events (warnings and above) from the kiosk clients.
• added 'Reconnect' button which temporarily drops all client connections to the server. This is useful in case of having connection problems or to update clients data.
• display browser version in the browser column of the Administration Panel
• display client's kernel version in the Administration Panel
• enabled startup notifications for the launchers
• custom commands are preceded with 'nohup' so they continue executing even when ssh is disconnected
• added back 'restart session' option (client must run latest kiosk version from automatic updates channel in order to support this feature properly)
• added confirmation window to 'reboot/shutdown client' options
• Administration Panel can be resized and maximized. Useful when you want to monitor many clients without scrolling the window.
• added 'Help' button to the 'Client Logs' and 'Remote Management' tabs in the Administration Panel which points to the webpage which explains how these features work
• removable devices are mounted with read-write access