Lockdown Ubuntu no installs

[GraySenshi]

I'm doing a workstation build for some basic office web browsing and file server. I wanted to lock it down where no new software, add-ons ect can be installed. I want to make sure it will stay virus free even if a user goes to unsecur site or tries to install software that could have potential threats.

 

[skittle]

SELinux is what you are looking for. Tons of various guides on the interweb if you choose. Otherwise the traditional way is through user/group/read-write-exec permissions. Believe it or not but you can accomplish quite a bit by simply not giving users sudo/root group privileges.

https://wiki.centos.org/HowTos/SELinux
https://wiki.archlinux.org/index.php/SELinux

Fedora and CentOS for example have SELinux installed an enabled by default, just need to modify the settings to your liking.

 

[Faux_Grey]

Guest users?
Pretty much can't do anything other than browse the web.