I joined the "guess sessions" Ubuntu Forum (https://ubuntuforums.org) with the hopes of FIXING the security flaws issues in guest sessions but it seemed to have lost steam (other than me) and was closed.
[Quoting myself from that forum, (hope this is permissible):]
Qassis: Ubuntu 18:04 LTS (Bionic Beaver) guest sessions (guest account) is NOT secure.
1. "guests" have access to user files and data.
2. "guests" have access to system files and data.
For many more security issues, details, and where Ubuntu is see:
The only secure workaround I see is to continue using Ubuntu 16.04 LTS guest sessions as it is secure and still has 3 years support. This is what I continue to do at the time of this post for senior center computers I secure and donate.
Why use a guest account? Many reasons including:
1. Businesses (or churches, etc.) who allow visiting professionals or customers access to the I-net for what-ever reason.
2. Special needs, i.e. outside my home, for example, I donated a computer to our Senior Center. The seniors use guest session (guest account). They can more safely do their online banking and other business as there is nothing left behind (account numbers, Social security number, passwords, logins, other personal data) when they log out.
3. In my home, it doesn't matter who comes to visit (grandkids, friends) they can surf to their hearts content.
My current workaround for removing guess access to user files:
I tackled "guest" access to user files and have a work around for now for my HOME computers (still using 16.04 at the Senior Center). I'm using 18.04 at home.
In the home directory I ran:
sudo chmod -R o-rwx *
This removed access (rwx (Read, Write, eXecute) access) by “guest” to my user’s files/folders.
Result: "guests" can no longer view, run, unzip, or otherwise access other user’s file and data.
This work around does NOT secure guest accounts to any acceptable standard (i.e. they still have access to system files) but is 'good enough' for when my grandkids visit me at home.
BTW, I did not try this recursively from / directory as I trust Ubuntu has reasons for permissions as fielded and didn't want to break anything.
I'm hoping for other work arounds to better secure 18.04 guest accounts.
Thank you. [END QUOTE]
I've seen no forward movement in months. Does anyone here have an update on fixing Guest Sessions?