Protecting hard disks on terminalserver clients

["Andrew" <knoppix@rngresearch.com>]

Dear Klaus et al,

I have some windows boxes and would like to use Knoppix terminalserver to
provide a linux alternative.  The users should have full access to any usb
devices they plug in, but I do not want them to be able to (accidentally
or intentionally) clobber the windows drives; they should only be
mountable ro, or perhaps not mountable at all.  The problem is that some
of the machines have more than one hard disk, so I must prevent /dev/sdb1
from being writable, but this prevents use of usb flash drives on the
machines with only one hard disk!

Any suggestions?

-Andrew