Jamie Zawinski used diskless terminals and NIS/NFS in his nightclub for a setup so bombproof, you could even UNPLUG 'EM without halting the system and they don't have to fsck, since they get all their important files over the network.
- Remember to keep the BIOS passwd-protected, and not have any removable media (A:, CDROM) in the boot-path.
- Make as much as possible mountable read-only. This should be doable with /usr with little or no modification. It could almost be done with root, except things need to mount on it. The best way to do this is with NIS / NFS, so that a cluster of diskless computers shares network access to a remote filesystem.
- For a standalone machine, there's a way to do this by making all the partitions except for /var read-only, then disabling a lot of things that need to write to the disk and symlinking everything essential to the /var partition.
- Create a restricted ~cafe account. Configure your *DM (XDM, KDM, GDM, whatever) for autologin to ~cafe. For the public login, make as much read-only as possible. One way to do this is chmod -R a-w ~cafe, and then see what breaks.
- Enable quotas. This will prevent .netscape/cache from eating anything but the ~cafe dir.
- Pick up a journaling FS when convenient.