[K12OSN] banning windows clients from DHCP?

[ssanders at coin.org]

putting the offenders (by name) into hosts.deny worked fine, such a
simple solution (i should have known that one).  assuming they don't
change their hostnames, it should be great. they aren't techies, they
won't figure out why.

there remains ONE client that i don't think hosts.deny would work on. it
is reasonably modern hardware, with an oddball vidcard (knoppix 3.4
wouldn't even work on it, tried several cheatcodes). i did a few quick
searches (forget now what the card was) and saw nothing but linux grief
for it. i had sort of forgotten about this one.  i wound up setting him
up w/VNC into the server, he then logs in with his username like that,
it works well. he's still running Windows in the background, and he has
discovered that he can 'use his windows stuff' after getting an IP from
DHCP. 

how can i allow this user to VNC, but nothing else (except FTP, he needs
that to move docs to his /home dir)?

TIA
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/k12osn/attachments/20040602/4c3f562c/attachment.sig>