Thanks for replies. I would to clarify a few points:
The users will only be uploading files, so read-only access to NTFS is perfectly fine, perhaps even preferred. My only issue is automating the process of mounting and unmounting.
You definitely want to make sure the device gets unmounted if it's pulled. If you don't, the system will keep on
creating more and more mount points as people plug and unplug their thumb drives.
Exactly why it would be nice. What I meant by "safe unmounting" was that I'm OK with the idea of a user ripping out a drive before it is safely unmounted, so long as the mount point is removed afterwords automatically. This acceptable primarily because I will have them mount read-only anyway. In any case, I do plan on restarting these kiosks daily via a cronjob, so they will load fresh off of the boot image early every morning to clean up any user-generated messes.
You must make sure it is unmounted BEFORE you pull it.
I really have no way of forcing a user of this kiosk to click on a button to unmount before he or she yanks it out of the hub. Even if I did provide such a button for the handful of conscientious Linux users, I would still need it to automatically clean up after a device is removed without unmounting. Besides, as I mentioned above, I plan on mounting read-only, so data loss shouldn't be a problem.
Make sure you add etc/udev/rules.d/98-tc.rules to your backup.
I have already done that, and ensured that it and the linked scripts had proper permissions, but it seemed to have no effect. Also, I am actually extracting the core.gz image and editing the filesystem directly, then packing it back up, so I'm not really using the backup feature.
For now, I will follow up on the links you posted, and read up on udev rules. I'll report back with my success or failure. Thanks again!