Firefox Lockdown Information
This page shows how to easily lock-down Mozilla Firefox's Settings before you deploy the app with my Deployment Utility. These instructions are based on Chris LLias's Blog entry about Locking Down Firefox.
- Edit the file "Mozilla Firefox\greprefs\all.js" and add the following to the end of it:
- Create a new file called "mozilla.txt" and add any lockdown settings you want, an example is:
- Now, you must "encode" the "mozilla.txt" file into a "mozilla.cfg" file. To do this use the application located here, or even easier is the online converter located at:
http://www.alain.knaff.lu/%7Eaknaff/howto/MozillaCustomization/cgi/byteshf.cgi. - Finally, put the new "mozilla.cfg" file into the "Mozilla Firefox" directory. Now you are ready to deploy Firefox with the appropriate settings "Locked-Down".
pref("general.config.filename", "mozilla.cfg");
//
lockPref("app.update.enabled", false);
lockPref("network.proxy.type", 0);
lockPref("browser.startup.page", 1);
lockPref("browser.startup.homepage", "http://www.google.com/");
You can find more options to lockdown below, or you can browse the "about:config" page to find more settings to lockdown.
Note: If you do not wish to "byte-shift" the mozilla.cfg file, simply add the following to the greprefs\all.js file:
pref("general.config.obscure_value", 0);
Also, you may be able to store your mozilla.cfg file on a server with the following - although I haven't full tested it yet:
lockPref("autoadmin.global_config_url", "http://yourserver.companyname.com/mozilla.cfg");
Update for Mozilla Firefox 4
I received these instructions from Landon Veitch (Thank You!!), which since I haven't had time to test these, I will post the email in it's entirety.
Mike,
I know that Firefox 4 was just released but I wanted to write you to inform you that I figured out how to apply your locks to the new changes in Firefox 4. This way you can keep your customers up to date. I did this on a Vista and 7 machine so I know this works for these installs.
ENSURE YOU HAVE WINZIP
- Install Firefox 4 (using standard defaults)
- Navigate to C:\Program Files\Mozilla Firefox
- Right click the OMNI.JAR file and open with Winzip
- Extract all files to a folder somewhere on the PC
- Go to that extraction folder and you will see the files in their applicable folder structure.
- Navigate to the defaults\profile\firefox.js
- Add the following line to the end of that file:
- Save the file
- Re-Zip all the files back into a file called OMNI.JAR
- Replace the original OMNI.JAR file with the new one
- Drop your mozilla.cfg file in the root of Program Files\Mozilla Firefox
- Launch Firefox and see your lockdowns work
\\MOZILLA FIREFOX LOCKDOWN
pref("general.config.filename", "mozilla.cfg");
Again, I haven't fully test this yet and I am not sure if you have to use Winzip or if you could also use 7-zip.
Thanks again Landon for the input!
Here is a Youtube Video Showing Firefox 4 Lockdown
Firefox Lockdown Settings
There are many ways to find various settings you can lock down within firefox. The most thorough way is to simply browse through the "about:config" page within Firefox. A few settings not readily apparent is the ability to disable extensions and themes, you can do this by setting the following:
lockPref("config.lockdown.disable_extensions", true);
lockPref("config.lockdown.disable_themes", true);
Also, if you want to disable the ability to access the "about:config" page you must copy this file into the "Mozilla Firefox\components\" directory.
To lock down basic settings, here is a list of the settings available through the "Options" Dialog (Current with Firefox 2.0.0.6). Remember, there are quite a few more available through the "about:config" Firefox page, but these should get you started.
Main Tab
- Startup - "When Firefox Starts:"
lockPref("browser.startup.page", 0);
Where:
0 = "Show a blank page" 1 = "Show my home page" 3 = "Show my windows and tabs from last time"
lockPref("browser.startup.homepage", "http://www.google.com/");
lockPref("browser.download.manager.showWhenStarting", false);
lockPref("browser.download.manager.closeWhenDone", true);
lockPref("browser.download.useDownloadDir", true);
lockPref("browser.download.dir", "C:\\Downloads");
lockPref("browser.download.downloadDir", "C:\\Downloads");
lockPref("browser.download.folderList", 2);
lockPref("browser.download.useDownloadDir", false);
lockPref("browser.shell.checkDefaultBrowser", false);
Tabs Tab
- New pages should be opened in: a new window
lockPref("browser.link.open_external", 2);
lockPref("browser.link.open_newwindow", 2);
lockPref("browser.link.open_external", 1);
lockPref("browser.link.open_newwindow", 1);
lockPref("browser.tabs.warnOnClose", false);
lockPref("browser.tabs.warnOnOpen", false);
lockPref("browser.tabs.autoHide", false);
lockPref("browser.tabs.loadInBackground", false);
Content Tab
- Block pop-up windows
lockPref("dom.disable_open_during_load", false);
Note that exceptions are added to the hostperm.1 file in the user's Firefox profile.
lockPref("permissions.default.image", 2);
Where (1) is checked and (2) is unchecked.
Note that exceptions are added to the hostperm.1 file in the user's Firefox profile.
lockPref("javascript.enabled", false);
- To disable the Advanced button
Advanced JavaScript Settings
lockPref("pref.advanced.javascript.disable_button.advanced", true);
lockPref("dom.disable_window_move_resize", true);
lockPref("dom.disable_window_flip", false);
lockPref("dom.event.contextmenu.enabled", false);
lockPref("dom.disable_window_open_feature.status", false);
lockPref("dom.disable_window_status_change", false);
lockPref("security.enable_java", false);
You could lock down these settings, but not recommended as each user utilizes their own preferences
The app that opens each type of file is written to the "mimeTypes.rdf" file in the user's profile. However, you can disable the apps "browser plugin" by adding something similar to the following, forcing the user to "save the file" to disk:
lockPref("plugin.disable_full_page_plugin_for_types", "audio/x-ms-wma,application/pdf");
Privacy Tab
- History - Remember visted pages for the last _ days
lockPref("browser.history_expire_days", 4);
lockPref("browser.history_expire_days.mirror", 4);
Set "browser.history_expire_days" to "0" to disable History completely
lockPref("browser.formfill.enable", false);
lockPref("browser.download.manager.retention", 0);
Set to "2" to enable
lockPref("network.cookie.cookieBehavior", 2);
Where "0" is enabled, "2" is disable cookies
lockPref("network.cookie.lifetimePolicy", 2);
Where "0" is "they expire" - "1" is "ask me every time" - "2" is "I close Firefox"
lockPref("pref.privacy.disable_button.cookie_exceptions", false);
Note that Cookie exceptions are added to the hostperm.1 file in the user's Firefox profile.
lockPref("privacy.sanitize.sanitizeOnShutdown", true);
- Browsing History
Clear Private Data Settings
lockPref("privacy.item.history", true);
lockPref("privacy.item.downloads", true);
lockPref("privacy.item.formdata", true);
lockPref("privacy.item.cache", true);
lockPref("privacy.item.cookies", false);
lockPref("privacy.item.passwords", false);
lockPref("privacy.item.sessions", true);
lockPref("privacy.sanitize.promptOnSanitize", false);
Security Tab
- Warn me when sites try to install add-ons
lockPref("xpinstall.whitelist.required", true);
Note that "Add-ons" exceptions are added to the hostperm.1 file in the user's Firefox profile.
lockPref("browser.safebrowsing.enabled", true);
Note: To utilize "Google" to check for web forgeries the user must Accept an EULA.
lockPref("signon.rememberSignons", true);
The user must enter a master password when enabling, thus you cannot enforce this setting
lockPref("pref.privacy.disable_button.view_passwords", true);
- I am about to view an encrypted page
lockPref("security.warn_entering_secure", false);
lockPref("security.warn_entering_weak", false);
lockPref("security.warn_leaving_secure", false);
lockPref("security.warn_submit_insecure", false);
lockPref("security.warn_viewing_mixed", false);
Advanced Tab
- General - Accessibility - Always use the cursor keys to navigate within pages
lockPref("accessibility.browsewithcaret", true);
lockPref("accessibility.typeaheadfind", true);
lockPref("general.autoScroll", false);
lockPref("general.smoothScroll", true);
lockPref("layout.spellcheckDefault", 1);
Where "0" is no spell checking and "1" is spell checking enabled
lockPref("network.proxy.type", 0);
- "0" is "Direct connection to the Internet"
- "1" is "Manual proxy configuration"
Where
You must also set the following:
lockPref("network.proxy.http", "firewall.private.lan");
lockPref("network.proxy.http_port", 3128);
lockPref("network.proxy.ssl", "firewall.private.lan");
lockPref("network.proxy.ssl_port", 3128);
lockPref("network.proxy.ftp", "firewall.private.lan");
lockPref("network.proxy.ftp_port", 3128);
lockPref("network.proxy.gopher", "firewall.private.lan");
lockPref("network.proxy.gopher_port", 3128);
lockPref("network.proxy.socks", "firewall.private.lan");
lockPref("network.proxy.socks_port", 3128);
You can also list addresses that you do not want to use the proxy for:
lockPref("network.proxy.no_proxies_on", "localhost, 127.0.0.1, www.mozilla.com");
You can also set the following setting for the correct autoconfig URL
lockPref("network.proxy.autoconfig_url", "http://mysite.com/");
lockPref("browser.cache.disk.capacity", 5000);
Where 5000 is 5MB, etc.
lockPref("app.update.enabled", false);
lockPref("extensions.update.enabled", true);
lockPref("browser.search.update", true);
lockPref("app.update.auto", false);
Will set the checkbox to "Ask me what I want to do, While
lockPref("app.update.mode", 0);
Set to "0" will set to Automatically download and install the update and not check the "Warn me if this will disable any of my add-ons", Set to "1" will check both the Automatically download/install as well as the warn about disabling add-ons.
lockPref("security.enable_ssl3", true);
lockPref("security.enable_tls", true);
lockPref("security.default_personal_cert", "Ask Every Time");
