Kids Installing Firefox

I dont know if this has been covered before, but we are currently having some problems with the kids being able to install firefox, this is allowing them to them bypass our proxy and surf anywhere on the internet.

i have had some other trouble with them installing firefox on there usb sticks and installing this program

http://portableapps.com/

And using firefox from there.

Is anyone having problem with this aswell or does anyone know of a solution. I have blocked the exe's to run firefox and the portable app program but some kids are still getting on somehow.

block port 80 traffic on your border firewall, or redirect it to a transparent proxy (if you want to maintain access for software updates, etc).

they could be getting past while logging on and by-passing the group policies and then running firefox.

I was speaking to someone and they were saying that the firefox installer does not need admin priverlages to install, which is why the kids can install it.

I dont know fully how it all works but its always seemed that any outgoing traffic points to the gateway first and we have to force the internet settings towards our proxy.

Our internet doesn't work if you don't enter the ISA server in the proxy settings.

Can you add the installer file to the restricted applications & block firefox website?

That would work but you'd need to redo a new policy everytime the installer was updated, which with Firefox seems to be every day!

i have done that and blocked the application exe, the installer exe but they download it from home and bring it in.

I have just noticed taht there was a new version of firefox, mabye they have just downloaded the new version but still this is going to be a problem.

if a proxy is not set in the internet settings then internet access comes though with out authentication

In that case blocking port 80 on your firewall (the gateway) for everything but the proxy, as Geoff suggested should do the trick.
What proxy server do you have?

Block Access tot he c:drive?

Also, using GP to prevent unknown files from being executed from anything other than C: should help, as they can't run anything from their usb sticks then.

Just take the Default Gateway out of the info DHCP sends out.

Take away USB drive access. Tell them they have to use the school email. exe files will be blocked if they email them selfs. If they change the file extension to a .jpq etc the the anti virus will pick up on it.

why not just let them have firefox and fix the gaping security hole with the proxy

Quote:

---

Originally Posted by CyberNerd

why not just let them have firefox and fix the gaping security hole with the proxy

---

how? :oops: