Setting Java Control Panel Security by GPO

[richrogan]

Afternoon,

 

We're running Java v7 update 45 across our school and we're wanting the default Security level set in the Java Control Panel to be 'Medium'.

 

Is there anyway to force this out via GPO? I've had a look but can't seem to find the relevant path.

 

Any help would be much appreciated

[free780]

Set the setting on a pc copy the deployment.properties from the users profile appdata locallow sun java deployment. Push that file out via gpp to c:\windows\sun\java I think.

[fiza]

Can anyone shed any light on this? How do you set the security level to Medium for all users using GPO?

[Arthur]

How do you set the security level to Medium for all users using GPO?

Add the highlighted line to your deployment.properties file to set the security at the system level. I use Group Policy Preferences (Computer Configuration » Preferences » Windows Settings » Files) to copy the file to C:\Windows\Sun\Java\Deployment.

 

deployment.expiration.check.enabled=false
deployment.expiration.decision.suppression=true
deployment.expiration.decision=NEVER
deployment.insecure.jres=ALWAYS
deployment.security.level.locked
[color="#FF0000"]deployment.security.level=MEDIUM[/color]
deployment.security.mixcode.locked
deployment.security.mixcode=HIDE_RUN
deployment.webjava.enabled.locked
deployment.webjava.enabled=true

 

You will also need to copy a file called deployment.config to the same folder. This contains the two lines below.

 

deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
deployment.system.config.mandatory=false

Edited January 20, 2014 by Arthur

[fiza]

Add the highlighted line to your deployment.properties file to set the security at the system level.

 

deployment.expiration.check.enabled=false
deployment.expiration.decision.suppression=true
deployment.expiration.decision=NEVER
deployment.insecure.jres=ALWAYS
deployment.security.level.locked
[color="#FF0000"]deployment.security.level=MEDIUM[/color]
deployment.security.mixcode.locked
deployment.security.mixcode=HIDE_RUN
deployment.webjava.enabled.locked
deployment.webjava.enabled=true

@Arthur - I read that somewhere but can I find my deployment.config file anywhere? Nope!!! Looked in windows\sun\java\Deployment - its empty!

Looked in App Data - no mention of Sun or Java.

 

does this only work if you deploy Java via Group Policy in the first place?

[fiza]

@Arthur - Scratch that last post. I found it.

How would I add the line for every user?

[Arthur]

How would I add the line for every user?

If you copy deployment.config and deployment.properties to C:\Windows\Sun\Java\Deployment on every PC with Java installed, the settings contained within deployment.properties will be applied to all users that log onto the computer.

[agarabaghi]

So we are venturing down the same path with the new Java security. We are having an issue with sites being blocked and needed to manually whitelist them. Has anyone managed to make the DeploymentRuleSet.jar file yet?

 

Ive created the .jar file and used the guides to combine the .xml file with the site exceptions. Im running into issues though once I've signed the .jar with our wildcard .p12 and apply it to the sun\java\deployment folder.

 

When i open up the java configure panel, and go to security the blue hyperlink shows up, and it shows the contents of my .xml. But when I go the site defined as "run" in the XML it says cannot verify self signed Deployment Rule Set jar...

 

Is this an issue with the signing cert or my method?

[ADMaster]

My guess would be your computer doesn’t trust the signing cert. However I didn’t create a deployment rule set, I avoided all that by creating exception.sites list.

Add the path to your exception list in the deployment properties, copy it out with the same method. In my case I use SCCM, but GPP or startup script works too.

 

See my post in the other java thread for examples of my config file.

http://www.edugeek.net/forums/downloads/130138-java-runtime-environment-7-update-51-released-36-vulnerabilities-fixed.html#post1112785

[agarabaghi]

oh wow i will have to look into your exception.sites... im pushing to release SCCM site wide and so far eveyrthing we have needed to change has been pushing for this.

[agarabaghi]

could you post a copy of what your exceptions.sites looks like?

[free780]

From my instructions when I did it.

 

Create the jar file

 

 

[TABLE=width: 100%]

[TR]

[TD]Jar -cvf DeploymentRuleSet.jar ruleset.xml

 

[/TD]

[/TR]

[/TABLE]

 

 

 

 

Then you need to generate a keystore.

 

 

[TABLE=width: 100%]

[TR]

[TD]keytool -genkey -keyalg RSA -alias selfsigned -keystore java-keystore.jks -storepass password -validity 360 -keysize 2048

 

[/TD]

[/TR]

[/TABLE]

The keystore will be valid for 1 year. The password will be password. The filename is java-keystore.jks . Store the file in secure location, when finished.

Then you need to export a certificate.

Copy the lcb-keystore.jks to c:\program files (x86)\java\jre7\bin

 

 

[TABLE=width: 100%]

[TR]

[TD]Keytool -importkeystore --destkeystore c:\program files (x86)\java\jre7\lib\security\cacerts -srcKeystore Cert.cer

 

[/TD]

[/TR]

[/TABLE]

[TABLE=width: 100%]

[TR]

[TD]keytool -exportcert -keystore keystore.jks -alias selfsigned -file Cert.cer

 

[/TD]

[/TR]

[/TABLE]

 

Then you need to insert the cert into cacerts store in java 7.

 

Copy the cacerts file so it can be deployed through GPP.

 

You then need to sign the DeploymentRuleSet.jar file. You will need to download the JDK. The keystore will need to be copied to the same directory as jarsigner.exe .

 

[TABLE=width: 100%]

[TR]

[TD]jarsigner -verbose -keystore keystore.jks -signedjar DeploymentRuleSet.jar DeploymentRuleSet.jar selfsigned

 

[/TD]

[/TR]

[/TABLE]

 

I've only tested it not got it out in production.

[LS-NetTech]

Is this a txt file or jar file?

 

deployment.properties

deployment.config

Edited February 28, 2014 by LS-NetTech

[Arthur]

Is this a txt file or jar file?

They are text files.

[wardsidjame]

Just thought id let you know what we did,

 

Seems to work well and keeps us in control of Java which is increasingly becoming a nightmare!

 

We created two files in c:\windows\sun\java\deployments

 

deployment.properties

exception.sites

 

In deployment properties we pointed the exception sites at the one listed above, once we had the files we needed we used gpo to create a folder like the above path in c:\windows and then setup a share which would copy the two files at each machine restart (se we could update the files in the share and then the machines would pickup the new settings and exceptions once a day)..

 

 

Details of the deployment file

 

#deployment.properties

#Wed Oct 08 10:40:29 BST 2014

deployment.modified.timestamp=1412761229518

deployment.javaws.appicon.index=C\:\\Users\\username\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\appIcon\\appIcon.xml

deployment.javaws.splash.index=C\:\\Users\\username\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\splash\\splash.xml

deployment.version=7.21

install.disable.sponsor.offers=false

deployment.browser.path=C\:\\Program Files\\Internet Explorer\\iexplore.exe

#Java Deployment jre's

#Wed Oct 08 10:40:29 BST 2014

deployment.security.level=High

deployment.user.security.exception.sites=C\:\\Windows\\Sun\\Java\\Deployment\\exception.sites

deployment.javaws.jre.0.registered=true

deployment.javaws.jre.0.platform=1.7

deployment.javaws.jre.0.osname=Windows

deployment.javaws.jre.0.path=C\:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe

deployment.javaws.jre.0.product=1.7.0_67

deployment.javaws.jre.0.osarch=x86

deployment.javaws.jre.0.location=http\://java.sun.com/products/autodl/j2se

deployment.javaws.jre.0.enabled=true

deployment.javaws.jre.0.args=

 

The exceptions file is just then url's or ip's

 

This way we can keep the security on high but allow sites we trust fairly easily.

 

Files are copied using robocopy as a start up script, ive pasted the line below

 

 

'Sync the local machine with the redirection share on the file and print server

Set objShell = CreateObject("Wscript.Shell")

objCommand = "RoboCopy.Exe " & Chr(34) & "\\servername\Redirection$" & Chr(34) & " " & Chr(34) & "C:\windows\sun\java\deployments" & Chr(34) & " /MIR /r:0 /w:0 "

objShell.Run(objCommand)