Deploying Firefox

[Michael]

You should be OK disabling SSL2.0 as SSL3.0 is 'more secure' in the way it works. You don't need the FrontMotion MSI, if anything it just complicates things.

 

Extract the Firefox WinRAR file to a deployment directory on your server such as:

 

\\SERVERNAME\DEPLOYMENT

 

Double click: Mozilla Firefox (3.6) Logistix > Program Files > Mozilla Firefox

 

Make the changes you want here, then deploy the MSI. That's all you have to do!

[digone52]

Hi Michael.

 

Thanks for that.

 

I think I've done the right thing - I've downloaded version 3.6 from logistixonline.com, and see that the files are there to edit.

 

Looks good.

 

Can I ask you some questions which I'm a bit embarassed to ask.

 

If I use the version from LogistixOnline, does this tie me into using this version in future for updates?

 

Will LogistixOnline be kept bang up-to-date with security updates to Firefox?

 

Rather than using incremental updates to Firefox, does deploying a an MSI for updates cause any issues such as extended time taken to deploy?

 

Thanks again.

[Michael]

You can use any version of Firefox you like, however the version I have created is 'ready to deploy' with minor modifications.

 

I can't promise I'll create a version for every Firefox release, but only where there's a need. Alternatively you can create your own version by downloading the latest Firefox browser from Mozilla and using WinstallLE create your own MSIs/customisations. You're free to copy the modifications I have compiled

[digone52]

Thanks Michael.

 

Can the "Add-ons" window be supressed do you know?

 

I've noticed on what I've done so far that when you update Java for instance, on first start-up of Firefox, the Add-on manager starts, giving the pupil the option of disabling Java - not very desirable!

 

Thanks again.

[pagelad]

Thanks for this,

 

Ive tested it and seem to get an error stating "failed to read configuration file"

 

I have used the mozzilla text and byteshifted it, i dont see what im doing wrong

[pagelad]

Its ok, im a numpty!

[Michael]

Ive tested it and seem to get an error stating "failed to read configuration file"

 

Double check you've copied my code in full otherwise it won't work properly. If it works with my code, double check your changes.

 

Can the "Add-ons" window be supressed do you know?

 

It will appear on first use, however once closed it shouldn't appear again. If you're using mandatory files, you need to update these so the the Add-ons window doesn't appear everytime.

[digone52]

Hi.

 

Don't know if you're interested, but I've stopped use of "chrome:" "file:" "C:\" "about:" "resource:" by editing browser.js to send all uses of these to about:blank

 

To do this, I installed 7Zip, and opened chrome\browser.jar to extract browser.js.

 

I edited browser.js in Notepad++, and changed the loadURI function the following...

 

function loadURI(uri, referrer, postData, allowThirdPartyFixup)

{

// Next section added to stop users from accessing stuff

var uri2 = uri.toLowerCase();

if (uri2.match(/^file:/) ||

uri2.match(/^\//) ||

uri2.match(/^c:/) ||

uri2.match(/^d:/) ||

uri2.match(/^chrome:/) ||

uri2.match(/^resource:/) ||

(!uri2.match(/^about:blank/) &&

uri2.match(/^about:/))) {

uri = "about:blank";

}

 

 

try {

if (postData === undefined)

postData = null;

var flags = nsIWebNavigation.LOAD_FLAGS_NONE;

if (allowThirdPartyFixup) {

flags = nsIWebNavigation.LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP;

}

gBrowser.loadURIWithFlags(uri, flags, referrer, null, postData);

} catch (e) {

}

}

 

You could presumably redirect this to any URL you like, such as a misuse warning.

 

You can also do the following to the LightWeightThemeWebInstaller to stop all themes from installing...

 

// inserted a "2" in the next line to stop theme installation

var LightWeightThemeWebInstaller2 = {

 

 

Just put browser.js back into browser.jar, and you're away.

 

There are probably better ways of doing this, but this does work well.

 

Hope this helps.

[Michael]

Thanks, I am aware disabling file browsing within Firefox is possible but it doesn't really create a security risk. By all means though add your own customisations for your own deployments

[digone52]

I'll share with you something else I've found.

 

In the same way as my previous post, if you edit broswer.xul and remove this...

 

 

key="&historySidebarCmd.commandKey;"

modifiers="accel"

command="viewHistorySidebar"/>

 

... it disables Ctrl D, Ctrl B, Ctrl H, Shift Ctrl B.

 

I think by doing this, and doing a few other tweaks, you can completely mask off the use of bookmarks, RSS, history.

 

Regarding the previous posting, access to file:, I guess it's down to the schools policy, but we don't want pupils being able to browse and copy files off the C: drive. If you've blocked the pupils from browsing the C: drive in Explorer via GPO, then they will still be able to browse the C: drive using Firefox unless you implement this kind of fix. I suspect that blocking access to chrome: is more important though.

[pagelad]

This has come in really handy and ive moved most of my schools across to this.

 

Will there be a .6.2 release coming soon we can upgrade to?

 

Thanks for your help

[Michael]

Mozilla Firefox 3.6.3 Logistix is now available for download, happy dayz!

[6Foot2]

Mozilla Firefox 3.6.3 Logistix is now available for download, happy dayz!

 

Hi Michael,

 

Thanks for that. But a previous version of your package is the only thing that is keeping our Internet connection [for staff] alive [internet Explorer proxy settings have been corrupted (somehow)]

 

So I will stay where I am for now.

[Michael]

Good to know it's being put to good use! I don't think your staff would appreciate no connection at all

 

Two things come to mind regarding IE. Firstly check your GPO settings and secondly, you could alternatively run a silent reg file as proxy settings are in clear text within the registry. It should be easy enough to find and correct.

[rbouman]

Hi.

 

Don't know if you're interested, but I've stopped use of "chrome:" "file:" "C:\" "about:" "resource:" by editing browser.js to send all uses of these to about:blank

 

To do this, I installed 7Zip, and opened chrome\browser.jar to extract browser.js.

 

I edited browser.js in Notepad++, and changed the loadURI function the following...

 

function loadURI(uri, referrer, postData, allowThirdPartyFixup)

{

// Next section added to stop users from accessing stuff

var uri2 = uri.toLowerCase();

if (uri2.match(/^file:/) ||

uri2.match(/^\//) ||

uri2.match(/^c:/) ||

uri2.match(/^d:/) ||

uri2.match(/^chrome:/) ||

uri2.match(/^resource:/) ||

(!uri2.match(/^about:blank/) &&

uri2.match(/^about:/))) {

uri = "about:blank";

}

 

 

try {

if (postData === undefined)

postData = null;

var flags = nsIWebNavigation.LOAD_FLAGS_NONE;

if (allowThirdPartyFixup) {

flags = nsIWebNavigation.LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP;

}

gBrowser.loadURIWithFlags(uri, flags, referrer, null, postData);

} catch (e) {

}

}

 

You could presumably redirect this to any URL you like, such as a misuse warning.

 

You can also do the following to the LightWeightThemeWebInstaller to stop all themes from installing...

 

// inserted a "2" in the next line to stop theme installation

var LightWeightThemeWebInstaller2 = {

 

 

Just put browser.js back into browser.jar, and you're away.

 

There are probably better ways of doing this, but this does work well.

 

Hope this helps.

 

When i try this, nothing happens when you type in valid url. I was using 7zip portable, edited carefully in notepad2 and when prompted saved it back to the jar file.

I've tried twice. Will try again to edit it with notepad++ instead.

what saved my hide is the backup browser.jar file from a portable install.

 

did you use any specific settings in 7zip? because i went from 2028kb to 1770kb by adding your data. that can't be right can it?

maybe a step-by-step instruct for browser.jar dummy editors... :-)

[Arthur]

because I went from 2028kb to 1770kb by adding your data. that can't be right can it?

That's perfectly normal. The compression level doesn't affect Firefox's ability to read what is inside the JAR file so it can be set to whatever you want. I use the Maximum or Ultra setting whenever I do this.

[rbouman]

That's perfectly normal. The compression level doesn't affect Firefox's ability to read what is inside the JAR file so it can be set to whatever you want. I use the Maximum or Ultra setting whenever I do this.

 

ok, good to know all is well there.

please be patient with this newbie; I can't get the altered browser.js to take proper effect, by that i mean that once the code has been replaced, users get blank results when entering valid urls also.

-----------------code entered into browser.js, 3.6.8 firefox community edition by frontmotion --------

function loadURI(uri, referrer, postData, allowThirdPartyFixup)

{

// Next section added to stop users from accessing stuff

var uri2 = uri.toLowerCase();

if (uri2.match(/^file:/) ||

uri2.match(/^\//) ||

uri2.match(/^c:/) ||

uri2.match(/^chrome:/) ||

uri2.match(/^resource:/) ||

(!uri2.match(/^about:blank/) &&

uri2.match(/^about:/))) {

uri = "about:blank";

}

 

{

try {

if (postData === undefined)

postData = null;

var flags = nsIWebNavigation.LOAD_FLAGS_NONE;

if (allowThirdPartyFixup) {

flags = nsIWebNavigation.LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXU P;

}

gBrowser.loadURIWithFlags(uri, flags, referrer, null, postData);

} catch (e) {

}

}

--------------end of code snippet--------------

i've taken the d: drive line out of it but that's the extent of my fiddling about.

i've probably forgotten some important stuff, what else should i have checked?

[sted]

is it possible to alter the msi to install firefox without it making itself the default browser as i just want it there for certain sites that dont play well with ie but firefox dosent play that well with other sites

[john2k5]

Hi, I know this is an old thread, but this seems to be exactly what I am looking for to deploy firefox in my school.

 

I have looked at FrontMotion Firefox, and have had some relative success with it, but after stumbling across this thread Logistix seems to be the perfect solution and much easier to deploy.

 

Unfortunately, all the download links are missing now. Has this project been discontinued? If so, does anyone have the last version of the msi floating around that I could pinch? I'm not too fussed about future updates, just need something that works.

 

Thanks,

John

Edited February 25, 2011 by john2k5
Typo's :)

[Michael]

Originally I created a locked down package to deploy Firefox, as many schools were using Policy Central. At the time it created slow down issues/crashes with Internet Explorer and using Firefox was the perfect workaround.

 

Lessons have been learnt and thankfully Policy Central no longer conflicts with Internet Explorer, so there's less of a requirement to need both Internet Explorer and Firefox. Firefox 4 however is soon to be released, so I'd be happy to create a new locked down version with this release

[Fraser-09]

Hi Micheal,

 

Any thoughts of continuing this project for Firefox 4? I'd be more than happy to help/test.

 

 

Fraser

[Michael]

I shall look into it for you

[sted]

well so far i can lock settings using the same mozilla.crg as before and stop the first time tab and do you want to grab stuff from ie box what i cant do is hide menus and stop people enabling/disabling addons (they cant install them though)

 

so far its pretty similar to before BUT the firefox.js you need to edit is now stored in omni.jar (a zipped file rather than just in the program files folder)

 

so in there add at the bottom

 

pref("general.config.filename", "mozilla.cfg");
pref("browser.startup.homepage_override.mstone", "rv:2.0");

 

top line defines your lockdown file 2nd line hides the first run tab (at least i think it does it may also be set elsewhere)

 

create a file called override.ini in c:\..\Mozilla Firefox\

 

[XRE]
EnableProfileMigrator=false

 

that hides the first run import from ie screen

 

userchrome.css seems to be a different kettle of fish every suggestion i have seen for hiding say the help menu fails

 

for what its worth my mozilla.cfg (pretty much pinched from the topic starter is ( while there are proxy details in theer (well sort of ive replaced with aproxy) its set to pinch its settings from ie anyway i just left them there if i ever decided they were useful

 

//
try {
lockPref("app.update.enabled", false);
lockPref("app.update.autoUpdateEnabled", false);
lockPref("app.update.disable_button.showUpdateHistory", true);
lockPref("network.cookie.cookieBehavior", 1);
lockPref("network.proxy.http", "aproxy");
lockPref("network.proxy.http_port", 80);
lockPref("network.proxy.type", 5);
lockPref("network.proxy.no_proxies_on", "cachepilot");
lockPref("network.proxy.share_proxy_settings", true);
lockPref("browser.startup.homepage", "http://www.google.co.uk");
lockPref("browser.startup.page", 1);
lockPref("browser.cache.disk.capacity", 50000);
lockPref("browser.download.manager.showWhenStarting", true);
lockPref("browser.download.manager.closeWhenDone", true);
lockPref("browser.download.manager.retention", 0);
lockPref("browser.download.useDownloadDir", false);
lockPref("browser.history_expire_days", 0);
lockPref("browser.popups.showPopupBlocker", false);
lockPref("browser.search.selectedEngine", "Google");
lockPref("browser.search.update", false);
lockPref("browser.shell.checkDefaultBrowser", false);
lockPref("browser.link.open_external", 2);
lockPref("browser.link.open_newwindow", 2);
lockPref("browser.tabs.loadInBackground", false);
lockPref("browser.tabs.warnOnClose", false);
lockPref("browser.tabs.autoHide", false);
lockPref("browser.display.screen_resolution", 96);
lockPref("browser.display.use_document_fonts", 1);
lockPref("browser.display.use_document_colors", true);
lockPref("browser.enable_automatic_image_resizing", false);
lockPref("browser.turbo.enabled", true);
lockPref("browser.places.importBookmarksHTML", false);
lockPref("browser.tabs.warnOnOpen", true);
lockPref("browser.display.use_focus_colors", false);
lockPref("browser.display.use_system_colors", false);
lockPref("browser.use_custom_colors", false);
lockPref("browser.underline_anchors", true);
lockPref("browser.offline-apps.notify", false);
lockPref("browser.active_color", "[url=http://www.edugeek.net/misc.php?do=dbtech_usertag_hash&hash=EE0000%22%29]#EE0000")[/url]
lockPref("browser.anchor_color", "[url=http://www.edugeek.net/misc.php?do=dbtech_usertag_hash&hash=0000EE%22%29]#0000EE")[/url]
lockPref("browser.display.background_color", "[url=http://www.edugeek.net/misc.php?do=dbtech_usertag_hash&hash=FFFFFF%22%29]#FFFFFF")[/url]
lockPref("browser.display.focus_background_color", "[url=http://www.edugeek.net/misc.php?do=dbtech_usertag_hash&hash=117722%22%29]#117722")[/url]
lockPref("browser.display.focus_text_color", "[url=http://www.edugeek.net/misc.php?do=dbtech_usertag_hash&hash=FFFFFF%22%29]#FFFFFF")[/url]
lockPref("browser.display.foreground_color", "[url=http://www.edugeek.net/misc.php?do=dbtech_usertag_hash&hash=000000%22%29]#000000")[/url]
lockPref("browser.visited_color", "[url=http://www.edugeek.net/misc.php?do=dbtech_usertag_hash&hash=551A8B%22%29]#551A8B")[/url]
lockPref("browser.safebrowsing.enabled", true);
lockPref("browser.safebrowsing.malware.enabled", true);
lockPref("dom.disable_open_during_load", true);
lockPref("pref.advanced.images.disable_button.view_image", true);
lockPref("pref.advanced.javascript.disable_button.advanced", true);
lockPref("pref.browser.homepage.disable_button.current_page", true); 
lockPref("pref.browser.homepage.disable_button.bookmark_page", true);
lockPref("pref.browser.homepage.disable_button.restore_default", true);
lockPref("pref.browser.language.disable_button.remove", true);
lockPref("pref.browser.language.disable_button.up", true);
lockPref("pref.browser.language.disable_button.down", true);
lockPref("pref.privacy.disable_button.cookie_exceptions", true);
lockPref("pref.privacy.disable_button.set_master_password", true);
lockPref("pref.privacy.disable_button.view_passwords", true);
lockPref("pref.downloads.disable_button.edit_actions", true);
lockPref("javascript.enabled", true);
lockPref("security.enable_java", true);
lockPref("security.warn_entering_secure", false);
lockPref("security.warn_entering_weak", true);
lockPref("security.warn_leaving_secure", false);
lockPref("security.warn_submit_insecure", false);
lockPref("security.warn_viewing_mixed", true);
lockPref("security.enable_ssl2", true);
lockPref("security.enable_ssl3", true);
lockPref("security.enable_tls", true);
lockPref("security.default_personal_cert", "Ask Every Time");
lockPref("print.save_print_settings", false);
lockPref("privacy.sanitize.promptOnSanitize", false);
lockPref("privacy.popups.showBrowserMessage", false);
lockPref("permissions.default.image", 1);
lockPref("xpinstall.enabled", false);
lockPref("xpinstall.whitelist.required", true);
lockPref("xpinstall.whitelist.add.36", "");
lockPref("general.autoScroll", true);
lockPref("general.smoothScroll", false);
lockPref("general.warnOnAboutConfig", false);
lockPref("extensions.update.enabled", false);
lockPref("extensions.update.autoUpdateEnabled", false);
lockPref("extensions.getAddons.showPane", false);
lockPref("font.default.x-western", "serif");
lockPref("font.language.group", "x-western");
lockPref("font.minimum-size.x-western", 0);
lockPref("font.name.cursive.x-western", "Comic Sans MS");
lockPref("font.name.monospace.x-western", "Courier New");
lockPref("font.name.sans-serif.x-western", "Arial");
lockPref("font.name.serif.x-western", "Times New Roman");
lockPref("font.size.fixed.x-western", 13);
lockPref("font.size.variable.x-western", 16);
lockPref("intl.accept_languages", "en-gb, en");
lockPref("intl.charset.default", "ISO-8859-1");
lockPref("intl.accept_charsets", "ISO-8859-1,*,UTF-8,");
lockPref("spellchecker.dictionary", "en-GB");
lockPref("layout.spellcheckDefault", 0);
lockPref("accessibility.blockautorefresh", false);
lockPref("accessibility.browsewithcaret", false);
lockPref("accessibility.typeaheadfind", false);
lockPref("browser.formfill.enable", true);
lockPref("privacy.sanitize.sanitizeOnShutdown", false);
lockPref("signon.rememberSignons", true);
} catch(e) {
displayError("lockedPref", e);
}

[kouloubj]

Just wondering if a new package has been created for the new version of FF (4.0.1)?

 

Our district is having problems with our content filter & the lack of SNI support for IE on Win XP clients...

 

 

Thanks in advance.

[featured_spectre]

I've found in my experience that FireFox is slow and buggy...over the summer I am doing a complete overhaul of our images and starting from scratch....