Deploying Firefox

[Michael]

Hello all,

 

Due to the continued problems with Internet Explorer (especially in Birmingham Schools), I went about trying to find the best ways of deploying Firefox to cover the following:

 

- Deployment should be easy as possible (MSI or equivalent)

- Locking down FF (similar to Group Policies). A typical example would be Proxy Settings

- Setting the Homepage

- Allow FF and IE to run together or just FF on its own

- Allow ease of management of Favourites between IE and FF

- Control the version of FF in use consistently (across the network)

- To cost nothing, as many FF custom solutions require payment

 

Thankfully after a few days I’ve pretty much nailed it, but I welcome any feedback you have (especially from Birmingham schools). Here are some facts:

 

- The file weighs in at 13.9MB

- Using the latest Firefox build 3.5.3

- Requires a one click installation or using an /s switch for scripts

- The install doesn't place a shortcut on desktop, but by navigating to: C:\Program Files\Mozilla Firefox\Firefox.exe you can create a shortcut to the desktop and rename it 'Mozilla Firefox'.

- The Import Favourites Wizard on FF startup has been disabled

- Many options are locked out or greyed out, such as Proxy Settings and Homepage (as well as many others). The homepage is set to http://www.bgfl.org/ (for all users)

- FF has been disabled to check if it’s the default browser, so IE and FF work perfectly together. To stop IE checking if it is default; this can be set using Group Policy.

- The Bookmarks menu is completely hidden in FF and an Add-on is automatically installed, so FF shares IE’s Favourites. No more worrying about managing different Favourite/Bookmark lists

- Checking for updates in FF has been disabled, so the school Network Manager can consistently control the version of FF in use

- Google has been set as the default Search Engine (top right)

 

Download the file here

Edited October 3, 2009 by Michael

[mac_shinobi]

Is it easy enough to re configure settings such as home page and other settings ?

[Michael]

Well once I've had some feedback I'd be prepared to make some custom versions for Local Authorities around the country. I can change the homepage and proxy settings as appropriate.

[mac_shinobi]

Well once I've had some feedback I'd be prepared to make some custom versions for Local Authorities around the country. I can change the homepage and proxy settings as appropriate.

 

I take it you change those by altering / amending the relevant js ( javascript file ) ?

 

If so maybe you could post it up here with relevant parts in bold and aprox directions on where it should be located but obviously not sure how you package that up with the rest of it ?

[Kitkatninja]

This may help you, a ADM file for Firefox (import it into AD). It should help you with administering FF setting via AD.

 

-ken

Edited October 3, 2009 by Kitkatninja
more info

[Michael]

No that information is stored within:

 

C:\Program Files\Mozilla Firefox\mozilla.cfg

 

Rename this to mozilla.txt make changes, then rename it back to mozilla.cfg

[rocknrollstar]

This looks great- I have wanted to deploy Firefox on the network, but didn't take the risk due the issues which you seemed to have nailed down.

 

I'm not from a Birmingham school, but would be very interested in using your FF package if it was easy to change the homepage and proxy settings.

[CyberNerd]

msi:

 

Download Firefox MSI

 

and put settings into mandatory profiles docs+settings/application data

[Michael]

Thanks Wagnerk. I had seen there were ADMs available, but I can configure more settings using the mozilla.cfg file, some ini files and the Favourites tweak.

 

Thanks also CyberNerd. I am using this MSI and adding additional tweaks to lock down menu items.

 

@rocknrollstar - If you have a look at the File Library, I have uploaded a proxy free version for you to test

[sted]

what about using firefox portable from a pen drive (or script copied to local hdds?)

[FN-GM]

Might be worth noting that if you install Google Chrome it picks up the majority of group policy settings you set in IE including proxy settings.

 

Z

[cookie_monster]

I have a couple of questions, these issues have put me off deploying FF before.

 

1. How will you manage patches for Firefox will it update itself without user interaction? EDIT I see above that you disabled it.

2. If it does autoupdate how can you tell if it's working and all clients are upto date? I can tell with WSUS if IE is upto date

3. What are the issues that you've been having with IE in Birmingham?

 

sted, interesting idea. FF portable could be good and relatively simple you could package that and deploy it each time a new update came out.

 

Thanks.

Edited October 3, 2009 by cookie_monster

[Michael]

what about using firefox portable

 

I could in theory of used FF portable but there wasn't really any requirement for me to do so.

 

Might be worth noting that if you install Google Chrome

 

Google Chrome just didn't work properly at all when I tested it in a domain environment with roaming profiles (months and months ago). Absolute nightmare, although Google Chrome portable worked it wasn't anywhere near as smooth as FF or IE. Maybe this has changed with Chrome 3.0?

 

1. How will you manage patches for Firefox will it update itself without user interaction? EDIT I see above that you disabled it.

2. If it does autoupdate how can you tell if it's working and all clients are upto date? I can tell with WSUS if IE is upto date

3. What are the issues that you've been having with IE in Birmingham?

 

I'm glad you asked! I've disabled it on purpose so it means you as a Network Manager can control/decide what version you want your users to use. There's nothing worse than everyone using different versions.

The issues myself and other Network Managers have experienced in Birmingham schools is a really strange one. There were significant problems with IE and Policy Central and in general (for reasons unknown) IE more recently has become increasingly unreliable and unstable which causes IE to crash. Event logs show nothing interesting or useful.

 

I have been unsuccessful at replicating the same problem outside of the BGFL network, and my first initial tests proved interesting as on exactly the same hardware (at the same time) loading up pages in FF is significantly faster within the BGFL network. Outside of the BGFL network FF is fractionally quicker, but it's a lot more noticeable when I am in a school, even on the best of hardware.

I've now successfully packaged/tweaked FF, locked it down and initial speed tests/browsing has proved very successful

[mac_shinobi]

Maybe this has changed with Chrome 3.0?

 

Maybe .......... you can post results when and if you get a chance to

 

A - try it and post back with results

B - someone else trys it and posts back

C - Another option just in case I missed something

[cookie_monster]

So each time there is an update you'll just package it and roll it out? Do you have it running on any TS\Citrix boxes?

 

I'll take a look into this cheers.

[Michael]

Maybe .......... you can post results when and if you get a chance to

 

Even if Chrome does work OK, I have no plans to roll it out to a network. By all means give it a go

 

Do you have it running on any TS\Citrix boxes?

 

I've only tested it on XP at the moment. This is what all my sites use.

[Edu-IT]

No that information is stored within:

 

C:\Program Files\Mozilla Firefox\mozilla.cfg

 

Rename this to mozilla.txt make changes, then rename it back to mozilla.cfg

So I take it we can just install this, make the necessary changes, then just package it up again?

[Arthur]

Michael. Out of interest, have you solved the problem where users can browse drives in Firefox e.g. by typing C:\ in the address bar and access about:config? The solution discussed here doesn't work for me. I created a package almost exactly like yours several months ago, but this issue has prevented me deploying it onto the school computers so far. Edited October 4, 2009 by Arthur

[Michael]

@Arthur - If you type about:config into the address bar, you cannot change any of the settings I've set, such as proxy settings or homepage. These settings are locked by the custom mozilla.cfg file I created.

 

If you download the Proxy Free version from my website you can try/see this for yourself.

[Michael]

So I take it we can just install this, make the necessary changes, then just package it up again?

 

Yes that's correct, then use FFDeploy to repackage it with your changes. Alternatively I don't mind making some variations if there's enough demand

[Arthur]

If you download the Proxy Free version from my website you can try/see this for yourself.

I did try your package shortly after I posted, but surely if students have access to about:config there's still a lot of other stuff they can mess about with even with the prefs you have locked (which is why I was looking to block access to about:config entirely - not to mention file-system browsing too).

 

A couple of other things I noticed with your Firefox package is that 'xpinstall.enabled' is set to true which enables anyone to install add-ons. Is this not a really bad idea, not only for security and consistency reasons but also the fact that students could really screw Firefox up? Secondly, if the users have roaming profiles the browser cache will be stored on the network which will not be very good for performance reasons. Mozilla recommend changing the location of the cache to a faster local hard drive via the browser.cache.disk.parent_directory preference.

[CyberNerd]

I did try your package shortly after I posted, but surely if students have access to about:config there's still a lot of other stuff they can mess about with even with the prefs you have locked (which is why I was looking to block access to about:config entirely - not to mention file-system browsing too).

 

Does it really matter if students change the settings? Whats the worst that will happen? they get to 'read only' some system files.....

Are you sure this isn't taking things a bit too extreme in terms of locking down? If the network is too insecure to allow students to change proxy settigns and browse the filesystem, locking FF is closing the stable door after the horse has bolted - plus it will make further updates a pita.

 

As long as none of FF settings are saved (use a read only manadatory profile for default settings), make sure students cannot write to the c:\program files\firefox so they cannot screw with the installation with all sorts of addons, I don't really see the problem.

[Arthur]

I can see your point, but considering that most schools lock down Internet Explorer really well via GPOs it would be nice to do the same with Firefox too. Given the chance, the students at my school would love to mess around with the settings just because they can. Locking it down completely also enables you to create a [ame=http://en.wikipedia.org/wiki/Standard_Operating_Environment]SOE[/ame] which is a good idea if you are implementing FITS or ITIL processes.

 

Sure, the files will be read only, but the problem with file-system browsing is that students could copy applications and other files they don't normally have access to onto their memory sticks. Once they are on there there is not much you can do about it. What would happen if a student did this, took the applications and/or license files home and then shared them on a P2P program for example? That would definitely not be good for the school especially if the company that makes the software found out.

[CyberNerd]

@Arthur

I just think that sometimes we (me included) spend ages trying to fix something that isn't such a big deal in the first place - only to find x months later to go through the whole process for every upgrade.

Sometimes it's ok to give the students flexibility to explore computers, it doesn't make the computers any less standard if they can't make permanent changes.

Is there a demand for p2p educational apps? I'm shocked.

[Michael]

If you'd like to hide/remove about:config do the following:

 

Navigate to C:\Program Files\Mozilla Firefox\chrome

 

Rename toolkit.jar to toolkit.zip, then navigate to, content > global and delete config.xul

 

Now rename toolkit.zip back to toolkit.jar then try running about:config. You should receive an error message.