Locking Down Mozilla Firefox

One of the main draw backs to Mozilla Firefox from most corporate IT people is its inability to be locked down, or taken care of by Group Policy. While you cannot lock down Firefox from within Group Policy alone, you can script these fixes into place to lock settings down.

To start you will need a program to byte shift a config file so that Firefox can read it. I used Byte Shifter.exe. There are also websites that do it all in a browser, but I haven't used them.

You will also need to edit the all.js file in "C:\Program Files\Mozilla Firefox\greprefs\" to include:

pref("general.config.filename", "mozilla.cfg");

I put that line at the absolute bottom, but it might not matter where it goes.

To start create an empty file. I called mine mozilla.txt since the result file will be mozilla.cfg.

The file must start with // on its own line.

Add in any settings you want to lock down. You can peruse about:config for settings, and again after you lock them down to check for the "locked" option.

Below is my mozilla.txt file, with host names changed to protect the innocent. I have included comments (They start with //) to explain things a bit further.

//

//Lock the option for startup page. 0 = "Show a blank page", 1 = "Show my home page", and 3 = " Show my windows and tabs from last time"

lockPref("browser.startup.page", 1);

//Set the home page. Use a pipe to include many home pages as tabs.

lockPref("browser.startup.homepage", "http://www.mysuperawesomecompany.com|https://mail.google.com");

//Set the browser history to something a bit longer than the default 7 days.

lockPref("browser.history_expire_days", 90);

lockPref("browser.history_expire_days.mirror", 90);

// Clean up certain things every time Firefox shuts down. This keeps things clean and running smooth for us, your results may very.

lockPref("privacy.sanitize.sanitizeOnShutdown", true);

//We do not want to clear the history on shutdown.

lockPref("privacy.clearOnShutdown.history", false);

lockPref("privacy.item.history", false);

//We can clean up the downloads history. I have seen things get really slow if this doesn't happen.

lockPref("privacy.item.downloads", true);

//Clear the cache.

lockPref("privacy.item.cache", true);

//Clean up cookies.

lockPref("privacy.item.cookies", true);

//Remove any session info.

lockPref("privacy.item.sessions", true);

//We do not want to keep passwords saved.

lockPref("privacy.item.passwords", true);

//Do not prompt to do this, just do it.

lockPref("privacy.sanitize.promptOnSanitize", false);

lockPref("signon.rememberSignons", true);

//Do not allow the "Show passwords" button.

lockPref("pref.privacy.disable_button.view_passwords", true);

//Don't use a proxy.

lockPref("network.proxy.type", 0);

//We keep one version of Firefox for a while. The newest version breaks things in our application, so we currently need to just run what we have.

lockPref("app.update.enabled", false);

//Disable extensions.

lockPref("config.lockdown.disable_extensions", true);

//Disable themes.

lockPref("config.lockdown.disable_themes", true);

//Show the downloads window when downloading a file.

lockPref("browser.download.manager.showWhenStarting", false);

//Close the downloads window when all downloads are done.

lockPref("browser.download.manager.closeWhenDone", true);

//Save files to:

lockPref("browser.download.useDownloadDir", true);

lockPref("browser.download.dir", "c:\\%homepath%\\Desktop");

lockPref("browser.download.downloadDir", "c:\\%homepath%\\Desktop");

lock{ref("browser.download.folderList", 2);

//Always ask me where to save files.

lockPref("browser.download.useDownloadDir", false);

//Always check to see if Firefox is the default browser.

lockPref("browser.shell.checkDefaultBrowser", false);

//New pages should open in a new window.

lockPref("browser.link.open_external", 2);

lockPref("browser.link.open_newwindow", 2);

//New pages should open in a new tab.

lockPref("browser.link.open_external", 1);

lockPref("browser.link.open_newwindow", 1);

//Warn me when closing multiple tabs.

lockPref("browser.tabs.warnOnClose", false);

//Warn me when openining multiple tabs might slow down Firefox.

lockPref("browser.tabs.warnOnOpen", false);

//Always show the tab bar.

lockPref("browser.tabs.autoHide", false);

//When I open a link in a new tab, switch to it immediately.

lockPref("browser.tabs.loadInBackground", false);

//Block pop-up windows.

lockPref("dom.disable_open_during_load", false);

//Load images automatically. 1 = check 2 = unchecked.

lockPref("permissions.default.image", 2);

//enable JavaScript.

lockPref("javascript.enabled", true);

//Some of the advanced JavaScript options.

//Disable the Advanced Button.

lockPref("pref.advanced.javascript.disable_button.advanced", true);

//Move or resize existing windows.

lockPref("dom.disable_window_move_resize", true);

//Raise or lower windows.

lockPref("dom.disable_windows_flip", false);

//Disable or replace context menus.

lockPref("dom.event.contextmenu.enabled", false);

//Hide the status bar.

lockPref("dom.disable_window_open_feature.status", false);

//Enable Java.

lockPref("security.enable_java", false);

Of course there are others and many more settings, but that covers a good number of them. Also I have only tested this on our version of Firefox, which is 2.0.0.20.

How to: mod_expires & mod_deflate in Apache running on CentOS 5

While trying to improve the performance of our internal workflow I was tasked with setting up mod_deflate and mod_expires, based off of Yahoo's! Best Practices for Speeding Up Your Website.

The nitty gritty of these two is to make sure they are both listed in your httpd.conf file:

LoadModule expires_module modules/mod_expires.so

LoadModule deflate_module modules/mod_deflate.so

Since this server is running the default CentOS 5 apache I already had the support I needed.  I then continued on to find the documentation online. Both modules support vhost context so that is the route I went with. I added the lines below to each vhost that I wanted the settings to take place for.

ExpiresActive On

                ExpiresByType image/gif A2592000

                ExpiresByType image/jpeg A2592000

                ExpiresByType image/png A2592000

                ExpiresByType text/css A2592000

                ExpiresByType application/x-javascript A2592000

                ExpiresByType application/pdf A2592000

        

The syntax for the ExpiresByType directive is:

ExpiresByType mime/type TimeInSeconds. 

The A2592000 is Access time + one month.  If I wanted the file to be cached for one month from modification date I would have done M2592000 instead.

Other handy numbers in seconds:

86400 = One Day

604800 = One Week

2592000 = One Month

31536000 = One Year (365 Days)

157680000 = Five Years

3153600000 = Ten Years

Why might these large numbers come in handy?  Well you want to set far future expiration dates for things that don't change often.  The catch is if you need to update one of these items with a far future expiration date.  You have to change the file name.  Modify the case of the filename will work in the short term but really you want to start adding version strings to all of your static files like CSS and JavaScript.  

mod_deflate is much easier to setup.  Simply add the line:

AddOutputFilterByType DEFLATE text/html text/plain text/xml application/x-javascript text/css

Again based on the mod_deflate documentation you can add this directive to the vhost directives.  Please note that this directive can be placed on just about any context level and as such is very powerful.  Also note that you should not try to compress image file because they are already compress and it really is just a waste of CPU and time.

Using these two methods we where able to reduce our website on a first visit from 190.7Kb total to 157.3Kb total.

Before:

9.4K HTML/Text

32.1K Javascript

12.9K Stylesheets

0.4K CSS Images

135.9K Images

190.7K Total

After:

3.1K HTML/Text

15.0K Javascript

2.9K Sytlesheets

0.4K CSS Images

135.9K Images

157.3K Total

I also used the yuicompressor to minify our main Javascript and our CSS file.

After:

3.1K HTML/Text

12.3K Javascript

2.2K Sytlesheets

0.4K CSS Images

135.9K Images

154.0K Total

As you can see using mod_deflate to compress the Javascript and CSS is a more substantial savings in terms of bandwidth than trying to minify.

Granted based on my observations if we really wanted to save on bandwidth and make our pages load faster we would reduce the substantial image footprint.

In case anyone is wondering where I culled all of these numbers from I used Y! Slow for Firebug in Firefox. 

nagstamon: A Nagios system tray monitor

First a little bit about my setup. While its true that I love nagios I don't always want to wait for e-mails to come before I know about a problem. I run a dual PC setup with Synergy2 to connect the two monitors and use only one keyboard and mouse. I keep the second monitor on my helpdesk tickets and nagios service detail page. I also use the Nagios Checker for Firefox on my second screen, but since I run Chrome as my main browser I cannot use that option on my main screen.

Today I found nagstamon and instantly fell in love with it! Configuration is easy. Below you can see what settings I am using for optimal performance in my opinion. Of course nagios-server is my actual FQDN for my nagios server and I don't use nagiosadmin to login to my nagios server.

If you notice on the last tab "Executables" I keep putty in the Windows directory so I don't have to update my path. This allows me to run putty right from the command line anywhere I am once I am at a command prompt.

Also if you don't choose to put NagStaMon in the system tray it will float in it's own tiny window like you see below. Look near the upper left corner by the Firefox Icon.

Firefox 3: places.sql to bookmarks.html conversion

Sometimes, just sometimes you jump the gun and upgrade too soon. Well as it turns out I did that when I first started my new job. Our home grown web app renders perfectly in Firefox 2 but looks odd in Firefox 3. Also one of the plugins we need to run is very unstable in Firefox 3 so I had to revert back.

If I had known this a month ago and not started accumulating bookmarks all over the place I would have been fine, but that was not the case. The main problem is that Firefox 3 uses a new places.sqlite SQL database to keep track of bookmarks instead of the tried and true bookmarks.html. I went online looking for some sort of conversion program, thought about making my own (which I still might do just as a proof of concept / fun project.)

So anyway, here is how to have Firefox 3 save a bookmarks.html file in addition to the places.sqlite. Open a new tab and go to about:config. Click "Ok" when it asks if you will be careful. Now browse down to "browser.bookmarks.autoExportHTML" and change this from the default of "false" to "true". Restart Firefox and you will have your bookmarks.html file updated as you add new bookmarks.

If I ever do create a conversion program I will post the link on this site.