0

I would like to block pretty much the insecure IE and OE of from my network. Some people are persitent to use the thoe, and pretty much don't use them. I installed both FF and SM, they uninstalled both. I want to make sure gateways to heck don't open.

EDIT: Router is a D-Link EBR-2310.

12 Answers 12

10

This cannot be done at the firewall layer without introducing additional software.

Out of the suggestions people have made, you have shot down every single one:

  • You can't have a proxy server because you have nobody to manage it
  • You can't enforce Group Policy because you purchased XP Home
  • You can't just uninstall IE/OE because the users are Admins and can install whatever they want

These are technical solutions. Make them work (ie, buy the hardware for a proxy server or revoke their admin privileges) or stop worrying about this as an issue. As others have pointed out, IE/OE insecurity is nothing compared to users running day-to-day as Admins. And XP Home? That's a security joke - you can't even enforce file permissions.

The last alternative is to treat this as a social problem. You said you ARE the management - fine, then set and enforce your policy. Uninstall IE. If they reinstall it, fire them. Can't do that? Then deal with your users running IE. And you may want to reconsider your "management" techniques.

2
  • 4
    +1 Oh snap, he got told. (In all seriousness, well put.)
    – notandy
    Jun 2, 2009 at 20:26
  • 3
    This is clearly a people problem first, a technical problem second.
    – Chris
    Jun 2, 2009 at 20:39
4

Unfortunately you made a genuinely bad decision in getting them XP Home - save now, pay later. The best thing to do is to accept that and put in XP Pro; at least then you can start implementing some local Group Policy to lock things down to a more sensible level (although without AD you're going to have to do this on each machine individually - hope you don't have too many of them!)

1
  • I also have a lack of disc drives and can't implement AD anyways. I also only have 3 PCs, and one is also Windows 98 and it's owner doesn't care about browsers.
    – user7635
    Jun 2, 2009 at 20:05
3

Internet Explorer and Outlook use standard protocols to access the Internet. Without doing deep packet inspection and checking for their specific headers, you can't block them at the router.

What you can do is force all access to the Internet to go through a proxy server. At the proxy server, you can block certain clients by the User Agent string (though I don't think OE sends anything identifiable, so this would only work for IE.

If you can manage the computers, you may get better mileage from an (electronic) desktop policy.

2
  • 2
    The PCs don't have GPE support, and I can't have a proxy server. OE also sends a MUA, pretty much the email version of UAs.
    – user7635
    Jun 2, 2009 at 19:38
  • Well, since your D-Link is not powerful enough to do DPI, you'll have to replace it.
    – MikeyB
    Jun 2, 2009 at 20:17
3

Unfortunately, the PCs for some reason MUST have administer privileges.

I think your time and energy would be better spent investigating this issue first.

2

Agreed with all above ppl, proxy is your best shot for disabling IE. Dont think you'll have any luck with OE tough

You could however block them by software. in win7 2008r2 you can use AppLocker wich is deployed trough GroupPolicys. To bad those OSes isnt RTM yet. In applocker its just to disable the exe's filehash to be run from the computer. The similar Software Restriction Policys i think have existed since windows 2000, im not familiar with that tough.

As far as i know, FF is more insecure than IE. If you want a more secure enviroment generally your users should be users not admins/local admins. Use ACT(Application compability toolkit) to cheat the app to think its being run by an admin.

2
  • I can't implement a proxy. The hardware iteslf needs adminship, triedit on a test PC, wouldn't run. I also am putting SeaMonkey in, but the owner say it is slower. I also think they are crazy. Say even think that turning off a PC, even if it's not commected makes connections faster. The Windows 98 machine runs speedily and it has a quarter of the memory.
    – user7635
    Jun 2, 2009 at 20:08
  • of course, you could point me to a public one, as that is allowed.
    – user7635
    Jun 2, 2009 at 20:08
1

You can't block applications at a router level, unless they use a different port. For example, if you block port 80, it's going to block IE/Firefox/etc. Why not just remove all the IE shortcuts and do not allow users to run programs manually?

2
  • They know how to uninstall the applications.
    – user7635
    Jun 2, 2009 at 19:36
  • Also, for some reason, the PCs need adminship.
    – user7635
    Jun 2, 2009 at 19:39
1
  1. Publish an IT policy with management approval disallowing use of Internet Explorer and Outlook Express in the enterprise.

  2. Remove shortcuts to Internet Explorer (manually or with GPO) and uninstall Outlook Express.

  3. Remove admin rights from users to prevent them from installing applications.

  4. Audit machines for Internet Explorer and Outlook Express occasionally and write-up anyone using them to management.

Violating IT policy should be something taken seriously in your organization. You shouldn't have to fight with users about what software is approved for company use. If your management doesn't support your efforts at security, I'd consider looking to work somewhere that does.

6
  • I am management, and the users will usually nag about it to death. The PC users require adminship because of hardware, OE and IE can't be uninstalled, and even then, they can find shortcuts, and I can't use GPE because I was lazy and got XP home.
    – user7635
    Jun 2, 2009 at 19:42
  • 4
    well good luck trying to "manage" your users, sir.
    – Jacob
    Jun 2, 2009 at 19:44
  • I may be able to use the Access and Defaults though, seeing as that don't know about that, but maybe they may find out. I'll probably just send mail and change their home page. Crashie would be the best page for them.
    – user7635
    Jun 2, 2009 at 19:47
  • If you change the access and defaults, you can still open IE from the start menu, sys tray, program files folder. access and defaults would just change what runs when you open .html files and would change the default browser under the start menu.
    – Jacob
    Jun 2, 2009 at 19:49
  • 3
    Unfortunately, it seems that you are not in charge of your computers, your users are. If you can't enforce an IT policy and you don't run an AD domain with XP pro, there is probably very little you can do electronically. Jun 2, 2009 at 19:53
1

(This was going to be a comment, but it got a bit long...)

It would appear that you are trying to solve a social problem (something that should be controlled by policy) with a technical solution. This is almost always a bad idea, and almost always fails in some way. Usually in a way that comes to bite the admin.

As an aside, have you examined why you think IE and OE are a bad idea? Many (most?) companies use them all over the world, and as long as they are fully patched, you don't hear of many major incidents (well, these days, at least). I suspect that you would be better served by changing to Windows Pro, getting rid of Administrative rights from users' workstations, and implementing a reliable patching regime. This will do far more for you in the long-term than simply blocking access to IE and OE. If you need help in removing administrative rights Aaron Margosis used to have a non-admin weblog. It hasn't been updated in a while, but it still contains useful information.

1
  • They will abosutely nag for adminship and drives me nuts. Those machines are also intranet only as well. The poor security of OE and IE, with just opening a page, and you're infected. Plus, the PCs are sluggish and IE just bogs them down.
    – user7635
    Jun 2, 2009 at 20:11
0

IANANG (I am not a Netowork God), however this seems pretty impossible to me. Outlook Express should appear as an SMTP client and as such you won't be able to detect it on a router or firewall. You might be able to block IE, if you can detect the UserAgent string, but that seems dubious as well.

3
  • I am trying to protect the PCs. Unfortunately, the PCs for some reason MUST have administer privileges. I also don't want to block clients that don't open gateways to heck, e.g; Thunderbird and Chrome.
    – user7635
    Jun 2, 2009 at 19:33
  • 4
    The fact that you have granted users Admin rights on their machines, already opens the door wide enough for viruses/Trojans. It doesn't matter much whether you're running FF or IE. Once a virus get's in (by a unaware user) your network will most probably be comprimised no matter what browser you use. The only good way is as mentioned below 'Desktop policies' that restrict permissions
    – kolonell
    Jun 2, 2009 at 19:40
  • The users are smart enough to not get threats, just that that applications are notirous for simply just opening a page, and you're infected. I can't let that happen, as the PCs which people want IE on are slow. Also, IE itself is slow, even on my fast PC.
    – user7635
    Jun 2, 2009 at 19:45
0

I would agree with "crchad" on that. There's many, many work-arounds for having to give admin privs.

The other folks are right as well. Your users are in charge of the computers, and you're attempting to manage "them", albeit from afar and via quiet means instead of working directly with the users or management in question to prove your case.

Instead of spending your time researching technical solutions, instead I would suggest that you research valid case examples of why they would not want to run in the configuration that they're currently in. What the danger is to the company as a whole, of using an outdated and vulnerable browser and OS.

Either way, good luck mate..

0

With what you have: No Chance.

One option would be getting a new Router or a proxy in front of the router that inspects network traffic and blocks applications based on that (That is called Layer 7 Filtering to my knowledge). However, as IE and OE use standard protocols, you could only rely on things like the user-agent string which might block other browsers and applications as well.

A far better option is to upgrade to a real domain and enforce policies.

But with Users having admin permissions, no domain and only a home-user router, you're lost.

0

Technically, if you'd block IE, some applications might fail because of this, even if they don't connect to the Internet. IE has become a core part of the Windows operating system and it's becoming more and more important these days.

Then again, your problem seems to be the users who connect to the Internet for reading their emails and probably for some other personal stuff. Is this bad? It happens so often at companies that it has been investigated and as it turns out, it tends to make people a bit more productive if they can use IE and email at work. One reason for this is because it keeps them connected to their computer instead of wandering off to colleagues for a quick chat. So if you don't allow IE and OE because you fear that you'll lose productivity, then you're wrong.

About security... You can't really block applications at the router level, although routers are able to detect communications from certain kinds of applications. Such a browser might block IE but still allow Chrome or Firefox. Which brings me to an interesting alternative... Why not install and enforce the use of Chrome or Firefox on those computers? It will be a bit more secure. If you also want to provide an email alternative, get Mozilla's Seamonkey, which combines browsing and email in one product. Then users might not use IE and OE anymore. (Then again, something as simple as a Windows update might bring it back again.)

And install a good antivirus product on those computers, just in case. Blocking IE and OE won't keep them secure since there are many other ways that can infect a computer. MS-Word is already known to be insecure and so is Acrobat Reader. A bug in the Windows GUI even made simple JPG images a potential hazard but this has been fixed in one of the updates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .