Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need java, but I don't want any browser to be able to access it.

Is it possible to remove the whole applet/browser plugin code?

share|improve this question
add comment

4 Answers

As of Java Version 7 Update 10, the Java Control Panel (in the Security tab) can disable the Java plug-in completely: http://www.java.com/en/download/help/disable_browser.xml

                                      ss of dialog

This should avoid the possibility that a Java upgrade might re-enable the plug-in, which might be a risk with some other approaches.

share|improve this answer
    
great answer. thanks for adding this –  reinier Apr 15 '13 at 18:43
add comment

If you install the JRE; you can delete or rename npjp2.dll or libnpjp2.so (on linux); or on Linux make it non executable (chmod 0000 libnpjp2.so). This single file is the plugin file.

They're located in %ProgramFiles%\jre<x>\bin\plugin2 on Windows. On Linux, they're where ever your java is installed. You can run locate libnpjp2.so to find the location.

The same also applies to the JDK.

share|improve this answer
2  
Disabling the plugin would alleviate most java security concerns right? (Since java attacks happen through the browser) –  reinier Sep 29 '12 at 16:08
    
But if this is a server, people should not be using it for browsing web sites anyway... –  Massimo Sep 29 '12 at 17:37
    
Yes, removing the ability to execute or deleting it completely will alleviate applet or plugin security concerns. –  josten Sep 29 '12 at 20:08
    
I really don't think anything is located in "jre<x>/bin/plugin2" on Windows. :) –  John Gardeniers Sep 29 '12 at 21:49
1  
I did not give full path because it can be in Program Files or Program Files (x86) or anywhere else one chooses to install Java. –  josten Sep 30 '12 at 17:16
add comment

One method to disable the Windows/IE browser plugin is to set a deny ACE on the following files:

"C:\Program Files\Java\jre6\bin\ssv.dll"
"C:\Program Files\Java\jre6\bin\jp2ssv.dll"

"C:\Program Files\Java\jre7\bin\ssv.dll"
"C:\Program Files\Java\jre7\bin\jp2ssv.dll"

"C:\Program Files (x86)\Java\jre6\bin\ssv.dll"
"C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll"

"C:\Program Files (x86)\Java\jre7\bin\ssv.dll"
"C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll"

This could be performed in a computer startup script.

If you run this command manually, it must be done from an elevated command prompt.

icacls "C:\Program Files (x86)\Java\jre7\bin\ssv.dll"
C:\Program Files (x86)\Java\jre7\bin\ssv.dll NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

icacls "C:\Program Files (x86)\Java\jre7\bin\ssv.dll" /deny Everyone:(X)
processed file: C:\Program Files (x86)\Java\jre7\bin\ssv.dll
Successfully processed 1 files; Failed processing 0 files

icacls "C:\Program Files (x86)\Java\jre7\bin\ssv.dll"
C:\Program Files (x86)\Java\jre7\bin\ssv.dll
Everyone:(DENY)(S,X)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

share|improve this answer
    
is deleting it not easier? –  reinier Sep 29 '12 at 17:06
3  
What if a process replaced the files? This is not inconceivable, for example if an installer had the files on a manifest to determine relevancy. A script to remove the files may not be applied until the next restart. Applying the deny ACE works in most cases. –  Greg Askew Sep 29 '12 at 17:27
add comment

Starting from Oracle JDK/JRE 7u21 (Release Notes), a Server JRE is available which can serve such requirement.

A new Server JRE package, with tools commonly required for server deployments but without the Java plug-in, auto-update or installer found in the regular JRE package, is available starting from this release. The Server JRE is specifically targeted for deploying Java in server environments and is available for 64-bit Solaris, Windows and Linux platforms. For more information on installing this package, see Installation Instructions.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.