Slashdot Mirror
Stopping Adware and Spyware on Windows w/ Citrix?
SilverDivan asks: "A fairly large non-profit charity organization recently asked me how they can permanently take care of the spyware and adware problem that is plaguing their computing environment. I told them to simply use Mozilla/FireFox, but as it turns out they access outside applications that only run in Internet Explorer. So, I am planning to make a recommendation to publish Internet Explorer on a Citrix Farm, and let the users use the IE published on Citrix instead of the locally installed IE This way they can lock down the IE to their heart's desire. Also publishing IE 'anonymously' on Citrix will further secure the environment, as the anonymous profiles can be deleted on a nightly basis. However one issue with 'anonymous' access to Citrix applications, is that the user can not maintain their preference or even their bookmarks. Another issue is that there is no tracking, and no way to hold someone accountable in case of abuse. Has anyone implemented a similar solution before? What was your experience? Will it work? How can you configure the Citrix environment to best handle a situation like this?"
You could always run Win4Lin Terminal Services. Then you could run a linux server farm and still let users run their windows desktops. Then you could let them do what ever they want.
:)
Once you remove Microsoft from the important job, it gets pretty easy
"A synonym is a word you use when you can't spell the word you first thought of." - Burt Bacharach
Make them use Firefox with this extension. Then they only use IE for the sites that require it. Those, one would hope, should be reasonably safe.
When will Windows be ready for the desktop?
If they need to surf with no limits, put-up a Squid caching proxy and let them use Firefox.
Yeah, I know, I read the article. So let them run IE under the Win$lin TS. What is the worst that could happen that particular users windows session needs to be restored. under win4lin that would take all of a couple minutes. And if you did a nightly back up of their bookmarks and userfiles, you could restore them too.
I fail to see the problem here.
"A synonym is a word you use when you can't spell the word you first thought of." - Burt Bacharach
theres dozens of ways to maintain bookmarks.
offer them a customisiable startpage or something for instance.
world was created 5 seconds before this post as it is.
Set them up with del.icio.us accounts for their bookmarks, then have a bookmark for del.icio.us in the default profile.
About writing IE only applications. It's the web, for heaven's sake - the idea is that it's not supposed to depend upon any given application.
My bet is the outside sites they access only say they require IE. Try changing the user agent string in firefox so it looks like IE (with prefbar extension for example), and the sites will likely work just fine. It's worth trying anyway.
I told them to simply use Mozilla/FireFox, but as it turns out they access outside applications that only run in Internet Explorer.
Maybe this is an obvious question, but have they actually tested these applications on FF or Opera? I'm sure that somone in the company has told them that they only work on IE, but it seems quite possible that FF would handle them just fine.
Guys who design for IE generally don't have clue about other options.
Three Squirrels
Use profiles, store the bookmarks elsewhere on a file server. You can then set the rights to stuff accordingly, and backup stuff regularly.
Better if you run the IE as a different user. e.g. normal user account = John_Doe. normal user's IE account = John_Doe-IE.
Then allow John_Doe to have access to John_Doe-IE's files, but not vice-versa.
For "internet zone", turn off everything, including activeX.
For your "access outside applications that only run in Internet Explorer" but them in the trusted sites, and nothing else.
Install firefox and let them use that for the "intar web".
Please let me know where I can send the bill.
There was a way to open a link in a new window without displaying the window's address bar. Couple that with putting up a link like so:
iexplore.exe http://site.com
And removing all links to iexplore.exe elsewhere...
And a better example:
enforce proxy servers (setup as admin in win2k, and leave the users unprivileged), setup a squid proxy server that only allows the site, and do not setup any proxies for firefox...
How about this one:
Hack a spyware and find out how they redirect people's URLs. use that and infect your own machines, so any address in IE takes them to that website. Use firefox for everywhere else.
And make sure you disable activex!!!
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
Can't they just "lock down IE to their heart's content" via Group Policy? Or perhaps an outbound proxy that only allows access to the specified pages when the user agent is IE's?
Citrix seems like a little overkill for this problem.
NO CARRIER
I know of a guy who works in a real estate office, who has to access everything through citrix. All employees have individual logins, and are able to maintain their own preferences, email, and other stuff.
I used a similar setup where I work. We set up a win2k server box with terminal services (essentially citrix), so we could keep one stable desktop while we were constantly messing with our own desktops (or like in my case, I was using unix with rdesktop client).
Managing virus and malware on one common server would be preferable I think. The only issue you might face could be licensing costs, especially if you went the multi-user route.
_______
2B1ASK1
If they are serious about going the Citrix/Terminal Services route, you might consider moving all of their applications to the server and migrating them to cheap thin clients on their desktop. From an administration perspective, managing the machines becomes a lot easier. They can't install anything on their local machines. Most don't need to have access to install anything to the server. No virus software needed for the clients. Actually, no client management at all. If one breaks, you just replace it because their customizations are all on the server. And while you might stretch a PC to 5 years, the only limitation on a thin client will be the display resolution.
The only drawback is political. You have to manage user egos when they find they can't do whatever they want with 'their' PC anymore.
Windows is like a high maintenance wife. Everything is nice to look at, but it cleans out your wallet and there is a lot of down time.
It is amazing what you can accomplish if you do not care who gets the credit. -- Harry Truman
Maybe this is too simple and obvious, but how about, Don't go to websites that install spuware/adware!!
Where I work (US Air Force), this type of policy has not created any problems at all, and for the most part has prevented any significant invasion of spyware in the 5 years I've been at this facility. Why build some expensive and unnecessary additional infrastructure to solve a problem that can be controlled with permissions?
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Maybe something like Deep Freeze would solve your problem.
Each restart eradicates all changes and resets the computer to its original state, right down to the last byte.
There'd still be risks during a session of course. Then again, most of the truly evil stuff I see doesn't turn up until after the system has been rebooted and all the user-installed trash in registry gets launched.
Whoever designed level 61 in Frozen Bubble is a sadistic bastard.
They are all half assed patches. I find, time and time again, that it is better, faster, and cheaper to remove the dependency on IE - like, re-write the app or use a vendor that actually supports decent, secure software.
Citrix?!? Just to run Internet Explorer?!? Absolute rubbish. Fix the real issue instead just doing a half assed patchjob like that. What's wrong with you whippersnappers....
People who think they know everything are a great annoyance to those of us who do.
Deploying Citrix to an organization of the size you imply would be a HUGE expense. Doing so for a single application is absurd. If this charity is as big as you say, let them use their clout to have the IE sites updated.
At one point in May-ish, with a fresh install, I brought everything up to date, set the security settings, but forgot to trash MS's Javascript .. and promptly picked up a bad case of CoolWeb. With the change, I was CoolWeb-immune. I forget Sun's URL for it, but installing Robocode is always a good start and a fun learning game!
One line blog. I hear that they're called Twitters now.
Hehe. I am betting that the outside app. relies on ActiveX. Which would explane might acount for more spyware getting loaded up. ActiveX would be the only real show stoper for going with Mozilla/FireFox, as others have pointed out.
Quite simple. Firstly you give your users Firefox to stop the spyware problem.
Now, for the external IE only applications, you create them as applications in Citrix and give each an icon on the user's desktop. If the user wants to use one of the external apps, they click the app icon which will launch a Citrix'ified IE window with the app in it. Obviously configure the Citrix IE to remove the address bar.
Let me preface this by saying that I'm not a Citrix administrator or a web site administrator, but here's two things that might make this simpler on many of the fronts you listed.
1. Make a custom home page for IE on the Citrix Server. Include links to where they enter all these custom IE applications so they can get to them in one click after starting IE.
2. Optional. Disable pretty much every domain but the ones these custom apps are on. A thorough test should verify if they will (currently) work in that configuration.
This might be a better option than using the anonymous option in Citrix, which will mean that they can still use bookmarks (but to what?) and preferences (good for all those passwords), and you will have abuse-tracking logs.
Sure I'm paranoid, but am I paranoid enough?
If it is a significant problem, they will be interested enough to learn how to avoid it. If it is not a big deal, they are not going to care. If you can't educate their users to avoid this problem, either your a bad teacher, or they don't really care about avoiding it. If their management is asking you to fix the problem, tell their management to point out the simple fact that these things are easily avoided. The answer is NOT always technical guys. Sometimes it is social. If you treat them like a bunch of monkeys banging on the keyboard, they are going to act that way. There will never be enough options in the world to lock everything down. If they can drive a car to work, they can avoid spyware on the internet. There will be mistakes, insurance will always be necessary, but for the most part education is the way.
You do not have to use anonymous access to get to the server. Mandatory profiles may do the trick as well. That way they can use their normal user IDs to log in, but still get a clean copy of the profile every time. You can also set where bookmarks are stored using group policy or the IEAK so they can keep some degree of personal settings. You could either redirect it to a network share or back to the user's local computer.
Trend Micro makes IWSS, which is a proxy that has built in anti-virus, including filtering out assorted spyware/malware.
I can't recommend the product too highly, it seems somewhat immature, though it does block the spyware/adware as advertised.
Why not install a content filtering system such as Webmarshal or another inbound web filtering program.
Use group policies to force the use of a proxy and make this machine the proxy machine.
Then you set the rules on the WebMarshal box to what you want. You can install a virus scanner and such.
I use webmarshal in my enviroment, and whilst its not the greatest. (It IS a big brother monitoring device), it keeps my systems clean and protected from viruses and trojans and other illicit content that enters a company through the web.
The cost of hardware and software is probably similar to or significantly less than the cost of a citrix server and licenses.
I hate suggesting things that support continued use of IE but since we are talking charity here it is:
You can probably wrap the browser session with a frame navigator (like ask jeeves...) where the controlling frame has all the navigation buttons and necessary menu items and even an address bar. When the browser starts up, hide all top menus and only show the buttons and menus you want them to see via DHTML. You could even create a bookmark based system using DHTML and some simple server side storage. The only difficulty is that you would need to put an authentication layer to resolve the current user although there may be a way to resolve this with an active-x plugin or even native.
Although you are looking at a bit of coding here, I know that you could use a citrix frame to navigate any IE based site in this way.
Good luck.
JsD
Since the "IE-only" sites are presumably known, set up a sqid proxy that only allows access to those specific sites. Set everyones IE to use the proxy server.
Then to allow access to the wider internet, set up firefox w/out a proxy, or (more secure) firewall off ports 80 and 443 and proxy firefox through a different squid server which allows more-or-less open access.
Note that it's virtually impossible to 'lock down' IE under citrix since you can hit the 'help' menu which has a link to 'web help' which gives you... -- try it and you'll see what I mean. All citrix would do for you is to crap out their entire iE install in one go when there's a problem.
"But actually trying to use m4 as a general-purpose langage would be deeply perverse" --ESR
Seriously, IE does have some security features, the default setup is abysmal, but you can tweak-up the security for the whole world, and put the outside app into the 'trusted sites' zone. Problem solved. I've done it and it works.
BTW, you still have to keep your boxes patched, but that's a no-brainer anyway.
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails
You seemed to have missed the "take your business to a vendor that has a clue" part.
I work for the local school district's IT department and we use Deep Freeze in all of our labs. What can I say, it's great.
We use the Professional version. This allows the computer to maintain itself. The computers are set to shutdown each night at 4:30 except Friday. On Friday at 5:00, Deep Freeze turns itself off and locks the keyboard and mouse. Windows updates are performed, virus defs updated, and hard drive defragmented. Sure since Deep Freeze is installed we don't need to do all of this but we do just to be safe.
Windows is like a high maintenance wife. Everything is nice to look at, but it cleans out your wallet and there is a lot of down time.
I don't know about you, dude, but I'd be a happy man if my girlfriend went down as much as my Windows install does.
Dealing with lawyers would be a lot less tedious if they all looked like Casey Novak.