How to block Mozilla browser

[Prometejas]

Hi everyone, How I can disable Mozilla and Opera browsers usage? Custom signature? The idea is that in IE I disable proxy window from AD, bus users with user rights (???) can install Opera or Mozilla in own profile and can set up proxy servers. It cause that they can browse everywhere without surf protection. Thanx in advice! Prometejas

[#2]

You can' t. You could block based on the host-agent field, but even that' s changable. Technology doesn' t solve everything. Get management backing, and tell people if you find Mozilla on their desktop, then they' re fired.

[#3]

Another idea is simply to not allow users (assuming that you' re using WinXP) to be local administrators of their computers. That way, they are prevent from installing any software that you don' t want them to.

[Prometejas]

The problems is that Pc users with USER RIGHTS (!!!) still can install Opera or Mozilla in own profile, i.e. My Documents. In other hand they copy-paste files and http client works! How other systems recognizing it?

[#5]

Make your users Limited Accounts. Some programs won' t run correctly under limited accounts, but if they run well under admin accounts, permissions on the Program Files folder and registry hives can be changed to allow Limited Accounts to write to these. Here' s another idea: http://www.winability.com/folderguard/restrict-downloads-ie.htm

[#6]

I' m maybe wrong, but I think you didn' t choose the appropriate solution to block surfing. If I understand your config, you disable the internet access simply by browser proxy configuration. This is a poor locking system. IMHO It is more effective to allow only certain machine or user to access your proxy. For machine access control: e.g. you can fix the IP address of allowed machine and ensure that others cannot change their IP. After that, you can allow these machines by writing a firewall policy or probably on your proxy. Some proxies can even allow access based on MAC addresses. Ok, there are some tools to fake MAC, but I don' t think a simple " user" can do it. User access: e.g. you can write a policy on your fortigate asking authentication to access the proxy or some proxies can do authentication. The best is to combine both solution. HTH, Buzzy

[Prometejas]

Hello buzzy, You don' t understand me correctly. All my users are going through transparent proxu with content filtering. But using Opera the manually can set new proxy: Users PC ----> My proxy -----> Other Proxy Using this scheme they are bypassing my proxy content filtering - that' s the problem!

[#8]

Hi Prometejas, Ok, if I understand you, yours users use external proxies (not from your company) I suggest 2 solutions: 1) I understand that you use the FG as a transparent proxy and use its' content filtering. If you don' t, and you have a proxy device, set explicit proxy => require a proxy setting in your browser config and deny all internet accesses except for the proxy. That' s what we do in our company. 2) write an IPS rule to drop attempts to reach proxies of the intenet, it will more efficient than trying to block a specific browser. User ca change easily their " User-Agent" , but they probably do not have de knowlede to change the " Proxy-Connection" header send when a browser try to connect to a proxy server. Here is a snort rule to do it, you have to write it using the Fortinet syntax and apply it for all port not only 80. You can look at my previous post to help you (http://support.fortinet.com/forum/tm.asp?m=14492&p=1&tmode=1&smode=1) alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:" BLEEDING-EDGE Policy Proxy Connection detected" ; flow:established; content:" Proxy-Connection" ; classtype:attempted-user; sid:2001449; rev:1;) OTH, Buzzy

[Prometejas]

Thanx, buzzy, for answer. But there is one problem - we are using internal transparent proxy with content filtering (not FG CF!). We have proxy on one FG dmz zone and all users are going through this proxy. I' ll write IPS custom signature " Drop session" for rule Proxy_interface --> internet: F-SBID( --protocol tcp; --revision 1; --content " Proxy-connection" ; --no_case; --name " KillProxyConnection" ;) It doesn' t work. Help me!

[#10]

What doesn' t work ? Writing the rule ? Detection ? By the way, in your rule I would add: " --flow from_client,established;"