One of our execs got the idea that putting a public access computer in our lobby for internet access was a great idea, even though i told him it was stupid and a huge security risk. So I'm looking for a little help on securing this box. What I would like to do is make it so the only thing that they can do is visit web sites. I can lock down the machine, and the desktop and all that with server based policies, i will just drop that box in its own AD container and lock it down so they cant actually do anything on the desktop, basically they will only have a shutdown button. What I am worried about is someone doing a \\servername\share on that machine even though they wont be able to get into anything since the account that auto logs in on it will have no rights to anything on the network. I guess what I am asking is if i can make it so IE just says hi get bent if they try to go to anything that isnt a http:// or https:// and any other tips for securing this type of machine. If there is 3rd party software that does this sort of thing i would be interested in that also. The box itself is in a locked cage, the worst someone could do is pull cables out of it. I will also set this machine up on our firewall to only allow sites safe for 3 yr olds, so i am not worried about porn, and of course there is NAV corp edition for viruses and adaware corp edition and pop up blockers so i am not so concerned about that sort of thing.
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Locking down IE or other browswer options
- Thread starter Tink
- Start date
mikey71497
Limp Gawd
- Joined
- Sep 27, 2004
- Messages
- 215
why not hang this box off of your network, on its own subnet, and make it sit behind a linksys, or other brand router/firewall. Lock down the router, and there you go. A machine on its own network, and locked down. Also, make sure you disable downloading from IE. Also, about the \\servername......disable the "run" command from start menu. Lock the machine down tight. Diable network neighborhood, and my computer. Also disable right clicking to get into WIN explorer.
I had thought about putting it on its own locked down network segment by just getting another nic for our Cisco PIX box, then setting up the ACL to not allow any traffic from say 10.0.50.x to reach our real network, i thought there might be an easier way. And if I have to access the real network on this box as me that becomes a pain in the butt swapping patch cables or physically moving the box onto the real network or changing ACL's. I was hoping there might be a software solution so if I did log into this machine as admin equiv then i could get what i needed.
If i go that route, then I still need to lock down IE with some software and it wont be in the domain so i will need to configure policies locally on the machine.
If i go that route, then I still need to lock down IE with some software and it wont be in the domain so i will need to configure policies locally on the machine.
