## Guide to the Secure Configuration of Firefox

> with profile Mozilla Firefox STIG
> This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process, serving as the upstream development environment for the Firefox STIG. As a result of the upstream/downstream relationship between the SCAP Security Guide project and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content. For official DISA FSO STIG content, refer to https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security%2Cbrowser-guidance. While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note that commercial support of this SCAP content is NOT available. This profile is provided as example SCAP content with no endorsement for suitability or production readiness. Support for this profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The upstream project homepage is https://www.open-scap.org/security-policies/scap-security-guide/.

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide
This guide presents a catalog of security-relevant configuration settings for Firefox. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the `scap-security-guide` package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for Firefox, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

## Profile Information

Profile Title | Mozilla Firefox STIG
Profile ID | xccdf_org.ssgproject.content_profile_stig

#### CPE Platforms

- cpe:/a:mozilla:firefox

## Revision History

Current version: 0.1.79

- draft (as of 2025-12-05)

## Table of Contents

1. Firefox
   1. The DoD Root Certificate Is Required

## Checklist

Group Guide to the Secure Configuration of Firefox Group contains 2 groups and 34 rules
Group Firefox Group contains 1 group and 34 rules

[ref] Firefox is an open-source web browser and developed by Mozilla. Web browsers such as Firefox are used for a number of reasons. This section provides settings for configuring Firefox policies to meet compliance settings for Firefox running on Red Hat Enterprise Linux systems.

Refer to
- http://kb.mozillazine.org/Firefox_:_FAQs_:_About:config_Entries
for a list of currently supported Firefox settings.

Group The DoD Root Certificate Is Required Group contains 1 rule
[ref] The Shared System Certificates store contains certificates that applications can access for a single certificate repository. If enabled, Firefox can access that single system certificate repository. If the DoD root certificate is also installed into the shared system certificate repository, Firefox will see and use the DoD root certificate as a valid certificate authority.

#### Rule The DoD Root Certificate Exists [ref]

The DoD root certificate should be installed in the Shared System Certificates store for Firefox to be able to access the DoD certificate. To install the root certificated into the Shared System Certificates store, copy the DoD root certificate into `/etc/pki/ca-trust/source/anchors`. Once the file is copied, run the following command:

    $ sudo update-ca-trust extract

Rationale: | The DOD root certificate will ensure that the trust chain is established for server certificates issued from the DOD CA.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_preferences-dod_root_certificate_installed
Identifiers: | CCE-82056-3

References:

nist | IA-5 (2)
stigid | FFOX-00-000016

#### Rule Firefox must be configured to disable the installation of extensions. [ref]

Addon installation may be disabled in an administrative policy by setting the `InstallAddonsPermission` key under `policies` to `false`.

Rationale:

A browser extension is a program that has been installed into the browser to add functionality. Where a plug-in interacts only with a web page and usually a third-party external application (e.g., Flash, Adobe Reader), an extension interacts with the browser program itself. Extensions are not embedded in web pages and must be downloaded and installed in order to work. Extensions allow browsers to avoid restrictions that apply to web pages. For example, an extension can be written to combine data from multiple domains and present it when a certain page is accessed, which can be considered cross-site scripting. If a browser is configured to allow unrestricted use of extensions, plug-ins can be loaded and installed from malicious sources and used on the browser.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-addons_permission

References:

nist | CM-7
stigid | FFOX-00-000013

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'InstallAddonsPermission' in _tree['policies']:
       pass
    else:
       _tree['policies']['InstallAddonsPermission'] = dict()

    _tree['policies']['InstallAddonsPermission']['Default'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox autoplay must be disabled. [ref]

Audio/Video autoplay may be disabled in an administrative policy by setting the `Default` key under `Permissions`, `Autoplay` to `"block-audio-video"`.
Rationale: | Autoplay allows the user to control whether videos can play automatically (without user consent) with audio content. The user must be able to select content that is run within the browser window.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-autoplay_video

References:

nist | CM-7
stigid | FFOX-00-000021

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Permissions' in _tree['policies']:
       pass
    else:
       _tree['policies']['Permissions'] = dict()

    if 'Autoplay' in _tree['policies']['Permissions']:
       pass
    else:
       _tree['policies']['Permissions']['Autoplay'] = dict()

    _tree['policies']['Permissions']['Autoplay']['Default'] = 'block-audio-video'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enabled Firefox Cryptomining protection [ref]

Cryptomining protection may be enabled by setting `privacy.trackingprotection.cryptomining.enabled` to `true`.

Rationale:

The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists you set Firefox to use, then the fingerprinting script (or other tracking script/image) will not be loaded from that site. Cryptomining scripts use your computer’s central processing unit (CPU) to invisibly mine cryptocurrency.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-cryptomining

References:

nist | CM-7
stigid | FFOX-00-000024

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'EnableTrackingProtection' in _tree['policies']:
       pass
    else:
       _tree['policies']['EnableTrackingProtection'] = dict()

    _tree['policies']['EnableTrackingProtection']['Cryptomining'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable Firefox Development Tools [ref]

Firefox provides development tools which identify detailed information about the browser and its configuration. These details are often also recorded into a log file, giving an attacker the ability to capture detailed information about the system. This can be disabled by setting `DisableDeveloperTools` to `true` in `policies.json`
Rationale: | In order to protect privacy and sensitive data, Mozilla provides the ability to configure Firefox so that development tools are prevented from being used.
Severity: | low
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-development_tools

References:

nist | SI-11 b
stigid | FFOX-00-000015

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisableDeveloperTools'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable Firefox deprecated ciphers [ref]

Pocket may be disabled by setting `TLS_RSA_WITH_3DES_EDE_CBC_SHA` to `true` under `DisabledCiphers` in the policies file.
Rationale: | Weak ciphers are encryption/decryption algorithms that use keys of insufficient length. Using an insufficient length for a key increases the probability that the encryption scheme could be broken.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-disable_deprecated_ciphers

References:

nist | CM-7
stigid | FFOX-00-000027

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'DisabledCiphers' in _tree['policies']:
       pass
    else:
       _tree['policies']['DisabledCiphers'] = dict()

    _tree['policies']['DisabledCiphers']['TLS_RSA_WITH_3DES_EDE_CBC_SHA'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must be configured to disable form fill assistance. [ref]

The update check may be disabled in an administrative policy by setting the `DisableFormHistory` key under `policies` to `true`.
Rationale: | To protect privacy and sensitive data, Firefox provides the ability to configure the program so that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-disable_form_history

References:

nist | CM-7
stigid | FFOX-00-000007

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisableFormHistory'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable Firefox Pocket [ref]

Pocket may be disabled by setting `DisablePocket` to `true` in the policies file.
Rationale: | Pocket is a social bookmarking service for storing, sharing, and discovering web bookmarks. Data gathering cloud services such as Pocket are generally disabled in some organizations such as the DoD.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-disable_pocket

References:

nist | CM-7
stigid | FFOX-00-000038

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisablePocket'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable Firefox Studies [ref]

Pocket may be disabled by setting `DisableFirefoxStudies` to `true` in the policies file.
Rationale: | Studies try out different features and ideas prior to release to all Firefox users. Testing beta software is not in the profile user's mission.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-disable_studies

References:

nist | CM-7
stigid | FFOX-00-000039

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisableFirefoxStudies'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must be configured so that DNS over HTTPS is disabled. [ref]

DNS over HTTPS feature may be disabled via administrative policy by setting `Enabled` under `DNSOverHTTPS` to `false`.

Rationale:

DNS over HTTPS has generally not been adopted in the DoD. DNS is tightly controlled. It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-dns_over_https

References:

nist | CM-7
stigid | FFOX-00-000033

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'DNSOverHTTPS' in _tree['policies']:
       pass
    else:
       _tree['policies']['DNSOverHTTPS'] = dict()

    _tree['policies']['DNSOverHTTPS']['Enabled'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox encrypted media extensions must be disabled. [ref]

Firefox's Encrypted Media Extensions support playback of media content that is subject to Digital Right Management. These extensions may be disabled completely by setting

- `Enabled` under `EncryptedMediaExtensions` to `false`
- `Locked` under `EncryptedMediaExtensions` to `true`

.

Rationale:

Enable or disable Encrypted Media Extensions and optionally lock it. If "Enabled" is set to "false", Firefox does not download encrypted media extensions (such as Widevine) unless the user consents to installing them. If "Locked" is set to "true" and "Enabled" is set to "false", Firefox will not download encrypted media extensions (such as Widevine) or ask the user to install them. It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-encrypted_media_extensions

References:

nist | CM-7
stigid | FFOX-00-000037

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'EncryptedMediaExtensions' in _tree['policies']:
       pass
    else:
       _tree['policies']['EncryptedMediaExtensions'] = dict()

    _tree['policies']['EncryptedMediaExtensions']['Enabled'] = False

    if 'EncryptedMediaExtensions' in _tree['policies']:
       pass
    else:
       _tree['policies']['EncryptedMediaExtensions'] = dict()

    _tree['policies']['EncryptedMediaExtensions']['Locked'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enabled Firefox Enhanced Tracking Protection [ref]

Enhanced Tracking Protection may be enabled by setting `browser.contentblocking.category` to `strict`.
Rationale: | Tracking generally refers to content, cookies, or scripts that can collect your browsing data across multiple sites.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-enhanced_tracking

References:

nist | CM-7
stigid | FFOX-00-000025

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'browser.contentblocking.category' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['browser.contentblocking.category'] = dict()

    _tree['policies']['Preferences']['browser.contentblocking.category']['Value'] = 'strict'

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'browser.contentblocking.category' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['browser.contentblocking.category'] = dict()

    _tree['policies']['Preferences']['browser.contentblocking.category']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disabled Firefox Extension Recommendations [ref]

Extension recommendations may be disabled by setting `extensions.htmlaboutaddons.recommendations.enabled` to `false` in the policy file.
Rationale: | The Recommended Extensions program will make it easier for users to discover extensions that have been reviewed for security, functionality, and user experience.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-extension_recommendation

References:

nist | CM-7
stigid | FFOX-00-000026

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'extensions.htmlaboutaddons.recommendations.enabled' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['extensions.htmlaboutaddons.recommendations.enabled'] = dict()

    _tree['policies']['Preferences']['extensions.htmlaboutaddons.recommendations.enabled']['Value'] = False

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'extensions.htmlaboutaddons.recommendations.enabled' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['extensions.htmlaboutaddons.recommendations.enabled'] = dict()

    _tree['policies']['Preferences']['extensions.htmlaboutaddons.recommendations.enabled']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must be configured to not automatically update installed add-ons and plugins. [ref]

Firefox has a feature to permit installed add-ons and plugins to automatically update. The check may be disabled in an administrative policy by setting the `ExtensionUpdate` key under `policies` to `false`.
Rationale: | Automatic updates from untrusted sites puts the entire enclave at risk and may override existing security settings.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-extension_update

References:

nist | CM-7
stigid | FFOX-00-000005

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['ExtensionUpdate'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox feedback reporting must be disabled. [ref]

Feedback reporting feature may be disabled via administrative policy by setting `DisableFeedbackCommands` under `policies` to `true`.

Rationale:

Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-feedback_reporting

References:

nist | CM-7
stigid | FFOX-00-000036

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisableFeedbackCommands'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enabled Firefox Fingerprinting Protection [ref]

Fingerprinting protection may be enabled by setting `Fingerprinting` to `true` under `EnableTrackingProtection` in the policies file.

Rationale:

The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists you set Firefox to use, then the fingerprinting script (or other tracking script/image) will not be loaded from that site. Fingerprinting scripts collect information about your browser and device configuration, such as your operating system, screen resolution, and other settings. By compiling these pieces of data, fingerprinters create a unique profile of you that can be used to track you around the Web.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-fingerprinting_protection

References:

nist | CM-7
stigid | FFOX-00-000023

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'EnableTrackingProtection' in _tree['policies']:
       pass
    else:
       _tree['policies']['EnableTrackingProtection'] = dict()

    _tree['policies']['EnableTrackingProtection']['Fingerprinting'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must prevent the user from quickly deleting data. [ref]

The update check may be disabled in an administrative policy by setting the `DisableForgetButton` key under `policies` to `true`.
Rationale: | There should not be an option for a user to "forget" work they have done. This is required to meet non-repudiation controls.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-forget_button

References:

nist | AC-24(2)
stigid | FFOX-00-000018

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisableForgetButton'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable JavaScript's Raise Or Lower Windows Capability [ref]

JavaScript can configure and make changes to the web browser's appearance by specifically raising and lowering windows. This can be disabled by setting `dom.disable_window_flip` to `true` in the policy file.
Rationale: | JavaScript can make changes to the browser’s appearance. Allowing a website to use JavaScript to raise and lower browser windows may disguise an attack.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-javascript_window_changes

References:

nist | CM-7
stigid | FFOX-00-000011

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_flip' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_flip'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_flip']['Value'] = True

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_flip' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_flip'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_flip']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable JavaScript's Moving Or Resizing Windows Capability [ref]

JavaScript can configure and make changes to the web browser's appearance by specifically moving and resizing browser windows. This can be disabled by setting `dom.disable_window_move_resize` to `true` in the policy file.
Rationale: | JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-javascript_window_resizing

References:

nist | CM-7
stigid | FFOX-00-000010

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_move_resize' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_move_resize'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_move_resize']['Value'] = True

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_move_resize' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_move_resize'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_move_resize']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable Firefox network prediction [ref]

Firefox has a feature where it predicts and caches DNS requests. This can be disabled by setting `NetworkPrediction` to `true` in the policy file.
Rationale: | With network prediction enabled, URL requests are made without user consent. Browsers should always make a direct DNS request with prefetching.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-network_prediction

References:

nist | CM-7
stigid | FFOX-00-000022

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['NetworkPrediction'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must be configured to not delete data upon shutdown. [ref]

The default certificate to present may be configured by setting multiple options under `SanitizeOnShutdown` key.

- `Cache` = `false`

Rationale: | For diagnostic purposes, data must remain behind when the browser is closed. This is required to meet non-repudiation controls.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-no_sanitize_on_shutdown

References:

nist | CM-7 a
stigid | FFOX-00-000017

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['Cache'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['Cookies'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['Downloads'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['FormData'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['History'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['Sessions'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['SiteSettings'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['OfflineApps'] = False

    if 'SanitizeOnShutdown' in _tree['policies']:
       pass
    else:
       _tree['policies']['SanitizeOnShutdown'] = dict()

    _tree['policies']['SanitizeOnShutdown']['Locked'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule The Firefox New Tab page must not show Top Sites, Sponsored Top sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets. [ref]

Display of top sites may be disabled in an administrative policy by setting the following items under `FirefoxHome` to `false` and by setting the `locked` key to `true`. `Search` `TopSites` `SponsoredTopSites` `Pocket` `SponsoredPocket` `Highlights` `Snippets`

Rationale:

The New Tab page by default shows a list of built-in top sites, as well as the top sites the user has visited. It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled. The new tab page must not actively show user activity.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-nonessential_capabilities

References:

nist | CM-7
stigid | FFOX-00-000029

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['Search'] = False

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['TopSites'] = False

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['SponsoredTopSites'] = False

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['Pocket'] = False

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['SponsoredPocket'] = False

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['Highlights'] = False

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['Snippets'] = False

    if 'FirefoxHome' in _tree['policies']:
       pass
    else:
       _tree['policies']['FirefoxHome'] = dict()

    _tree['policies']['FirefoxHome']['locked'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must be configured to not use a password store with or without a master password. [ref]

The update check may be disabled in an administrative policy by setting the `PasswordManager` key under `policies` to `false`.
Rationale: | Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate PIN, which could lead to compromise of information.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-password_manager

References:

nist | CM-7
stigid | FFOX-00-000008

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['PasswordManagerEnabled'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enable Firefox Pop-up Blocker [ref]

The pop-up blocker can be enabled by setting `Default` key under `PopupBlocking` to `true` in `policies.json`. `Allowed` may be set to a list of sites allowed to use popups.
Rationale: | Popup windows may be used to launch an attack within a new browser window with altered settings.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-pop-up_windows

References:

nist | CM-7
stigid | FFOX-00-000009

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'PopupBlocking' in _tree['policies']:
       pass
    else:
       _tree['policies']['PopupBlocking'] = dict()

    _tree['policies']['PopupBlocking']['Default'] = True

    if 'PopupBlocking' in _tree['policies']:
       pass
    else:
       _tree['policies']['PopupBlocking'] = dict()

    _tree['policies']['PopupBlocking']['Locked'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox private browsing must be disabled. [ref]

Private browsing may be disabled in an administrative policy by setting the `DisablePrivateBrowsing` key under `policies` to `true`.
Rationale: | Private browsing allows the user to browse the internet without recording their browsing history/activity. From a forensics perspective, this is unacceptable. Best practice requires that browser history is retained.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-private_browsing

References:

nist | CM-7
stigid | FFOX-00-000019

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisablePrivateBrowsing'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox search suggestions must be disabled. [ref]

Search Suggestions may be disabled in an administrative policy by setting the `SearchSuggestEnabled` key under `policies` to `false`.
Rationale: | Search suggestions must be disabled as this could lead to searches being conducted that were never intended to be made.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-search_suggestion

References:

nist | CM-7
stigid | FFOX-00-000020

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['SearchSuggestEnabled'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable Installed Search Plugins Update Checking [ref]

Firefox automatically checks for updated versions of search plugins. To disable the automatic updates of plugins, set value of `browser.search.update` to `false` via policies.json.
Rationale: | Updates need to be controlled and installed from authorized and trusted servers. This setting overrides a number of other settings which may direct the application to access external URLs.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-search_update

References:

nist | CM-7
stigid | FFOX-00-000004

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'browser.search.update' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['browser.search.update'] = dict()

    _tree['policies']['Preferences']['browser.search.update']['Value'] = False

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'browser.search.update' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['browser.search.update'] = dict()

    _tree['policies']['Preferences']['browser.search.update']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must be configured to allow only TLS 1.2 or above. [ref]

Firefox may be configured via administrative policy to allow TLS 1.2 at minimum by setting `SSLVersionMin` to `tls1.2`.
Rationale: | Use of versions prior to TLS 1.2 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-ssl_minimum_version

References:

nist | AC-17 (2)
stigid | FFOX-00-000002

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['SSLVersionMin'] = 'tls1.2'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox accounts must be disabled. [ref]

Firefox accounts feature may be disabled via administrative policy by setting `DisableFirefoxAccounts` under `policies` to `true`.

Rationale:

Disable Firefox Accounts integration (Sync). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-sync

References:

nist | CM-7
stigid | FFOX-00-000034

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisableFirefoxAccounts'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable Firefox Telemetry [ref]

Telemetry can be disabled by setting `toolkit.telemetry.enabled` to `false`.
Rationale: | The Telemetry feature provides this capability by sending performance and usage info to Mozilla. As you use Firefox, Telemetry measures and collects non-personal information, such as performance, hardware, usage and customizations. It then sends this information to Mozilla on a daily basis and we use it to improve Firefox
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-telemetry

References:

nist | CM-7
stigid | FFOX-00-000014

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['DisableTelemetry'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must not recommend extensions as the user is using the browser. [ref]

The extension recommendation messages may be disabled in an administrative policy by setting the `ExtensionRecommendations` key under `UserMessaging` to `false`.
Rationale: | The Recommended Extensions program recommends extensions to users as they surf the web. The user must not be encouraged to install extensions from the websites they visit. Allowed extensions are to be centrally managed.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-user_messaging

References:

nist | CM-7
stigid | FFOX-00-000028

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'UserMessaging' in _tree['policies']:
       pass
    else:
       _tree['policies']['UserMessaging'] = dict()

    _tree['policies']['UserMessaging']['ExtensionRecommendations'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enable Certificate Verification [ref]

Firefox can be configured to prompt the user to choose a certificate to present to a website when asked. To enable certificate verification, set `security.default_personal_cert` to `Ask Every Time` in an administrative policies file
Rationale: | Websites within the organization require user authentication for access which increases security for the information within. Access will be denied to the user if certificate management is not configured.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-verification

References:

nist | IA-5(2)
stigid | FFOX-00-000003

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'security.default_personal_cert' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['security.default_personal_cert'] = dict()

    _tree['policies']['Preferences']['security.default_personal_cert']['Value'] = 'Ask Every Time'

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'security.default_personal_cert' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['security.default_personal_cert'] = dict()

    _tree['policies']['Preferences']['security.default_personal_cert']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable auto-download for proscribed MIME types. [ref]

Firefox must be configured to not automatically execute or download MIME types that are not authorized for auto-download.
Rationale: | This setting ensures that some file types that may be downloaded or executed without user interaction are not downloaded and/or executed.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions

References:

nist | SI-3 c
stigid | FFOX-00-000006

#### Rule Supported Version of Firefox Installed [ref]

If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates:

    $ sudo yum update

If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded and installed using `rpm`.

Rationale: | Use of versions of an application which are not supported by the vendor are not permitted. Vendors respond to security flaws with updates and patches. These updates are not available for unsupported version which can leave the application vulnerable to attack.
Severity: | high
Rule ID: | xccdf_org.ssgproject.content_rule_installed_firefox_version_supported

References:

nist | SA-22
stigid | FFOX-00-000001

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.