Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm setting up a Windows 2008 R2 terminal server which users will connect to from thin clients. Since the thin clients don't have a web browser I need to allow users to surf from their terminal session.

With security in mind what browser should I install for the users? Do I stick with IE9 or should I look at Firefox?

Also, with regards to the Flash player, should I avoid installing it and inform the users that due to security Flash sites will not work end of story?

share|improve this question

3 Answers

up vote 1 down vote

RDS is just an "exported display". You should allow exactly what you would allow the users to do if they could sit in front of the machine itself. The most important thing is to keep the browser (and the OS) always up to date. For that, I tend to prefer Chrome, which updates itself transparently and can often do so without requiring any browser restart.

I recommend avoiding Flash for a usability reason: Flash is used to animate things, and, as such, implies considerable data traffic between the computer and the display mechanism -- in your case, over the network which connects the thin clients with the base system. Playing a Flash-based video over RDP can be a frustrating experience (of course, if you use gigabit ethernet, this is not necessarily an issue).

share|improve this answer
+1 for no flash for usability! I've used such thin clients before and would sometimes come across a website with full window animated flash stuff...making the system unusable for a few minutes while I struggled to close the window. – Grant Aug 23 '12 at 14:02
Yep I've seen this happen during my testing, so flash will not be installed. – joshu Aug 23 '12 at 14:18
up vote 0 down vote

This may not be a answer a lot of people like but if you are worried about your users clicking bad links in their email, I would avoid firefox and stick with the newest IE or Chrome. Personally I use firefox and will never use chrome or IE, but firefox XSS protection is less than IE's or Chrome's....

With that said. Your overall security doesn't have much to do with the browser you force them to use....I would probably focus time on something else since your users will probably just install whichever one they want (assuming they can).

And about flash, sure can lead to additional vulnerabilities if your users are in the wrong place or click on the wrong link, but can you honestly say nobody at your company will ever need to load up a video from a talk/conference on youtube? I would leave it...it will just cause you a headache later.

share|improve this answer
The server will be locked down tight, so the users will only be allowed to use designated software and won't be allowed to install or run anything else. – joshu Aug 21 '12 at 13:45
Man. That sounds like torture. I would be a very dissatisfied employee. I recommend you allow them at least some choices...like browser. – Rell3oT Aug 21 '12 at 14:12
Actually the torture has been mine as I have been far too lenient until now allowing users to do as they please. The users are not computer savvy and are actually happy to hear that things are being re-done. Anyway my scenario is specific, so what sounds bad to you isn't how my users feel. We digress ;) – joshu Aug 21 '12 at 16:47
up vote 0 down vote

Stepping back to the root problem here, what are you using as the thin client and why not have the web browsing there?

For example, you can load something like Thin Station ( http://www.thinstation.org/ ) on commodity hardware or even dedicated thin clients via net booting. You can still connect to RDP.

The other possibility would be to disable the default local browser and use some type of sandbox (e.g., http://www.sandboxie.com/) for the only permitted web browsing. If you are giving end users full system access once they remote onto the server, they might be able to side step it, but through GPOs or third party tools you could lock it down. Ideally, you would only allow remote access to key apps which would be your target client apps and the web browser, single app RDP sessions is built in to Server 2008.

share|improve this answer
For only allowing remote apps you might consider RDP RemoteApp (en.wikipedia.org/wiki/Remote_Desktop_Services#RemoteApp). If they have functional desktop to remote from, you could try Application streaming (en.wikipedia.org/wiki/Microsoft_Application_Virtualization) – Eric G Aug 23 '12 at 2:40
I'm using Wyse S10 thin clients which don't have built-in web browsers. I did look at RDP RemoteApp, but to multitask between 5-10 apps would require 5-10 open RDP sessions per user. – joshu Aug 23 '12 at 8:10
Then you should go for no local admin permissions on the user and only permit running things like web browsers in a sandbox. Check with Wyse if you can do PXE boot, then you might be able to do the Thinstation option above. – Eric G Aug 23 '12 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.