0

When setting up a Kiosk network, one that you're using so that people can access a single website, shouldn't you use a proxy server that uses Squid or Squid Guard (or some sort of proxy) to limit the sites they're able to visit?

Someone showed me on a network using a Google Chrome Kiosk that they were able to press F1, search for the name of their website in the resulting Google Chrome help website, and then click the Google Web Search link and the website they were trying to visit came up, even though google chrome was being run in Kiosk Mode

Improve this question
6
  • Kiosks are hard to fully lock down with group policy. A proxy is a good idea. If that's not possible, I've also seen this done with a PAC file.
    – paj28
    Jul 29, 2016 at 20:35
  • @paj28 yeah but I don't think you'd want to NOT lock them down with Group Policy or without utilizing some other sort of feature minimizing THING on the OS end. They could cause just as much trouble inside the network with the other Kiosk users, even with a proxy server. Also locking down physical access to the systems wouldn't hurt either.
    – leeand00
    Jul 29, 2016 at 20:39
  • And let's not forget what they can do if they find the ability to spoof a MAC.
    – leeand00
    Jul 29, 2016 at 20:41
  • @paj28 As for PAC files... But note that proxy.pac files work at the level of hostnames and not IP address, so it does not protect against external sites returning local IP addresses (i.e. attacker.example.com claiming to be at 127.0.0.1), see here: security.stackexchange.com/a/106947/6103
    – leeand00
    Jul 29, 2016 at 20:45
  • Sure, use group policy as well - defence in depth is good. PACs using host names shouldn't be a problem - a random person wouldn't be able to control the DNS for the single website that you allow.
    – paj28
    Jul 29, 2016 at 20:51

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .