0

When setting up a Kiosk network, one that you're using so that people can access a single website, shouldn't you use a proxy server that uses Squid or Squid Guard (or some sort of proxy) to limit the sites they're able to visit?

Someone showed me on a network using a Google Chrome Kiosk that they were able to press F1, search for the name of their website in the resulting Google Chrome help website, and then click the Google Web Search link and the website they were trying to visit came up, even though google chrome was being run in Kiosk Mode

leeand00
  • 1,431
  • 1
  • 14
  • 22
  • Kiosks are hard to fully lock down with group policy. A proxy is a good idea. If that's not possible, I've also seen this done with a PAC file. – paj28 Jul 29 '16 at 20:35
  • @paj28 yeah but I don't think you'd want to NOT lock them down with Group Policy or without utilizing some other sort of feature minimizing THING on the OS end. They could cause just as much trouble inside the network with the other Kiosk users, even with a proxy server. Also locking down physical access to the systems wouldn't hurt either. – leeand00 Jul 29 '16 at 20:39
  • And let's not forget what they can do if they find the ability to spoof a MAC. – leeand00 Jul 29 '16 at 20:41
  • @paj28 As for PAC files... But note that proxy.pac files work at the level of hostnames and not IP address, so it does not protect against external sites returning local IP addresses (i.e. attacker.example.com claiming to be at 127.0.0.1), see here: http://security.stackexchange.com/a/106947/6103 – leeand00 Jul 29 '16 at 20:45
  • Sure, use group policy as well - defence in depth is good. PACs using host names shouldn't be a problem - a random person wouldn't be able to control the DNS for the single website that you allow. – paj28 Jul 29 '16 at 20:51
  • I usually recommend locking things like this down with network constraints. If you design the network to prevent them from getting out, it can succeed in all these cases. – MAP Jul 30 '16 at 02:39

0 Answers0