X-Git-Url: https://git.p6c8.net/policy-templates.git/blobdiff_plain/b535ad059b3465e029cff46ad170b7f958cf79b4..426f88e4358468dbaa352171dbc1ff4ff336771f:/README.md diff --git a/README.md b/README.md index 490bb5a..089b93c 100644 --- a/README.md +++ b/README.md @@ -6,8 +6,9 @@ Policies can be specified using the Group Policy templates on Windows (https://g | Policy Name | Description | --- | --- | -| **[`AppUpdateURL`](#AppUpdateURL)** | Change the URL for application update. -| **[`Authentication`](#Authentication)** | Configure sites that support integrated authentication. +| **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update. +| **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update. +| **[`Authentication`](#authentication)** | Configure sites that support integrated authentication. | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons). | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config. | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles). @@ -22,6 +23,8 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality. | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates. | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer. +| **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers. +| **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only). | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools. | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites. | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots. @@ -31,6 +34,7 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar. | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI. | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing. +| **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins. | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window. | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser. @@ -86,6 +90,39 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user. | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited. +### AppAutoUpdate + +Enable or disable **automatic** application update. + +If set to true, application updates are installed without user approval. + +If set to false, application updates are downloaded but the user can choose when to install the update. + +If you have disabled updates via DisableAppUpdate, this policy has no effect. + +**Compatibility:** Firefox 75, Firefox ESR 68.7\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** app.update.auto + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0 +``` +#### macOS +``` + + AppAutoUpdate + | + +``` +#### policies.json +``` +{ + "policies": { + "AppAutoUpdate": true | false + } +} +``` ### AppUpdateURL Change the URL for application update. @@ -654,6 +691,89 @@ Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0 } } ``` +### DisabledCiphers +Disable specific cryptographic ciphers. + +**Compatibility:** Firefox 68.8, Firefox ESR 76\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0 +``` +#### macOS +``` + + DisabledCiphers + + TLS_DHE_RSA_WITH_AES_128_CBC_SHA + | + TLS_DHE_RSA_WITH_AES_256_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | + TLS_RSA_WITH_AES_128_CBC_SHA + | + TLS_RSA_WITH_AES_256_CBC_SHA + | + TLS_RSA_WITH_3DES_EDE_CBC_SHA + | + + +``` +#### policies.json +``` +{ + "policies": { + "DisabledCiphers" { + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true | false, + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true | false, + "TLS_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false + } + } +} +``` +### DisableDefaultBrowserAgent +Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent. + +**Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0 +``` + +#### policies.json +``` +{ + "policies": { + "DisableDefaultBrowserAgent": true | false + } +} +``` ### DisableDeveloperTools Remove access to all developer tools. @@ -1183,7 +1303,9 @@ Configure DNS over HTTPS. `Locked` prevents the user from changing DNS over HTTPS preferences. -**Compatibility:** Firefox 63, Firefox ESR 68\ +`ExcludedDomains` excludes domains from DNS over HTTPS. + +**Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7)\ **CCK2 Equivalent:** N/A\ **Preferences Affected:** `network.trr.mode`,`network.trr.uri` @@ -1192,6 +1314,7 @@ Configure DNS over HTTPS. Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER" Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com" ``` #### macOS ``` @@ -1204,6 +1327,10 @@ Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0 URL_TO_ALTERNATE_PROVIDER Locked | + ExcludedDomains + + example.com + ``` @@ -1214,7 +1341,8 @@ Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0 "DNSOverHTTPS": { "Enabled": true | false, "ProviderURL": "URL_TO_ALTERNATE_PROVIDER", - "Locked": true | false + "Locked": true | false, + "ExcludedDomains": ["example.com"] } } } @@ -2053,9 +2181,11 @@ Set permissions associated with camera, microphone, location, notifications, and `Locked` prevents the user from changing preferences for the feature. -**Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6\ +`Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68. + +**Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8)\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `permissions.default.camera`,`permissions.default.microphone`,`permissions.default.geo`,`permissions.default.desktop-notification` +**Preferences Affected:** `permissions.default.camera`,`permissions.default.microphone`,`permissions.default.geo`,`permissions.default.desktop-notification`,`media.autoplay.default` #### Windows (GPO) ``` @@ -2078,6 +2208,8 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org" Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu" +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video" +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0 ``` #### macOS ``` @@ -2096,9 +2228,9 @@ Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://exampl https://example.edu BlockNewRequests - + | Locked - + | Microphone @@ -2111,9 +2243,9 @@ Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://exampl https://example.edu BlockNewRequests - + | Locked - + | Location @@ -2126,9 +2258,9 @@ Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://exampl https://example.edu BlockNewRequests - + | Locked - + | Notifications @@ -2155,6 +2287,10 @@ Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://exampl https://example.edu + Default + allow-audio-video | block-audio | block-audio-video + Locked + | @@ -2190,7 +2326,9 @@ Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://exampl }, "Autoplay": { "Allow": ["https://example.org"], - "Block": ["https://example.edu"] + "Block": ["https://example.edu"], + "Default": "allow-audio-video" | "block-audio" | "block-audio-video", + "Locked": true | false } } } @@ -2257,7 +2395,7 @@ Set and lock certain preferences. | --- | --- | --- | --- | accessibility.force_disabled | integer | Firefox 70, Firefox ESR 68.2 | 0 |     If set to 1, platform accessibility is disabled. -| app.update.auto | boolean | Firefox 68, Firefox ESR 68 | true +| app.update.auto (Deprecated - Switch to AppAutoUpdate policy) | boolean | Firefox 68, Firefox ESR 68 | true |     If false, Firefox doesn't automatically install update. | browser.bookmarks.autoExportHTML | boolean | Firefox 70, Firefox ESR 68.2 | false |     If true, bookmarks are exported on shutdown. @@ -2344,7 +2482,7 @@ disabled |     If set to Select Automatically, Firefox automatically chooses the default personal certificate. | security.mixed_content.block_active_content | boolean | Firefox 70, Firefox ESR 68.2 | true |     If false, mixed active content (HTTP and HTTPS) is not blocked. -| security.osclientcerts.autoload | boolean | Firefox 72, Firefox ESR 68.4 (Windows only) | false +| security.osclientcerts.autoload | boolean | Firefox 72 (Windows), Firefox 75 (macOS) | false |     If true, client certificates are loaded from the operating system certificate store. | security.ssl.errorReporting.enabled | boolean | Firefox 68, Firefox ESR 68 | true |     If false, SSL errors cannot be sent to Mozilla. @@ -2559,6 +2697,8 @@ or } } ``` + + ### SanitizeOnShutdown (Selective) Clear data on shutdown. Choose from Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences and Offline Website Data. @@ -2675,10 +2815,7 @@ Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate" } } ``` - - - - + ### SearchEngines (This policy is only available on the ESR.)