I do this on Scientific Linux 6.3 (to implement it, it requires a minimal Linux knowledge): Shared directory for downloadsRemember you can only copy from or to this directory, never move files to here or move files from here!adduser ffuserpasswd ffuser # use a very good and very long passwordgroupadd ffgroupvi /etc/group # add ffuser and the normal user to the end of the ffgroup line. after editing a users group, you need to re-login with it..mkdir /home/Downloads; chmod -R 2770 /home/Downloads; ln -s /home/Downloads /home/NORMALUSERHERE/Desktop/Downloads; chown ffuser:ffgroup /home/Downloads/echo umask 007 >> /home/ffuser/.bashrcssh-copy-id -i /home/NORMALUSERHERE/.ssh/id_rsa.pub '-p PORTNUMBER ffuser@127.0.0.1'With rootvi /etc/ssh/sshd_configPasswordAuthentication noPubkeyAuthentication yesPermitRootLogin without-passwordListenAddress 127.0.0.1Port SOMEHIGHPORTNUMBERHEREDownload firefox with this onelinerURL=https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/latest/linux-x86_64/en-US/; URLEND=`curl -s $URL | sed 's//\n/g' | fgrep '.tar' | sort -nr | egrep -v '/a|align|/td' | head -1`; curl ${URL}${URLEND} > ${URLEND}Don't show ffuser/root at login [using GNOME2]sed -i 's/\[greeter\]/\[greeter\]\nExclude=ffuser,root/g' /etc/gdm/custom.confcat /etc/gdm/custom.confFlashOnly use flash if really needed.yum install flash-plugin# run this with ffusermkdir -p /home/`whoami`/.firefox/plugins; ln -s /usr/lib64/flash-plugin/libflashplayer.so /home/`whoami`/.firefox/pluginsUse these as DEFAULT Firefox add-onshttps://addons.mozilla.org/en-US/firefox/addon/wot-safe-browsing-tool/ # WOT settings -> Searching -> Show only negative ratings # FOR REAL SECURITY don't use this plugin, because it send out url's that you are visiting..https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/https://www.eff.org/https-everywherehttps://addons.mozilla.org/en-US/firefox/addon/flashblock/ # if you are using flash.. but don't use it.. don't install flash..https://addons.mozilla.org/en-US/firefox/addon/cookie-whitelist-with-buttons/Add-ons for extra securityhttps://addons.mozilla.org/en-US/firefox/addon/noscript/ # tick the restrict on trusted sites too in the embedded objects tab# in 2013.03 convergence didn't worked very well: https sites were slow with it, etc...http://convergence.io/ # Firefox wouldn't start after installing convergence for the first time, just kill Firefox, start it again and then it will be ok :)about:configapp.update.silenttruenetwork.http.pipeliningtruenetwork.http.proxy.pipeliningtruenetwork.dns.disableIPv6true# only if using Linux/BSDbrowser.download.manager.scanWhenDonefalsebrowser.cache.disk.capacity262144browser.cache.offline.capacity262144layout.spellcheckDefault2browser.sessionstore.max_tabs_undo2browser.sessionstore.max_windows_undo2plugins.hide_infobar_for_missing_plugintrue# THESE 5 ARE IMPORTANT FOR SECURITY REASONSgeo.enabledfalsenetwork.http.sendRefererHeader0pdfjs.disabledtrue# only if using noscript!noscript.showPermanentfalseNew -> Stringgeneral.useragent.overrideMozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0# just don't use your real user agent..Disable flash cookiesFor privacy, if Flash is installed. Go to:https://www.youtube.com/and right click a flash elementRight click -> Global Settings... -> Storage TAB -> Block all sites from storing information on this computerCamera and Mic TAB -> Block all sites from using the camera and microphonePlayback -> Block all sites from using peer-assisted networkingOther important configsOptions->Advanced->Network->Offline storage 256 MBOptions->Advanced->General->Accessibility->Uncheck Always check to see if Firefox is the default browser on startupUncheck Use smooth scrollingRemove Unused Search Engines!Check about:plugins. There shouldn't be any plugins.rm /usr/lib/mozilla/plugins/*After this, you can start Firefox with:ssh -p 52317 ffuser@127.0.0.1 -X /home/ffuser/.firefox/firefox-bin > /dev/null 2>&1Firefox has built-in auto update.A few usefull websites:https://panopticlick.eff.org/http://centralops.net/asp/co/BrowserMirror.vbs.asphttp://samy.pl/evercookie/http://whatsmyuseragent.com/These questions are all related to this one topic (that's why I didn't started several questions): How could this setup be tricked from security side? Are there any tips/tricks to give less permissions to ffuser?Firefox still runs after closing it. How to close the Firefox process if there isn't any Firefox windows? (It's not causing any problems, just frustrating)There isn't any sound with ssh -X from Firefox. How do fix this?
Priviledge separation for Firefox (aka: how to secure webbrowsing)
security;firefox;scientific linux