Secure Firefox - DISA STIG

#!/bin/bash
##########
# Secure Firefox
#
# This script will bring Firefox browser on Red Hat Linux into DISA STIG compliance.
#
######

# Create local-setttings file so Firefox knows how to find our .cfg file
echo "pref(\"general.config.obscure_value\", 0); > /usr/lib64/firefox/defaults/preferences/local-settings.js
echo "pref(\"general.config.filename\", \"mozilla.cfg\"); >> /usr/lib64/firefox/defaults/preferences/local-settings.js

# Set appropriate permissions on local-settings.js
chmod 644 /usr/lib64/firefox/defaults/preferences/local-settings.js

# Set startup page to blank since we're probably on an air-gapped network.
sed -i 's%www.redhat.com%about:blank%' /usr/lib64/firefox/defaults/preferences/all-redhat.js
sed -i 's%file:///usr/share/doc/HTML/index.html%about:blank%' /usr/lib64/firefox/defaults/preferences/all-redhat.js

# Create our secure configuration file
cat > /usr/lib64/firefox/mozilla.cfg <<'MOZEOF'
//
lockPref("browser.urlbar.placeholderName", "unexpected results");
lockPref("browser.newtabpage.enabled", "false");
lockPref("browser.newtabpage.activity-stream.default.sites", "");
lockPref("browser.newtabpage.activity-stream.discoverystream.enabled", false);
lockPref("browser.newtabpage.activity-stream.showSearch", false);
lockPref("browser.newtabpage.activity-stream.showSponsoredTopSites", false);
lockPref("browser.search.suggest.enabled", false);
lockPref("browser.urlbar.showSearchSuggestionsFirst", false);
lockPref("browser.urlbar.suggest.searches", false);
lockPref(network.protocol-handler.external.shell", flase);
lockPref("privacy.sanitize.sanitizeOnShutdown", false);
lockPref("privacy.sanitize.promptOnSanitize", false);
lockPref("extensions.update.enabled", false);
lockPref("browser.formfill.enable", false);
lockPref("devtools.policiy.disabled", true);
lockPref("toolkit.telemetry.enabled", false);
lockPref("toolkit.telemetry.archive.enabled", false);
lockPref("privacy.trackingprotection.fingerprinting.enabled", true);
lockPref("privacy.trackingprotection.cryptomining.enabled", true);
lockPref("browser.contentblocking.category", "strict");
lockPref("extensions.htmlaboutaddons.recommendations.enabled", false);
lockPref("signon.prefillForms", false);
lockPref("signon.autofillForms", false);
lockPref("app.update.enabled", false);
lockPref("signon.rememberSignons", false );
lockPref("browser.search.update", false);
lockPref("datareporting.policy.dataSubmissionEnabled", false);
lockPref("xpinstall.enabled", false);
lockPref("security.enable_ssl2", false);
lockPref("security.enable.ssl2", false);
lockPref("security.tls.version.min", 2);
lockPref("security.tls.version.max", 4);
lockPref("security.default_personal_cert", "Ask Every Time");
lockPref("security.ssl3.rsa_des_ede3_sha", false);
lockPref("security.enable.ssl3", false);
lockPref("browser.startup.homepage", "about:blank");
lockPref("dom.disable_window_open_feature.status", true);
lockPref("dom.disable_windo_move_resize", true);
lockPref("dom.event.contextmenu.enabled", false);
lockPref("dom.disable_window_flip", true);
lockPref("security.warn_leaving_secure", true);
lockPref("extension.pocket.enabled", false);
lockPref("browser.helperApps.alwaysAsk.force", true);
lockPref("privacy.item.history", false);
lockPref("plugin.disable_full_page_plugin_for_types", "application/pdf,application/fdf,application/xfdf,application/lso,application/lss,application/iqy,application/rqy,application/lsl,application/xlk,application/xls,application/xlt,application/pot,application/pps,application/ppt,application/dos,application/dot,application/wks,application/bat,application/ps,application/eps,application/wch,application/wcm,application/wb1,application/wb3,application/rtf,application/doc,application/mdb,application/mde,application/wbk,application/ad,application/adp");

# Set appropriate permissions on mozilla.cfg
chmod 644 /usr/lib64/firefox/mozilla.cfg

# Build secure policies.json file
cat > /usr/lib64/firefox/distribution/policies.json <<'FFEOF'
{
    "policies": {
        "DisableFirefoxAccounts": true,
        "DisablePocket": true,
        "DisableAppUpdate": true,
        "DontCheckDefaultBrowser": true,
        "OfferToSaveLogins": false,
        "SSLVersionMin": "tls1.2",
        "ExtensionUpdate": false,
        "DisableFormHistory": true,
        "PasswordManagerEnabled": false,
        "PopupBlocking": { "Default": true, "Locked": true},
        "InstallAddonsPermission": { "Default": false},
        "DisableTelemetry": true,
        "DisableDeveloperTools": true,
        "DisableForgetButton": true,
        "DisablePrivateBrowsing": true,
        "SearchSuggestEnabled": false,
        "NetworkPrediction": false,
        "Permissions:"{ "Autoplay":{ "Default":"block-audio-video" }},
        "EnableTrackingProtection": { "Fingerprinting": true},
        "EnableTrackingProtection": { "Cryptomining": true},
        "SanitizeOnShutdown": { "Cache": false, "Cookies": false, "Downloads": false, "FormData": false,
        "History": false, "Sessions": false, "SiteSettings": false, "OfflineApps": false, "Locked": true},
    "Preferences": {
        "security.default_personal_cert": { "Value": "Ask Every Time", "Status": "locked"},
        "browser.search.update": { "Value": false, "Status": "locked"},
        "dom.disable_window_move_resize": { "Value": true, "Status": "locked"},
        "dom_disable_window_flip": { "Value": true, "Status": "locked"}
    }
    }
}
FFEOF
chmod 644 /usr/lib64/firefox/distribution/policies.json

echo "Secure Firefox completed."