1

I'm working on a project in which we need to download all sorts of files from websites. To reliably do this we also had to be able to do this for links containing javascript. I finally managed to do this by installing firefox on the (Ubuntu 14.04) server and using xvfb and PyVirtualDisplay to emulate a display. It works, but I'm not really a good sysadmin, so I can't really oversee the side effects; installing Firefox on a server simply feels wrong.

So my question is; with the firefox installation, the following dependencies were also installed:

firefox libasound2 libasound2-data libcanberra0 libdbusmenu-glib4 libdbusmenu-gtk4 libogg0 libstartup-notification0 libvorbis0a libvorbisfile3 libxcb-util0 sound-theme-freedesktop xul-ext-ubufox

can this become troublesome on a server for some reason? All tips are welcome!

Improve this question
7
  • Tip: you may find PhantomJS useful.
    – cYrus
    Nov 19, 2015 at 15:36
  • @cYrus - I first tried with Phantomjs, but unfortunately Phantom doesn't support file downloads..
    – kramer65
    Nov 19, 2015 at 15:39
  • What type of server are we even talking about? A dedicated server that’s directly connected to the internet? A server somewhere in a lab? Something else? Because a server is just a regular PC. It won’t explode because you install GUI software.
    – Daniel B
    Nov 19, 2015 at 15:43
  • can't you use curl or wget ?
    – Pierre-Alain TORET
    Nov 19, 2015 at 15:48
  • @kramer65 it seems that is possible with CasperJS.
    – cYrus
    Nov 19, 2015 at 15:48

1 Answer 1

Reset to default
2

Firefox always has vulnerabilities, possibly due to its open source structure. It is okay for everyday users, but highly risky for a server if you attempt to access third-party content outside the server's internal network. This can make it easy for hackers to compromise the server via Firefox Vulnerabilities. I recommend you install a server plugin to download files and run javascript. What software does your server run? If it is Node.JS, I would install a sandbox plugin. If you run apache, you could look at cordova.js.

Improve this answer
3
  • Note, it is the user that makes installing browsers on servers "risky". Browsers do not introduce additional attackable surface area, so there is no risk to installing a browser per se. using it in an unsafe manner however is a differant story. Using the browser to design/debug/test locally hosted content is harmless.
    – Frank Thomas
    Nov 19, 2015 at 15:48
  • Good points. We're using the server to both serve the website, an api for the app, and also scrape people's emails, click on links, and download stuff (PDFs) from the website in those links. So you're right in saying that this is potentially a very big security risk. I'm running Nginx as a webserver. I've been wanting to use docker to containerize things, I guess running the firefox scraping from a separate docker container would already be better. Do you think that would be a good idea to make things a bit safer?
    – kramer65
    Nov 19, 2015 at 16:25
  • Yes, that would definitely be more secure. It would be a big improvement. Good idea!
    – Admin3X
    Nov 19, 2015 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .