3

My network uses Kerio WinRoute Firewall 6 and is configured to authenticate HTTP requests using built in Active Directory accounts. That means every computer gets sent an NTLM auth challenge when trying to connect via HTTP.

The problem is, after a user enters their windows username / password, FF seems to cache that forever. If that user logs off windows and another user logs on, the second user gets the first users access rights in the firewall. This creates a huge security hole and logging hole in the system obviously.

Is there any way to stop FF from caching this? Or to force a logout on machine logout?

4 Answers 4

1

After looking at your accepted answer, I reached this manual page that might help you understand what is going on here.

From the user manual for Kerio WinRoute Firewall 6

Logout
Once finished with activities where authentication is required, it is recommended to log out of the firewall by using the Logout button. It is important to log out especially when multiple users work at the same host. If a user doesn’t log out of the firewall, their identity might be misused easily.

User can be logged on the firewall even if they have not used the web interface — e.g. if the firewall required user authentication during access to a website. To make user avoid opening the web interface when finishing their work and clicking on Logout, WinRoute includes a direct link for user logout: http://server:4080/logout or https://server:4081/logout

This URL performs immediate logout of the user without the need of opening of the web interface’s welcome page.

Hint: URL for user logout from the firewall can be added to the web browser’s toolbar as a link.
User can use this “button” for quick logout.

So, Maybe you can replace your wget hack with this formal method.

1
  • I think I'll just use wget to call the logout page so I can guarantee the session is logged out! Thanks. Feb 12, 2012 at 18:59
4

Firefox stores this information in the profile. Unless you are using one Firefox-profile for all Windows users there should not be an issue. The user loads his own profile with his saved credentials.

Also the credentials are only saved when you tick the "Save password" option. You can delete those saved password via "Options\Security\Saved Passwords".

1
  • This should have worked. But the OP's own answer suggest there is something else at play here.
    – nik
    Feb 12, 2012 at 15:29
1

Configure Firefox to clear stored password on Ff session shutdown:

  1. In the address bar type the following command: about:config
  2. Click on the "I'll be careful, I promise..." button
  3. In the Filter field type: privacy.clearOnShutdown.passwords Toggle its value to True
  4. Restart Firefox

Hope this help. Let us know. :)

1
  • 1
    Be careful! This will DELETE ALL PASSWORDS stored within that Firefox profile!
    – sm4rk0
    Aug 12, 2016 at 9:54
0

Even with different profiles, for some reason the caching was still happening.

I was able to solve it by creating a logoff script that calls wget and opens a site which sends .htaccess access denied. Then I added that loggoff script to GP and it all runs smoothly now.

1
  • Your question and subsequent answer that works for you imply that the part about FF seems to cache your windows username / password is a red-herring. Maybe, your proxy does not 'forget' an NTLM auth when you log-off from Windows and continues that access in the next session.
    – nik
    Feb 12, 2012 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .