Enforcing Java Security Manager in Restricted Windows Environments?



Hi

Lately I came across several Citrix and Terminal Server projects which
provide a restricted set of applications to their users. This is achieved
using Windows Software Restriction Policies or AppSense Application Manager
to white or black list executables.

One of these permitted binaries is often java.exe. Now the problem arises
that once Java is enabled any Java application can be executed on the
system. This allows a malicious user to execute arbitrary Java code, like
replacement shells (JSH), RDP clients (Propero Java RDP) and network port
scanners. I could block java.exe but business requires that the company's
Java application must still work.

This lead me into this research on how to white list Java applications in a
restricted Windows environment. For gory details see:
http://www.iplosion.com/archives/54

So all this melts down to my question: Is there a way to tell java.exe to
always use the Java Security Manager without the possibility of manipulation
by the user?

I would be very interested to learn your ideas.

Kind regards
Jan P. Monsch



Relevant Pages

  • Why Java?
    ... My applications are intended to be used mostly on desktop machines connected ... I have tried Java using NetBeans. ... GUI technology in Microsoft Windows Forms is best. ... than the solutions I have so far been able to devise to overcome Swing ...
    (comp.lang.java.advocacy)
  • Re: where do you store app wide data?
    ... Not the JVM.. ... Java applications. ... thats the fault of whoever wrote the application - not Java. ... Files are not stored in RAM when you close them. ...
    (alt.php)
  • [Full-disclosure] Enforcing Java Security Manager in Restricted Windows Environments?
    ... provide a restricted set of applications to their users. ... using Windows Software Restriction Policies or AppSense Application Manager ... to white or black list executables. ... that once Java is enabled any Java application can be executed on the ...
    (Full-Disclosure)
  • Java Developer Positions in downtown Chicago
    ... I have a few Java Developer positions in downtown Chicago. ... replacing the framework and changing look and feel to ... executing applications. ... Highly Proficient in writing client/server applications using Java ...
    (comp.lang.java.programmer)
  • Re: Giving an application a window icon in a sensible way
    ... Java app. ... At the time I made the initial posting to this thread, a google ... applications (they involved requesting the icon from a URL, ... or accomplish things on your own. ...
    (comp.lang.java.programmer)