From 46ad5cac7906b33c8c3203b5fa553c4ec2f41658 Mon Sep 17 00:00:00 2001 From: fred_the_tech_writer <69817454+fschillingeriv@users.noreply.github.com> Date: Tue, 12 Oct 2021 09:34:58 -0400 Subject: [PATCH] initial draft (#762) --- _articles/faqs/org-faqs.md | 2 +- _articles/organizations/browserext-deploy.md | 389 ++++++++++++++++++ .../organizations/organization-videos.md | 2 +- 3 files changed, 391 insertions(+), 2 deletions(-) create mode 100644 _articles/organizations/browserext-deploy.md diff --git a/_articles/faqs/org-faqs.md b/_articles/faqs/org-faqs.md index 3e3d96ea..d50ea147 100644 --- a/_articles/faqs/org-faqs.md +++ b/_articles/faqs/org-faqs.md @@ -5,7 +5,7 @@ categories: [organizations] featured: true popular: false tags: [] -order: "18" +order: "19" --- This article contains Frequently Asked Questions (FAQs) regarding **Organizations**. diff --git a/_articles/organizations/browserext-deploy.md b/_articles/organizations/browserext-deploy.md new file mode 100644 index 00000000..4f22690f --- /dev/null +++ b/_articles/organizations/browserext-deploy.md @@ -0,0 +1,389 @@ +--- +layout: article +title: Deploy Browser Extension to Managed Devices +categories: [organizations] +featured: true +popular: false +tags: [] +order: "17" +--- + +When operating Bitwarden in a business setting, administrators may want to automate deployment of Bitwarden Browser Extensions to users with an endpoint management platform or Group Policy. + +The process for doing so will be different for each Operating System and browser: + +## Windows + +Deploying Bitwarden Browser Extensions to browsers on Windows generally require using Windows Group Policy to target managed computers an ADMX policy template. The procedure is slightly different for each browser: + + + +
+
+{% capture chrome %} +### Chrome + +To deploy the browser extension on Windows and Google Chrome: + +1. Download and unzip the [Chrome Enterprise Bundle](https://chromeenterprise.google/browser/download/#windows-tab){:target="\_blank"} for Windows. +2. From the unzipped directory: + + - Copy `\Configuration\admx\chrome.admx` to `C:\Windows\PolicyDefinitions` + - Copy `\Configuration\admx\en-US\chrome.adml` to `C:\Windows\PolicyDefinitions\en-US` +3. Open the Windows Group Policy Manager and create a new GPO for Bitwarden browser extension installation. +4. Right-click on the new GPO and select **Edit...**, and proceed to navigate to **Computer Configuration** → **Policies** → **Administrative Templates** → **Google Chrome** → **Extensions**. +5. In the right-hand Settings area, select **Configure the list of force-installed apps and extensions**. In the dialog, toggle the **Enabled** option. +6. Select the **Show...** button and add the following: + + ``` + nngceckbapebfimnlniiiahkandclblb;https://clients2.google.com/service/update2/crx + ``` + + Click **OK**. +7. Still in **...Administrative Templates** → **Google Chrome**, select **Password manager** from the file tree. +8. In the right-hand Settings area, right-click **Enable saving passwords to the password manager** and select **Edit**. In the dialog, toggle the **Disabled** option and select **OK**. +9. Repeat **Step 8** for the **Enable Autofill for addresses** and **Enable Autofill for credit cards** options, found in Settings area for **...Administrative Templates** → **Google Chrome**. +10. Apply the newly-configured GPO to your desired scope. + +{% endcapture %} +{{ chrome | markdownify }} +
+
+{% capture firefox %} +### Firefox + +To deploy the browser extension on Windows and Firefox: + +1. Download and unzip the [Firefox ADMX Template](https://github.com/mozilla/policy-templates/releases){:target="\_blank"} file. +2. From the unzipped directory: + + - Copy `\policy_templates_\windows\firefox.admx` to `C:\Windows\PolicyDefinitions` + - Copy `\policy_templates_\windows\en-US\firefox.adml` to `C:\Windows\PolicyDefinitions\en-US` +3. Open the Windows Group Policy Manager and create a new GPO for the Bitwarden browser extension installation. +4. Right-click on the new GPO and select **Edit...**, and proceed to navigate to **Computer Configuration** → **Policies** → **Administrative Templates** → **Firefox** → **Extensions**. +5. In the right-hand Settings area, select **Extensions to Install**. In the dialog, toggle the **Enabled** option. +6. Select the **Show...** button and add the following: + + ``` + https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi + ``` + + Click **OK**. +7. Back in the file tree select **Firefox**. In the right-hand Settings area, **Edit...** and disable both the **Offer to save logins** and **Offer to save logins (default)** options. +8. Apply the newly-configured GPO to your desired scope. + + +{% endcapture %} +{{ firefox | markdownify }} +
+
+{% capture edge %} +### Edge + +To deploy the browser extension on Windows and Edge: + +1. Download and unzip the [Microsoft Edge Policy Files](https://www.microsoft.com/en-us/edge/business/download){:target="\_blank"}. +2. From the unzipped directory: + + - Copy `\windows\admx\msedge.admx` to `C:\Windows\PolicyDefinitions` + - Copy `\windows\admx\en-US\msedge.adml` to `C:\Windows\PolicyDefinitions\en-US` +3. Open the Windows Group Policy Manager and create a new GPO for the Bitwarden browser extension installation. +4. Right-click on the new GPO and select **Edit...**, and proceed to navigate to **Computer Configuration** → **Policies** → **Administrative Templates** → **Microsoft Edge** → **Extensions**. +5. In the right-hand Settings area, select **Control which extensions are installed silently**. In the dialog, toggle the **Enabled** option. +6. Select the **Show...** button and add the following: + + ``` + jbkfoedolllekgbhcbcoahefnbanhhlh;https://edge.microsoft.com/extensionwebstorebase/v1/crx + ``` + + Click **OK**. +7. Still in **..Administrative Templates** → **Microsoft Edge**, select **Password manager and protection** from the file tree. +8. In the right-hand Settings area, right-click **Enable saving passwords to the password manager** and select **Edit**. In the dialog, toggle the **Disabled** option and select **OK**. +9. Repeat **Step 8** for the **Enable Autofill for addresses** and **Enable Autofill for credit cards** options, found in Settings area for **...Administrative Templates** → **Microsoft Edge**. +10. Apply the newly-configured GPO to your desired scope. + +{% endcapture %} +{{ edge | markdownify }} +
+
+ +## Linux + +Deploying Bitwarden Browser Extensions to browsers on Linux generally involves using a `.json` file to set configuration properties. The procedure is slightly different for each browser: + + + +
+
+{% capture chrome2 %} +### Chrome + +To deploy the browser extension on Linux and Google Chrome: + +1. Download the [Google Chrome .deb or .rpm](https://www.google.com/chrome/?platform=linux){:target="\_blank"} for Linux. +2. Download the [Chrome Enterprise Bundle](https://chromeenterprise.google/browser/download/#windows-tab){:target="\_blank"}. +3. Unzip the Enterprise Bundle (`GoogleChromeEnterpriseBundle64.zip` or `GoogleChromeEnterpriseBundle32.zip`) and open the `/Configuration` folder. +4. Make a copy of the `master_preferences.json` (in Chrome 91+, `initial_preferences.json`) and rename it `managed_preferences.json`. +5. Add the following to `managed_preferences.json`: + + ``` + { + "policies:" { + "ExtensionSettings": { + "nngceckbapebfimnlniiiahkandclblb": { + "installation_mode": "force_installed", + "update_url": + "https://clients2.google.com/service/update2/crx" + } + } + } + } + ``` + + In this JSON object, `"nngceckbapebfimnlniiiahkandclblb"` is the application identifier for the Bitwarden browser extension. Similarly, `"https://clients2.google.com/service/update2/crx"` signals Chrome to use the Chrome Web Store to retrieve the identified application. + + {% callout info %}You may also configure forced installations using the [ExtensionInstallForcelist](https://chromeenterprise.google/policies/?policy=ExtensionInstallForcelist){:target="\_blank"} policy, however the [ExtensionSettings](https://support.google.com/chrome/a/answer/7517525#getID&zippy=%2Cset-custom-message-for-blocked-apps-and-extensions%2Cprevent-apps-and-extensions-from-altering-webpages){:target="\_blank"} method will supersede ExtensionInstallForceList.{% endcallout %} +6. (**Recommended**) To [disable](https://chromeenterprise.google/policies/#PasswordManagerEnabled){:target="\_blank"} Chrome's built-in password manager, add the following to `managed_preferences.json` inside of `"policies": { }`: + + ``` + { + "PasswordManagerEnabled": false + } + ``` +7. Create the following directories if they do not already exist: + + ``` + mkdir /etc/opt/chrome/policies + mkdir /etc/opt/chrome/policies/managed + ``` +8. Move `managed_preferences.json` into `/etc/opt/chrome/policies/managed`. +9. As you will need to deploy these files to users' machines, we recommend making sure only admins can write files in the `/managed` directory: + + ``` + chmod -w /etc/opt/chrome/policies/managed + ``` +10. Using your preferred software distribution or MDM tool, deploy the following to users' machines: + + - Google Chrome Browser + - `/etc/opt/chrome/policies/managed/managed_preferences.json` + +{% callout success %}For more help, refer to Google's [Chrome Browser Quick Start for Linux](https://support.google.com/chrome/a/answer/9025926?hl=en&ref_topic=9025817){:target="\_blank"} guide.{% endcallout %} + +{% endcapture %} +{{ chrome2 | markdownify }} +
+
+{% capture firefox2 %} +### Firefox + +To deploy the browser extension on Linux and Firefox: + +1. Download [Firefox for Linux](https://www.mozilla.org/en-US/firefox/all/#product-desktop-release){:target="\_blank"}. +2. Create a `distribution` directory within the Firefox installation directory. +3. In the `distrubition` directory, create a file `policies.json`. +4. Add the following to `policies.json`: + + ``` + { + "policies": { + "ExtensionSettings": { + "446900e4-71c2-419f-a6a7-df9c091e268b": { + "installation_mode": "force_installed", + "install_url": "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi" + } + } + } + } + ``` + + In this JSON object, `"446900e4-71c2-419f-a6a7-df9c091e268b"` is the extension ID for the Bitwarden browser extension. Similarly, `"https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi"` signals Firefox to use the extension store to retrieve the extension. +5. (**Recommended**) To [disable](https://github.com/mozilla/policy-templates/blob/master/README.md#passwordmanagerenabled){:target="\_blank"} Firefox's built-in password manager, add the following to `policies.json` inside of `"policies": { }`: + + ``` + { + "PasswordManagerEnabled": false + } + ``` +6. Using your preferred software distribution or MDM tool, deploy the following to users' machines: + + - Firefox Browser + - `/distribution/policies.json` + +{% callout success %}For more help, refer to Firefox's [policies.json Overview](https://support.mozilla.org/en-US/kb/customizing-firefox-macos-using-configuration-prof){:target="\_blank"} or [Policies README](https://github.com/mozilla/policy-templates/blob/master/README.md){:target="\_blank"} on Github.{% endcallout %} + +{% endcapture %} +{{ firefox2 | markdownify }} +
+
+ +## MacOS + +Deploying Bitwarden Browser Extensions to browsers on macOS generally involves using a property list (`.plist`) file. The procedure is slightly different for each browser: + + + +
+
+{% capture chrome3 %} +### Chrome + +To deploy the browser extension on macOS & Google Chrome: + +1. Download the [Google Chrome .dmg or .pkg](https://chromeenterprise.google/browser/download/#mac-tab){:target="\_blank"} for macOS. +2. Download the [Chrome Enterprise Bundle](https://chromeenterprise.google/browser/download/#windows-tab){:target="\_blank"}. +3. Unzip the Enterprise Bundle (`GoogleChromeEnterpriseBundle64.zip` or `GoogleChromeEnterpriseBundle32.zip`). +4. Open the `/Configuration/com.Google.Chrome.plist` file with any text editor. +5. Add the following to the `.plist` file: + + ``` + ExtensionSettings + + nngceckbapebfimnlniiiahkandclblb + + installation_mode + force_installed + update_url + https://clients2.google.com/service/update2/crx + + + ``` + + In this codeblock, `nngceckbapebfimnlniiiahkandclblb` is the application identifier for the Bitwarden browser extension. Similarly, `https://clients2.google.com/service/update2/crx` signals Chrome to use the Chrome Web Store to retrieve the identified application. + + {% callout info %}You may also configure forced installations using the [ExtensionInstallForcelist](https://chromeenterprise.google/policies/?policy=ExtensionInstallForcelist){:target="\_blank"} policy, however the [ExtensionSettings](https://support.google.com/chrome/a/answer/7517525#getID&zippy=%2Cset-custom-message-for-blocked-apps-and-extensions%2Cprevent-apps-and-extensions-from-altering-webpages){:target="\_blank"} method will supersede ExtensionInstallForceList.{% endcallout %} + +6. (**Recommended**) To [disable](https://chromeenterprise.google/policies/#PasswordManagerEnabled){:target="\_blank"} Chrome's built-in password manager, add the following to `com.Google.Chrome.plist`: + + ``` + PasswordManagerEnabled + + ``` + +7. Convert the `com.Google.Chrome.plist` file to a configuration profile using a conversion tool like [mcxToProfile](https://github.com/timsutton/mcxToProfile){:target="\_blank"}. +8. Deploy the Chrome `.dmg` or `.pkg` and the configuration profile using your software distribution or MDM tool to all managed computers. + +{% callout success %}For more help, refer to Google's [Chrome Browser Quick Start for Mac](https://support.google.com/chrome/a/answer/9020580?hl=en&ref_topic=7650028){:target="\_blank"} guide.{% endcallout %} + +{% endcapture %} +{{ chrome3 | markdownify }} +
+
+{% capture firefox3 %} +### Firefox + +To deploy the browser extension on MacOS and Firefox: + +1. Download and install [Firefox for Enterprise](https://www.mozilla.org/en-US/firefox/enterprise/#download){:target="\_blank"} for macOS. +2. Create a `distribution` directory in `Firefox.app/Contents/Resources/`. +3. In the created `/distribution` directory, create a new file `org.mozilla.firefox.plist`. + + {% callout success %}Use the [Firefox .plist template](https://github.com/mozilla/policy-templates/blob/master/mac/org.mozilla.firefox.plist){:target="\_blank"} and [Policy README](https://github.com/mozilla/policy-templates/blob/master/README.md){:target="\_blank"} for reference.{% endcallout %} +3. Add the following to `org.mozilla.firefox.plist`: + + ``` + ExtensionSettings + + 446900e4-71c2-419f-a6a7-df9c091e268b + + installation_mode + force_installed + update_url + https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi + + + ``` + + In this codeblock, `446900e4-71c2-419f-a6a7-df9c091e268b` is the extension ID for the Bitwarden browser extension. Similarly, `https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi` signals Firefox to use the extension store to retrieve the application. +4. (**Recommended**) To [disable](https://github.com/mozilla/policy-templates/blob/master/README.md#passwordmanagerenabled){:target="\_blank"} Firefox's built-in password manager, add the following to `org.mozilla.firefox.plist`: + + ``` + + PasswordManagerEnabled + + + ``` + +5. Convert the `org.mozilla.firefox.plist` file to a configuration profile using a conversion tool like [mcxToProfile](https://github.com/timsutton/mcxToProfile){:target="\_blank"}. +8. Deploy the Firefox `.dmg` and the configuration profile using your software distribution or MDM tool to all managed computers. + +{% endcapture %} +{{ firefox3 | markdownify }} +
+
+{% capture edge3 %} +### Edge + +To deploy the browser extension on macOS and Microsoft Edge: + +1. Download the [Microsoft Edge for macOS .pkg](https://www.microsoft.com/en-us/edge){:target="\_blank"} file. +2. In Terminal, use the following command to create a `.plist` file for Microsoft Edge: + + ``` + /usr/bin/defaults write ~/Desktop/com.microsoft.Edge.plist RestoreOnStartup -int 1 + ``` +3. Use the following command to convert the `.plist` from binary to plain text: + + ``` + /usr/bin/plutil -convert xml1 ~/Desktop/com.microsoft.Edge.plist + ``` +4. Open `com.microsoft.Edge.plist` and add the following: + + ``` + ExtensionSettings + + jbkfoedolllekgbhcbcoahefnbanhhlh + + installation_mode + force_installed + update_url + https://edge.microsoft.com/extensionwebstorebase/v1/crx + + + ``` + + In this codeblock, `jbkfoedolllekgbhcbcoahefnbanhhlh` is the application identifier for the Bitwarden browser extension. Similarly, `https://edge.microsoft.com/extensionwebstorebase/v1/crx` signals Edge to use the Edge Add-On Store to retrieve the identified application. + + {% callout info %}You may also configure forced installations using the [ExtensionInstallForceList](https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#extensioninstallforcelist){:target="\_blank"}, however the [ExtensionSettings](https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#extensionsettings){:target="\_blank"} method will supersede ExtensionInstallForceList.{% endcallout %} + +5. (**Recommended**) To [disable](https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#passwordmanagerenabled){:target="\_blank"} Edge's built-in password manager, add the following to `com.microsoft.Edge.plist`: + + ``` + PasswordManagerEnabled + + ``` +6. Convert the `com.microsoft.Edge.plist` file to a configuration profile using a conversion tool like [mcxToProfile](https://github.com/timsutton/mcxToProfile){:target="\_blank"}. +8. Deploy the Edge `.pkg` and the configuration profile using your software distribution or MDM tool to all managed computers. + +{% callout success %}**For Jamf-specific** help, refer to Microsoft's documentation on [Configuring Microsoft Edge policy settings on macOS with Jamf](https://docs.microsoft.com/en-us/deployedge/configure-microsoft-edge-on-mac-jamf){:target="\_blank"}.{% endcallout %} + +{% endcapture %} +{{ edge3 | markdownify }} +
+
diff --git a/_articles/organizations/organization-videos.md b/_articles/organizations/organization-videos.md index 9369b1ab..35dc70b5 100644 --- a/_articles/organizations/organization-videos.md +++ b/_articles/organizations/organization-videos.md @@ -5,7 +5,7 @@ categories: [organizations] featured: true popular: false tags: [organizations, videos, bitwarden 101] -order: "17" +order: "18" --- ## Bitwarden 101 - Organizations