is it possible to install java without the browser plugin?

Question

I need java, but I don't want any browser to be able to access it.

Is it possible to remove the whole applet/browser plugin code?

score 11 · Answer 1 · edited Apr 12 '13 at 11:43

11

As of Java Version 7 Update 10, the Java Control Panel (in the Security tab) can disable the Java plug-in completely: http://www.java.com/en/download/help/disable_browser.xml

ss of dialog

This should avoid the possibility that a Java upgrade might re-enable the plug-in, which might be a risk with some other approaches.

edited Apr 12 '13 at 11:43

slm

7,355
16
54
72

answered Apr 12 '13 at 11:17

seanf

266
2
6

score 4 · Answer 2 · 2013-05-18T01:01:37.663

4

If you install the JRE; you can delete or rename npjp2.dll or libnpjp2.so (on linux); or on Linux make it non executable (chmod 0000 libnpjp2.so). This single file is the plugin file.

They're located in %ProgramFiles%\jre<x>\bin\plugin2 on Windows. On Linux, they're where ever your java is installed. You can run locate libnpjp2.so to find the location.

The same also applies to the JDK.

edited May 18 '13 at 01:01

answered Sep 29 '12 at 15:52

2

Disabling the plugin would alleviate most java security concerns right? (Since java attacks happen through the browser) – reinier Sep 29 '12 at 16:08
But if this is a server, people should not be using it for browsing web sites anyway... – Massimo Sep 29 '12 at 17:37
I really don't think anything is located in "jre/bin/plugin2" on Windows. :) – John Gardeniers Sep 29 '12 at 21:49

score 3 · Answer 3 · answered Sep 29 '12 at 16:58

One method to disable the Windows/IE browser plugin is to set a deny ACE on the following files:

"C:\Program Files\Java\jre6\bin\ssv.dll"
"C:\Program Files\Java\jre6\bin\jp2ssv.dll"

"C:\Program Files\Java\jre7\bin\ssv.dll"
"C:\Program Files\Java\jre7\bin\jp2ssv.dll"

"C:\Program Files (x86)\Java\jre6\bin\ssv.dll"
"C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll"

"C:\Program Files (x86)\Java\jre7\bin\ssv.dll"
"C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll"

This could be performed in a computer startup script.

If you run this command manually, it must be done from an elevated command prompt.

icacls "C:\Program Files (x86)\Java\jre7\bin\ssv.dll"
C:\Program Files (x86)\Java\jre7\bin\ssv.dll NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

icacls "C:\Program Files (x86)\Java\jre7\bin\ssv.dll" /deny Everyone:(X)
processed file: C:\Program Files (x86)\Java\jre7\bin\ssv.dll
Successfully processed 1 files; Failed processing 0 files

icacls "C:\Program Files (x86)\Java\jre7\bin\ssv.dll"
C:\Program Files (x86)\Java\jre7\bin\ssv.dll
Everyone:(DENY)(S,X)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

What if a process replaced the files? This is not inconceivable, for example if an installer had the files on a manifest to determine relevancy. A script to remove the files may not be applied until the next restart. Applying the deny ACE works in most cases. — Greg Askew, Sep 29 '12 at 17:27

score 2 · Answer 4 · answered May 05 '13 at 08:29

Starting from Oracle JDK/JRE 7u21 (Release Notes), a Server JRE is available which can serve such requirement.

A new Server JRE package, with tools commonly required for server deployments but without the Java plug-in, auto-update or installer found in the regular JRE package, is available starting from this release. The Server JRE is specifically targeted for deploying Java in server environments and is available for 64-bit Solaris, Windows and Linux platforms. For more information on installing this package, see Installation Instructions.

is it possible to install java without the browser plugin?

4 Answers4