{"stig":{"title":"Omnissa Horizon Connection Server Security Technical Implementation Guide","version":"1","release":"1"},"checks":[{"vulnId":"V-286728","ruleId":"SV-286728r1291347_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must limit the number of concurrent client sessions.","description":"The maxConnections setting limits the maximum number of concurrent SSL Gateway connections accepted by a Horizon Connection Server. \n\nLimiting concurrent connections helps protect the server from resource exhaustion and reduces the potential impact of denial-of-service conditions by preventing the server from accepting more simultaneous connections than it is designed to handle.\n\nSatisfies: SRG-APP-000001-AS-000001, SRG-APP-000435-AS-000163","checkContent":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\nNote: defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.\n\n2. Verify the file \"locked.properties\" exists.\n\nIf the \"locked.properties\" file does not exist, this is a finding.\n\n3. Open \"locked.properties\" in a text editor. Review the following additional setting if present:\n\nmaxConnections\n\nIf \"maxConnections\" is present and is set to a value greater than \"4000\", this is a finding.\n\n(Note: The \"maxConnections\" setting can be higher than the default of 2000 [up to a maximum of 4000] to support larger Horizon deployments.)","fixText":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\n2. Open the \"locked.properties\" file in a text editor or create it if it does not exist.\n\n3. If the \"maxConnections setting\" is present and exceeds \"4000\", configure it to a value no greater than \"4000\". \n\nThe default value of \"2000\" should be retained unless additional capacity is required and documented. If a higher capacity is necessary, configure:\n\nmaxConnections=\n(where is greater than \"2000\" but not greater than \"4000\")\n\n4. Save and close the file. \n\n5. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-000054","CCI-002385"]},{"vulnId":"V-286729","ruleId":"SV-286729r1294272_rule","severity":"high","ruleTitle":"The Horizon Connection Server must use encryption strength in accordance with the categorization of the management data during remote access management sessions.","description":"Preventing the disclosure of transmitted information requires that the application server take measures to employ strong cryptographic mechanisms to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS).\n\nTLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.\n\nAccording to NIST and as of publication, TLS 1.1 must not be used and TLS 1.2 must be configured.\n\nNote: Mandating TLS 1.2 may affect certain client types. Test and implement carefully.\n\nSatisfies: SRG-APP-000014-AS-000009, SRG-APP-000439-AS-000155, SRG-APP-000440-AS-000167, SRG-APP-000442-AS-000259","checkContent":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\nNote: \"\" defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.\n\n2. Verify the file \"locked.properties\" exists.\n\nIf the \"locked.properties\" file does not exist, this is a finding.\n\n3. Open \"locked.properties\" in a text editor. \n\n4. Find the \"secureProtocols.1\" and \"preferredSecureProtocol\" settings. Verify they are set as follows:\n\nsecureProtocols.1=TLSv1.2\npreferredSecureProtocol=TLSv1.2\n\nIf the \"secureProtocols.1\" and \"preferredSecureProtocol\" are not exactly as above, this is a finding.","fixText":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\n2. Open the \"locked.properties\" file in a text editor or create it if it does not exist.\n\n3. Add or change the following lines:\n\nsecureProtocols.1=TLSv1.2\npreferredSecureProtocol=TLSv1.2\n\n4. Save and close the file. \n\n5. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-000068","CCI-002418","CCI-002421","CCI-002422"]},{"vulnId":"V-286730","ruleId":"SV-286730r1291353_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must be configured to only support TLS 1.2 connections.","description":"Preventing the disclosure of transmitted information requires that the application server take measures to employ strong cryptographic mechanisms to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS).\n\nTLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.\n\nAccording to NIST and as of publication, TLS 1.1 must not be used and TLS 1.2 must be configured.\n\nNote: Mandating TLS 1.2 may affect certain client types. Test and implement carefully.","checkContent":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\nNote: \"\" defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.\n\n2. Verify the file \"locked.properties\" exists.\n\nIf the \"locked.properties\" file does not exist, this is a finding.\n\n3. Open \"locked.properties\" in a text editor.\n\nIf there is a \"secureProtocols.2\" or \"secureProtocols.3\" setting, this is a finding.","fixText":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\n2. Open the \"locked.properties\" file in a text editor or create it if it does not exist.\n\n3. Remove any \"secureProtocols.2\", \"secureProtocols.3\", and \"preferredSecureProtocol\" setting. \n\n4. Save and close the file. \n\n5. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-001453"]},{"vulnId":"V-286731","ruleId":"SV-286731r1291356_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must be configured to use debug level logging.","description":"To ensure that all security-relevant information and events are logged, the Horizon Connection Server must be configured to the \"debug\" logging level. This is the default value, but because it can be changed to other levels, this configuration must be verified and maintained.","checkContent":"1. On the Horizon Connection Server, launch the Registry Editor.\n\n2. Traverse the registry tree to \"HKEY_LOCAL_MACHINE\\Software\\Omnissa\\Horizon\".\n\n3. Locate the \"DebugEnabled\" key.\n\nIf \"DebugEnabled\" does not exist, this is a finding.\n\nIf \"DebugEnabled\" exists and does not have a value of \"true\", this is a finding.","fixText":"1. On the Horizon Connection Server, open the Start menu.\n\n2. Find and launch the \"Set Horizon Connection Server Log Levels\" shortcut. The precise location will vary depending on the Windows Server version and Start menu options.\n\n3. In the resulting command window, select option 2, \"View Debug\".\n\n4. Press any key to exit the command prompt window.","ccis":["CCI-000067"]},{"vulnId":"V-286732","ruleId":"SV-286732r1294274_rule","severity":"medium","ruleTitle":"The Horizon Connection Server administrators must be limited in terms of quantity, scope, and permissions.","description":"Role-based access and least privilege are two fundamental security concepts that must be properly implemented in Horizon Connection Server to ensure the correct users and groups have the appropriate permissions on the relevant objects.\n\nHorizon Connection Server allows for assigning roles (predefined sets of permissions) to specific users and groups on a specific Access Group (set of objects).\n\nAdministrators must ensure that minimal permissions are assigned to the correct entities, in the right scope, and that the permissions remain unchanged over time.\n\nSatisfies: SRG-APP-000033-AS-000024, SRG-APP-000118-AS-000078, SRG-APP-000121-AS-000081, SRG-APP-000122-AS-000082, SRG-APP-000123-AS-000083, SRG-APP-000290-AS-000174, SRG-APP-000315-AS-000094, SRG-APP-000340-AS-000185, SRG-APP-000380-AS-000088","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Administrators.\n\n3. In the right pane, click the \"Administrators and Groups\" tab. \n\n4. Review each user and group in the left pane and their associated role in the far right pane.\n\n5. Permissions must be as restrictive as possible and their scope (Access Group) as limited as possible. Verify no user or group has unnecessary permissions and that their Access Group is appropriately limited. Pay special attention to the \"Local Administrator\" and \"Administrator\" roles on the root Access Group, as those roles have total control over the local and global environment, respectively. Anyone with any administrative role can log in to the Console and view potentially sensitive configurations, system details, and events.\n\nIf any user or group has permissions that are more permissive than the minimum necessary, this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Administrators.\n\n3. To remove users or groups:\n\na. In the right pane, from the \"Administrators and Groups\" tab, select the unnecessary users or groups in the left pane and click the \"Remove\" button.\n\nb. Click \"OK\" to confirm removal.\n\n4. To modify assigned permissions:\n\na. In the right pane, from the \"Administrators and Groups\" tab, select the appropriate user or group in the left pane.\n\nb. In the right pane, select the role to remove and click \"Remove Permissions\".\n\nc. Click \"OK\" to confirm removal.","ccis":["CCI-000213","CCI-000162","CCI-001493","CCI-001494","CCI-001495","CCI-001496","CCI-002314","CCI-002235","CCI-001813"]},{"vulnId":"V-286733","ruleId":"SV-286733r1291362_rule","severity":"medium","ruleTitle":"The Horizon Connection Server user interface must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system.","description":"Application servers are required to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system management interface, providing privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance that states that: \n\n(i) users are accessing a U.S. government information system; \n(ii) system usage may be monitored, recorded, and subject to audit; \n(iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and \n(iv) the use of the system indicates consent to monitoring and recording.\n\nSystem use notification messages can be implemented in the form of warning banners displayed when individuals log on to the information system. \n\nSystem use notification is intended only for information system access including an interactive logon interface with a human user and is not required when an interactive interface does not exist. \n\nUse this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner must be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating \"OK\".\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab and locate \"Display a Pre-Login Message\" check box under \"Client Settings\".\n\nIf \"Display a Pre-Login Message\" is not checked, this is a finding.\n\nIf the \"Display a Pre-Login Message\" field does not contain the Standard Mandatory DoW Notice and Consent Banner text, this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab.\n\n4. Click \"Edit\".\n\n5. Scroll down to \"Client Settings\".\n\n6. Verify the box next to \"Display a Pre-Login Message\" is checked.\n\n7. In the \"Display a Pre-Login Message\" field, supply the Standard Mandatory DoW Notice and Consent Banner text:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\n8. Click \"OK\".","ccis":["CCI-000048"]},{"vulnId":"V-286734","ruleId":"SV-286734r1291648_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must be configured with an events database.","description":"The Horizon Connection Server stores application level events and actions in a dedicated database rather than log files. This makes day-to-day administration easier while off-loading these events to a separate system for resiliency.\n\nAn events database is configured after Connection Server deployment. It must only be configured one time, even in the case of multiple grouped Connection Servers, as the configuration will be applied to the other servers automatically.\n\nSatisfies: SRG-APP-000089-AS-000050, SRG-APP-000091-AS-000052, SRG-APP-000092-AS-000053, SRG-APP-000095-AS-000056, SRG-APP-000096-AS-000059, SRG-APP-000097-AS-000060, SRG-APP-000098-AS-000061, SRG-APP-000099-AS-000062, SRG-APP-000100-AS-000063, SRG-APP-000101-AS-000072, SRG-APP-000266-AS-000168, SRG-APP-000343-AS-000030, SRG-APP-000495-AS-000220, SRG-APP-000499-AS-000224, SRG-APP-000503-AS-000228, SRG-APP-000504-AS-000229, SRG-APP-000505-AS-000230, SRG-APP-000509-AS-000234","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Monitor >> Events.\n\nIf the right pane is empty or shows \"Events DB is not configured\", this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Event Configuration.\n\n3. In the right pane, under \"Event Database\", click \"Edit\" and enter the necessary database information in the fields provided.\n\n4. Click \"OK\".\n\nNote: Horizon Connection Server supports MSSQL, Oracle, and PostgreSQL database types. Consult Omnissa documentation for more detailed database setup information and minimum required privileges.","ccis":["CCI-000169","CCI-000172","CCI-001464","CCI-000130","CCI-000131","CCI-000132","CCI-000133","CCI-000134","CCI-001487","CCI-000135","CCI-001312","CCI-002234"]},{"vulnId":"V-286735","ruleId":"SV-286735r1291368_rule","severity":"high","ruleTitle":"The Horizon Connection Server must use multifactor authentication (MFA) for network access to privileged accounts.","description":"MFA creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target. Unlike a simple username/password scenario where the attacker could gain access by knowing both the username and password without the user knowing their account was compromised, multifactor authentication adds the requirement that the attacker must have something from the user, such as a token, or to biometrically be the user.\n\nMFA is defined as: using two or more factors to achieve authentication. \n\nFactors include: \n(i) something a user knows (e.g., password/PIN); \n(ii) something a user has (e.g., cryptographic identification device, token); or \n(iii) something a user is (e.g., biometric). A CAC or PKI Hardware Token meets this definition.\n\nA privileged account is defined as an information system account with authorizations of a privileged user. These accounts would be capable of accessing the web management interface.\n\nWhen accessing the application server via a network connection, administrative access to the application server must be PKI Hardware Token enabled.\n\nSatisfies: SRG-APP-000149-AS-000102, SRG-APP-000080-AS-000045, SRG-APP-000151-AS-000103, SRG-APP-000153-AS-000104, SRG-APP-000177-AS-000126, SRG-APP-000391-AS-000239, SRG-APP-000392-AS-000240, SRG-APP-000403-AS-000248, SRG-APP-000820-AS-000170, SRG-APP-000825-AS-000180","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab. For each connection server listed, select the server and click \"Edit\".\n\n4. Click the \"Authentication\" tab and scroll down to \"Horizon Administrator Authentication\".\n\n5. Find the currently configured value in the drop-down menu under \"Smart card authentication for administrators\".\n\nIf \"Smart card authentication for administrators\" is not set to \"Required\", this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab. For each connection server listed, select the server and click \"Edit\".\n\n4. Click the \"Authentication\" tab and scroll down to \"Horizon Administrator Authentication\".\n\n5. Verify the value in the drop-down menu under \"Smart card authentication for administrators\" is set to \"Required\".\n\n6. Click \"OK\".","ccis":["CCI-000765","CCI-000166","CCI-004045","CCI-000187","CCI-001953","CCI-001954","CCI-002010","CCI-004046","CCI-004047"]},{"vulnId":"V-286736","ruleId":"SV-286736r1291650_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must only allow HTTPS connections.","description":"If HTTP connections are permitted, authentication credentials, session information, administrative data, and other sensitive communications may be transmitted without encryption. Unencrypted communications are susceptible to eavesdropping, man-in-the-middle attacks, session hijacking, and data manipulation by malicious actors with access to the network path.\n\nThe Horizon Connection Server includes an optional configuration that can enable HTTP connectivity for specialized deployment scenarios, such as certain TLS off-load architectures. However, HTTP is not required for normal operation and does not provide the confidentiality and integrity protections necessary for DoW environments. Additionally, authentication mechanisms such as common access card (CAC)/Personal Identity Verification (PIV) authentication require TLS-protected communications and are not supported over HTTP connections.\n\nTo ensure the confidentiality and integrity of information transmitted between clients and the Horizon Connection Server, only HTTPS connections must be permitted. Organizations must verify that HTTP access is disabled and that all client communications are protected using approved TLS protocols and cryptographic mechanisms. This http interface is not present in the default configuration but this must be verified and maintained over time.","checkContent":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\nNote: \"\" defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.\n\n2. Verify the file \"locked.properties\" exists.\n\nIf the \"locked.properties\" file does not exist, this is a finding.\n\n3. Open \"locked.properties\" in a text editor. Find the \"serverProtocol\" setting. Verify it is set as follows:\n\nserverProtocol=https\n\nIf \"serverProtocol\" is present and not set as above, this is a finding.\n\nIf \"serverProtocol\" is not present, this is not a finding.","fixText":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\n2. Open the \"locked.properties\" file in a text editor or create it if it does not exist.\n\n3. Open \"locked.properties\" in a text editor. Remove any \"serverProtocol\" setting or set it to: serverProtocol=https\n\n4. Save and close the file. \n\n5. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-000197"]},{"vulnId":"V-286737","ruleId":"SV-286737r1291374_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must perform full path validation on server-to-server TLS connection certificates.","description":"The Horizon Connection Server performs certificate revocation checking on its own certificate and on those of the security servers paired to it. Each instance also checks the certificates of vCenter and VDI machines whenever it establishes a connection to them. If a SAML 2.0 authenticator is configured for use by a connection server instance, the connection server also performs certificate revocation checking on the SAML 2.0 server certificate.\n\nBy default, all certificates in the chain are checked except the root certificate. This must be changed so that the full path, including the root, is validated.","checkContent":"1. On the Horizon Connection Server, launch the Registry Editor.\n\n2. Traverse the registry tree to \"HKEY_LOCAL_MACHINE\\Software\\Omnissa\\Horizon\\Security\".\n\n3. Locate the \"CertificateRevocationCheckType\" key.\n\nIf the \"CertificateRevocationCheckType\" key does not exist, this is a finding.\n\nIf the \"CertificateRevocationCheckType\" key does not have a value of \"3\", this is a finding.","fixText":"1. On the Horizon Connection Server, launch the Registry Editor.\n\n2. Traverse the registry tree to \"HKEY_LOCAL_MACHINE\\Software\\Omnissa\\Horizon\\Security\".\n\n3. If the \"CertificateRevocationCheckType\" key exists:\n\na. Right-click \"CertificateRevocationCheckType\", select \"Modify...\", and set the value to \"3\".\n\nb. Click \"OK\".\n\n4. If the \"CertificateRevocationCheckType\" key does not exist:\n\na. Right-click on the \"Security\" folder and select \"New\", then \"String Value\".\n\nb. Set the name to \"CertificateRevocationCheckType\".\n\nc. Right-click \"CertificateRevocationCheckType\", select \"Modify...\" and set the value to \"3\".\n\nd. Click \"OK\".\n\n5. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-000185"]},{"vulnId":"V-286738","ruleId":"SV-286738r1294276_rule","severity":"high","ruleTitle":"The Horizon Connection Server must only use FIPS 140-3-validated cryptographic modules.","description":"Encryption is only as good as the encryption modules used. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised due to weak algorithms or poor implementation.\n\nThe Horizon Connection Server can be configured to exclusively use FIPS 140-3 validated cryptographic modules but only at installation time, not post deployment. Reference Omnissa documentation for up-to-date requirements for enabling FIPS in Omnissa Horizon.\n\nSatisfies: SRG-APP-000179-AS-000129, SRG-APP-000224-AS-000152, SRG-APP-000416-AS-000140, SRG-APP-000439-AS-000274","checkContent":"1. On the Horizon Connection Server, launch the Registry Editor.\n\n2. Traverse the registry tree to \"HKEY_LOCAL_MACHINE\\Software\\Omnissa\\Horizon\".\n\n3. Locate the \"FipsMode\" key.\n\nIf \"FipsMode\" does not exist, this is a finding.\n\nIf \"FipsMode\" does not have a value of \"1\", this is a finding.","fixText":"1. FIPS mode can only be implemented during installation.\n\n2. Redeploy the virtual machine and install the Horizon Connection Server with the FIPS mode option selected.\n\nNote: The Connection Server can only be installed in FIPS mode if Windows Server itself is running in FIPS mode. If not installed in FIPS mode initially, the recommendation is to redeploy the virtual machine, enable FIPS mode in Windows, and install the connection server rather than uninstalling and reinstalling the connection server software, as LDAP issues may occur if reinstalling the software with a different FIPS setting.","ccis":["CCI-000803","CCI-001188","CCI-002450","CCI-002418"]},{"vulnId":"V-286739","ruleId":"SV-286739r1291380_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must time out idle administrative sessions after 15 minutes or less.","description":"If communication sessions remain open for extended periods of time, even when unused, there is the potential for an adversary to hijack the session and use it to gain access to the system.\n\nHorizon Connection Server administrative sessions can and must be limited in the amount of idle time that will be allowed before an automatic logoff occurs. By default, 30 minutes of idle time is allowed, but this must be changed to 15 minutes or less (but not 0) for systems on a DoW network. This configuration must be verified and maintained over time.\n\nSatisfies: SRG-APP-000220-AS-000148, SRG-APP-000295-AS-000263","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, locate \"Horizon Console Idle Session Timeout\" under \"Horizon Console Settings\".\n\nIf the \"Horizon Console Idle Session Timeout\" value is set to more than \"15\" or \"0\", this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab.\n\n4. Click \"Edit\".\n\n5. Under \"Horizon Console Settings\", set the \"Horizon Console Idle Session Timeout\" value to \"15\" (or less), but not \"0\".\n\n6. Click \"OK\".","ccis":["CCI-001185","CCI-002361"]},{"vulnId":"V-286740","ruleId":"SV-286740r1291655_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must protect log files from unauthorized access.","description":"Error logs can contain sensitive information about system errors and system architecture that need to be protected from unauthorized access and modification.\n\nBy default, Horizon Connection Server logs are only accessible to local Windows administrators. This configuration must be verified and maintained.","checkContent":"1. On the Horizon Connection Server, navigate to:\n\n%PROGRAMDATA%\\Omnissa\\Horizon\n\n2. Right-click the \"logs\" folder and select \"Properties\".\n\n3. Click the \"Security\" tab.\n\n4. By default, only built-in system accounts such as \"SYSTEM\" and \"NETWORK SERVICE\" and the local \"Administrators\" group have access to the \"logs\" folder.\n\nIf any other groups or users have any permissions on this folder, this is a finding.","fixText":"1. On the Horizon Connection Server, navigate to: \n\n%PROGRAMDATA%\\Omnissa\\Horizon.\n\n2. Right-click the \"logs\" folder and select \"Properties\".\n\n3. Click the \"Security\" tab.\n\n4. Click \"Edit\".\n\n5. Highlight any groups or users that are not built-in system administrative accounts or the local \"Administrators\" group.\n\n6. Click \"Remove\".\n\n7. Click \"OK\".\n\n8. Click \"OK\".","ccis":["CCI-001314"]},{"vulnId":"V-286741","ruleId":"SV-286741r1291386_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must off-load events to a central log server in real time.","description":"Information system logging capability is critical for accurate forensic analysis. Centralized management of log records provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records.\n\nThe Horizon Connection Server can be configured to ship all events to a syslog receiver. Multiple servers can be configured but only the User Datagram Protocol (UDP) is supported at this time.\n\nSatisfies: SRG-APP-000358-AS-000064, SRG-APP-000108-AS-000067, SRG-APP-000125-AS-000084, SRG-APP-000126-AS-000085, SRG-APP-000360-AS-000066, SRG-APP-000515-AS-000203, SRG-APP-000795-AS-000130, SRG-APP-000181-AS-000255","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Event Configuration.\n\n3. In the right pane, locate the \"Syslog\" section with the configured syslog servers listed beneath.\n\nIf there are no valid syslog servers configured, this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Event Configuration.\n\n3. In the right pane, under \"Syslog\", click \"Add\".\n\n4. Enter the address of the central log server and configure the port as necessary.\n\n5. Click \"OK\".\n\n6. Repeat for other Connection Servers as applicable.","ccis":["CCI-001851","CCI-000139","CCI-001348","CCI-001350","CCI-001858","CCI-003831","CCI-001876"]},{"vulnId":"V-286742","ruleId":"SV-286742r1291389_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must require common access card (CAC) reauthentication after user idle timeouts.","description":"When a user session becomes inactive for an extended period, there is no assurance that the originally authenticated user remains present at the workstation or retains control of the session. An unattended or abandoned virtual desktop session may be accessed by unauthorized individuals, resulting in the disclosure, modification, or destruction of sensitive information and organizational resources.\n\nIf a session that has timed out due to inactivity can be resumed without reauthentication, an unauthorized user may be able to assume control of the existing session and continue operating under the identity of the original user. This undermines accountability, weakens nonrepudiation, and increases the risk of unauthorized access to information systems and data.\n\nTo mitigate this risk, inactive virtual desktop sessions must be locked when the inactivity timeout period is reached. Access to the locked session must require the user to reauthenticate before resources are made available again. Reauthentication verifies the identity of the user requesting access, helps prevent session hijacking, and ensures that access to organizational resources remains restricted to authorized individuals.\n\nSatisfies: SRG-APP-000400-AS-000246, SRG-APP-000389-AS-000253","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab and locate \"Enable 2 Factor Reauthentication\" under \"Client Settings\".\n\nIf the checkbox next to \"Enable 2 Factor Reauthentication\" is not checked, this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab.\n\n4. Click \"Edit\".\n\n5. Scroll down to \"Client Settings\".\n\n6. Check the checkbox next to \"Enable 2 Factor Reauthentication\".\n\n7. Click \"OK\".","ccis":["CCI-002007","CCI-002038"]},{"vulnId":"V-286743","ruleId":"SV-286743r1291392_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must be configured with a DoW-issued TLS certificate.","description":"Systems operating on DoW networks must establish trust only with certificates issued by approved Public Key Infrastructure (PKI) certification authorities. Certificates issued by untrusted, self-signed, or nonapproved certification authorities cannot provide the level of identity assurance required for DoW operations and may allow attackers to impersonate legitimate services, conduct man-in-the-middle attacks, or intercept sensitive communications.\n\nThe Horizon Connection Server uses X.509 certificates to authenticate its identity to Horizon Clients and other Horizon components. If the server presents a certificate that is not issued by a DoW-approved internal or external certification authority, clients may be unable to establish trust in the server's identity, or users may become accustomed to accepting untrusted certificates, increasing the risk of successful spoofing or credential theft.\n\nBy default, the Horizon Connection Server is installed with a self-signed certificate intended only for initial deployment and testing. Production deployments must replace the default certificate with one issued by a DoW-approved certification authority. The certificate must be installed and configured for Horizon use in accordance with Omnissa Horizon documentation, including assignment of the required \"vdm\" friendly name.\n\nSatisfies: SRG-APP-000427-AS-000264, SRG-APP-000514-AS-000137","checkContent":"1. On the Horizon Connection Server, open \"certlm.msc\" (Certificate Management - Local Computer). Certificate management for the current user will not work.\n\n2. Select Personal >> Certificates.\n\n3. In the right pane, locate the certificate with the \"Friendly Name\" of \"vdm\".\n\n4. For this certificate, locate the issuer in the \"Issued By\" column.\n\nIf the Horizon Connection Server broker certificate is not \"Issued By\" a trusted DoW certificate authority (CA), this is a finding.","fixText":"1. Obtain a web server certificate from a DoW authority, specifying the common name as the Horizon Connection server FQDN, the signing algorithm as \"SHA384\" or \"SHA512\", and the key strength of at least \"1024 bits\".\n\n2. Export the certificate and private key to a password-protected PFX bundle.\n\n3. On the Horizon Connection Server, open \"certlm.msc\" or \"certmgr.msc\" (Certificate Management - Local Computer).\n\n4. Rename the existing certificate, if it exists:\n\na. Select Personal >> Certificates, then in the right pane, locate the certificate with the \"Friendly Name\" of \"vdm\".\n\nb. Right-click this certificate, select \"Properties\", and change the \"Friendly name\" to \"vdm-original\" or something similar.\n\nc. Click \"OK\".\n\n5. Import the new certificate:\n\na. Right-click on the Personal >> Certificates folder.\n\nb. Select All Tasks >> Import.\n\nc. Click \"Next\", then \"Browse...\" and navigate to the .pfx bundle and click \"Open\".\n\nd. Click \"Next\", supply the password, select \"Mark this key as exportable\" and \"Include all extended properties\", then click \"Next\", \"Next\", then \"Finish\".\n\ne. Right-click on the newly imported certificate, select \"Properties\", then change the \"Friendly name\" to \"vdm\" (this name must match exactly in name and case).\n\nf. Click \"OK\".\n\n6. Restart the connection server or the Omnissa Horizon Connection Server service for changes to take effect.\n\nNOTE: FIPS mode requires either \"SHA384\" or \"SHA512\" for the signing algorithm. If a UAG is in use in the environment and it has been configured to meet NIAP/CFFC requirements, using a signing algorithm of \"SHA512\" may cause issues.","ccis":["CCI-002470","CCI-002450"]},{"vulnId":"V-286744","ruleId":"SV-286744r1291395_rule","severity":"medium","ruleTitle":"All Horizon components must be running supported versions.","description":"Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities.\n\nOrganizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes) to production systems after thorough testing of the patches within a lab environment.\n\nFlaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.\n\nSatisfies: SRG-APP-000456-AS-000266, SRG-APP-001035-AS-000323","checkContent":"1. Log in to the Horizon Connection Server administrative interface as an administrator.\n\n2. Navigate to Servers and select the \"Connection Servers\" tab.\n\n3. Analyze the \"Version\" column information for each Connection Server listed.\n\n4. Cross-reference the build information displayed within Omnissa's site to identify, at minimum, the oldest supported build available.\n\nIf the installed version of Horizon is not supported by Omnissa, this is a finding.","fixText":"Install or upgrade each Horizon Connection Server to a Omnissa supported version.","ccis":["CCI-002605","CCI-003376"]},{"vulnId":"V-286745","ruleId":"SV-286745r1291398_rule","severity":"medium","ruleTitle":"The Blast Secure Gateway must be configured to only support TLS 1.2 connections.","description":"Preventing the disclosure of transmitted information requires that the application server take measures to employ strong cryptographic mechanisms to protect the information during transmission. This is usually achieved using Transport Layer Security (TLS).\n\nTLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.\n\nAccording to NIST and as of publication, TLS 1.1 must not be used and TLS 1.2 will be configured.\n\nNote: Mandating TLS 1.2 may affect certain client types. Test and implement carefully.","checkContent":"1. If the Horizon Connection Server is set to \"Do not use Blast Secure Gateway\", this control is not applicable.\n\n2. On the Horizon Connection Server, navigate to: \n\n\\appblastgateway\n\nIf a file named \"absg.properties\" does not exist, this is a finding.\n\n3. Open \"absg.properties\" in a text editor and find the \"localHttpsProtocolLow\" and \"localHttpsProtocolHigh\" settings.\n\n4. Verify they are set as follows:\n\nlocalHttpsProtocolLow=tls1.2\nlocalHttpsProtocolHigh=tls1.2\n\nIf the \"localHttpsProtocolLow\" or \"localHttpsProtocolHigh\" settings do not exist or are set to nothing, this is not a finding.\n\nNOTE: \"\" defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.","fixText":"1. On the Horizon Connection Server, navigate to: \n\n\\appblastgateway\n\n2. Open or create the \"absg.properties\" file in a text editor.\n\n3. Add or update the following lines:\n\nlocalHttpsProtocolLow=tls1.2\nlocalHttpsProtocolHigh=tls1.2\n\n4. Save and close the file.\n\n5. Restart the Omnissa Horizon Blast Secure Gateway service for changes to take effect.\n\nNOTE: \"\" defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.","ccis":["CCI-001453"]},{"vulnId":"V-286746","ruleId":"SV-286746r1291401_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must force server cipher preference.","description":"By default, during the initial setup of a Transport Layer Security (TLS) connection to the Horizon Connection Server, the client sends a list of supported cipher suites in order of preference. The Connection Server then replies with the cipher suite it will use for communication, chosen from the client list.\n\nThis is not ideal because it allows the untrusted client to set the boundaries and conditions for the connection. The client could potentially specify known weak cipher combinations that would make the communication more susceptible to interception.\n\nBy adding the \"honorClientOrder\" setting to the \"locked.properties\" file, the connection server will reject the client preference and force the client to choose from the server ordered list of preferred ciphers.","checkContent":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\nNote: \"\" defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.\n\n2. Verify the file \"locked.properties\" exists.\n\nIf the \"locked.properties\" file does not exist, this is a finding.\n\n3. Open \"locked.properties\" in a text editor. Find the \"honorClientOrder\" setting. Verify it is set as follows: \n\nhonorClientOrder=false\n\nIf \"honorClientOrder\" is missing or is not set to \"false\", this is a finding.","fixText":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\n2. Open the \"locked.properties\" file in a text editor or create it if it does not exist.\n\n3. Add or change the following lines:\n\nhonorClientOrder=false\n\n4. Save and close the file. \n\n5. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-001453"]},{"vulnId":"V-286747","ruleId":"SV-286747r1294277_rule","severity":"medium","ruleTitle":"The Horizon Connection Server HTTPS Secure Tunnel must validate client and administrator certificates in the case of common access card (CAC) authentication.","description":"The Horizon Connection Server can be configured to check the revocation status of Public Key Infrastructure (PKI) certificates over both online certificate status protocol (OCSP) and certificate revocation list (CRL). This capability is disabled by default and must be enabled post-deployment.\n\nThere are also a number of other configurations that are supported, including OCSP and CRL location override but those will be site and architecture specific.\n\nThe recommended configuration is OCSP with failover to CRL and override the AIA locations via a local OCSP responder, if present.\n\nNote: The Horizon Connection Server OCSP implementation currently only supports a single certificate authority (CA) hierarchy, so an intermediate CA cannot be used. Additionally, all certificates must be signed by the same Root CA.\n\nExample settings:\n\nenableRevocationChecking=true\nocspCRLFailover=true\nocspSendNonce=true\nenableOCSP=true\nallowCertCRLs=false\ncrlLocation=http://\nocspURL=http://\nocspSigningCert=\n\nSet enableRevocationChecking to true to enable smart card certificate revocation checking.\nSet ocspCRLFailover to enable CRL checking if OCSP fails.\nSet ocspSendNonce to true to prevent OCSP repeated responses.\nSet enableOCSP to true to enable OCSP certificate revocation checking.\nSet allowCertCRLs to false to disable pulling the CRL distribution point from the certificate.\nSet crlLocation to the URL to use for the CRL distribution point.\nSet ocspURL to the URL of the OCSP Responder.\nSet ocspSigningCert to the location of the file that contains the OCSP Responder's signing certificate.","checkContent":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\n1. On the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\nNote: \"\" defaults to \"%PROGRAMFILES%\\Omnissa\\Horizon\\Server\" unless changed during installation.\n\n2. Verify the file \"locked.properties\" exists.\n\nIf the \"locked.properties\" file does not exist, this is a finding.\n\n3. Open \"locked.properties\" in a text editor. Find the \"enableRevocationChecking\" setting. Verify it is set as follows: \n\nenableRevocationChecking=true\n\nIf \"enableRevocationChecking\" is missing or is not set to \"true\", this is a finding.","fixText":"If the \"HTTP(S) Secure Tunnel\" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.\n\nOn the Horizon Connection Server, navigate to:\n\n\\sslgateway\\conf\n\n1. Open the \"locked.properties\" file in a text editor or create it if it does not exist.\n\n2. Add or change the following lines:\n\nenableRevocationChecking=true\n\n3. Save and close the file. \n\n4. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-000185"]},{"vulnId":"V-286748","ruleId":"SV-286748r1291657_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must only trust DoW issuers for Public Key Infrastructure (PKI) logins.","description":"PKI certificates have visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.","checkContent":"On the Horizon Connection Server, launch a command prompt as an administrator and execute the following commands:\n\ncd \"C:\\Program Files\\Omnissa\\Horizon\\Server\\sslgateway\\conf\"\n\"C:\\Program Files\\Omnissa\\Horizon\\Server\\jre\\bin\\keytool.exe\" -list -keystore trust.store -storepass password -v|find \"Owner\"\n\nIf any certificates in the keystore are from a non-DoW issuer, this is a finding.\n\nNote: By default, Horizon Connection Server installs to \"C:\\Program Files\". If this was changed, modify the commands above to point to the installation directory with the \"Omnissa\" root.\n\nNote: The store password is not security-relevant but can be changed, if so desired.\n\nNote: The trust store file name may be different for the site.","fixText":"1. On the Horizon Connection Server, export all current DoW root and intermediate CAs in \"base64, .cer\" format to one directory, such as \"C:\\Certs\". Launch a command prompt as an administrator and execute the following commands:\n\ncd C:\\Certs\nfor /f %a in ('dir *.cer /b') do @\"C:\\Program Files\\Omnissa\\Horizon\\Server\\jre\\bin\\keytool.exe\" -import -alias %a -file %a -keystore trust.store -noprompt -storepass password -storetype jks\nmove trust.store \"C:\\Program Files\\Omnissa\\Horizon\\Server\\sslgateway\\conf\" /Y\n\n2. Navigate to \"C:\\Program Files\\Omnissa\\Horizon\\Server\\sslgateway\\conf\" and open \"locked.properties\" in a text editor. Verify the following lines are present:\n\ntrustKeyfile=trust.store\ntrustStoretype=jks\nuseCertAuth=true\n\n3. Save the file, if necessary.\n\nNote: By default, Horizon Connection Server installs to \"C:\\Program Files\". If this was changed, modify the commands above to point to the installation directory with the \"Omnissa\" root.\n\nNote: The store password is not security relevant but can be changed, if so desired.\n\n4. Copy the keystore to all Horizon Connection Servers in the system and repeat the process to verify the settings in \"locked.properties\" on each. Omit this step if multiple connections servers are not used.\n\n5. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-004909"]},{"vulnId":"V-286749","ruleId":"SV-286749r1291677_rule","severity":"medium","ruleTitle":"The Horizon Connection Server HTTPS Secure Tunnel must reauthenticate users after a network interruption.","description":"The Horizon Connection Server provides remote access to virtual desktops, applications, and organizational resources from endpoints that may be operating outside the direct physical control of the organization. When a client connection is interrupted due to network failure, device mobility, loss of connectivity, or other communication issues, the server can no longer verify that the endpoint remains under the control of the originally authenticated user.\n\nIf a disconnected session can be resumed without reauthentication, an unauthorized individual who gains access to the endpoint or session context may be able to reconnect and assume the identity of the original user. Such access could permit unauthorized use of organizational resources, compromise accountability, and weaken the assurance that actions performed within the session are attributable to the authenticated user.\n\nRequiring reauthentication following a network interruption reestablishes the user's identity before access to the disconnected session is restored. This additional verification helps ensure that the session remains under the control of an authorized user, reduces the risk of session hijacking, and preserves accountability and nonrepudiation for actions performed within the virtual desktop environment.\n\nTo maintain the security of remote access sessions and protect organizational resources, disconnected Horizon sessions must require user reauthentication before session access is restored.","checkContent":"If the HTTPS Secure Tunnel is not enabled, this control is not applicable.\n\n1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"Security Settings\" tab.\n\nIf the \"Reauthenticate Secure Tunnel Connections After Network Interruption\" value is set to \"No\", this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"Security Settings\" tab.\n\n4. Click \"Edit\".\n\n5. Check the box next to \"Reauthenticate Secure Tunnel Connections After Network Interruption\".\n\n6. Click \"OK\".","ccis":["CCI-000366"]},{"vulnId":"V-286750","ruleId":"SV-286750r1291413_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must disconnect users after a maximum of ten hours.","description":"Horizon Connection Server is intended to provide remote desktops and applications, generally during working hours, and for no more than an extended workday. Leaving sessions active for more than what is reasonable for a work day opens the possibility of a session becoming unoccupied and insecure on the client side. For example, if a client connection is opened at 0900, there are few day-to-day reasons that the connection should still be open after 1900; therefore, the connection must be terminated. If the user is still active, they can reauthenticate immediately and continue the session for another ten hours.","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab and locate \"Forcibly Disconnect Users\" under \"Client Settings\".\n\nIf the \"Forcibly Disconnect Users\" setting is set to \"Never\", or the value of \"Forcibly Disconnect Users\" is set to anything greater than \"600\" minutes (ten hours), this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab.\n\n4. Click \"Edit\".\n\n5. Scroll down to \"Client Settings\". Next to \"Forcibly Disconnect Users\", select \"After\" from the drop-down menu and fill in \"600\" minutes (or less) in the text field.\n\n6. Click \"OK\".","ccis":["CCI-000366"]},{"vulnId":"V-286751","ruleId":"SV-286751r1291678_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must invalidate single sign-on (SSO) Credentials after 120 minutes of idle time.","description":"The Horizon Connection Server provides access to virtual desktops and applications that may remain available to users for extended periods of time. Authentication credentials and session tokens retained beyond an appropriate period of inactivity increase the risk that an unauthorized user could gain access to organizational resources by exploiting a stale or unattended session.\n\nIf cached authentication information remains valid indefinitely, users may be able to reconnect to desktops and applications without reestablishing their identity. This increases the likelihood of unauthorized access resulting from unattended workstations, compromised endpoints, shared devices, or session hijacking. Long-lived authentication artifacts also reduce assurance that the individual accessing the resource is the same individual who originally authenticated.\n\nTo limit this risk, authentication information maintained by the Horizon Connection Server must be invalidated after 120 minutes. Once the 120-minute period has elapsed, users must reauthenticate before establishing a new desktop connection. Requiring periodic reauthentication helps maintain positive user identification, reduces the exposure associated with stale credentials, and preserves accountability for access to organizational resources.","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab and locate \"Disconnect Applications and Discard SSO Credentials for Idle Users\" under \"Single Sign-On (SSO) Settings\".\n\nIf the \"Disconnect Applications and Discard SSO Credentials for Idle Users\" setting is set to \"Never\", or the value of \"Disconnect Applications and Discard SSO Credentials for Idle Users\" is set to anything greater than \"120\" minutes (two hours), this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab.\n\n4. Click \"Edit\".\n\n5. Scroll down to \"Single Sign-On (SSO) Settings\".\n\n6. Under \"Disconnect Applications and Discard SSO Credentials for Idle Users\", select \"After\" from the drop-down menu and fill in \"120\" minutes (or less) in the text field.\n\n7. Click \"OK\".","ccis":["CCI-000366"]},{"vulnId":"V-286752","ruleId":"SV-286752r1291679_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must discard single sign-on (SSO) credentials after 15 minutes.","description":"The Horizon Connection Server temporarily caches user authentication information to facilitate SSO access to entitled virtual desktops and applications following successful authentication to the broker. While this capability improves usability by reducing the number of authentication prompts presented to the user, retention of authentication information for extended periods increases the risk of unauthorized access.\n\nIf cached SSO credentials remain available for an excessive amount of time, an unauthorized user who gains access to the client device, active session, or authentication context may be able to access virtual desktops and applications without independently proving their identity. Extended credential caching reduces assurance that access requests originate from the authenticated user and increases the potential impact of unattended workstations, compromised endpoints, or session hijacking.\n\nTo minimize this risk, cached SSO credentials must be retained only for the minimum period necessary to support the intended user experience. Authentication information cached by the Horizon Connection Server must be discarded after 15 minutes. Once the 15-minute period has elapsed, users must reauthenticate before establishing new desktop or application sessions, even if they remain connected to the broker. This requirement helps maintain positive user identification, reduces exposure associated with cached credentials, and preserves accountability for access to organizational resources.","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab and locate \"Discard SSO credentials\" under \"Single Sign-On (SSO) Settings\".\n\nIf the \"Discard SSO Credentials\" setting is set to \"Never\", or the value of \"Discard SSO Credentials\" is set to anything greater than 15 minutes, this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Global Settings.\n\n3. In the right pane, click the \"General Settings\" tab.\n\n4. Click \"Edit\".\n\n5. Scroll down to \"Single Sign-On (SSO) Settings\".\n\n6. Under \"Discard SSO Credentials\", select \"After\" from the drop-down menu and fill in \"15\" minutes in the text field.\n\n7. Click \"OK\".","ccis":["CCI-000366"]},{"vulnId":"V-286753","ruleId":"SV-286753r1291422_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must not allow \"Log On As Current User\".","description":"The Horizon Connection Server supports a \"Log On As Current User\" capability that allows a Horizon Client to use the credentials associated with the user's local endpoint session to authenticate to the Horizon environment. While this feature can improve user convenience by reducing authentication prompts, it reduces the assurance that the user accessing Horizon resources has been independently and currently authenticated by the Horizon infrastructure.\n\nWhen \"Log On As Current User\" is enabled, the Horizon Connection Server relies on the authentication state of the endpoint rather than requiring the user to directly authenticate to the Horizon environment. As a result, the server may be unable to verify the authentication method used at the endpoint, determine whether current organizational authentication requirements have been satisfied, or ensure that certificate-based credentials remain valid and have not been revoked since the endpoint session was established.\n\nUse of endpoint-derived credentials may also increase the risk of unauthorized access from unattended, compromised, or improperly authenticated systems. Requiring users to authenticate directly to the Horizon Connection Server ensures that current authentication policies, certificate validation requirements, account restrictions, and revocation checks are consistently enforced at the time access to Horizon resources is requested.\n\nTo maintain strong user authentication and ensure compliance with organizational identity assurance requirements, the \"Log On As Current User\" capability must be disabled.","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab.\n\n4. For each connection server listed, select the server and click \"Edit\".\n\n5. Click the \"Authentication\" tab.\n\n6. Locate the \"Accept logon as current user\" checkbox under \"Current User Authentication\".\n\nIf the \"Accept logon as current user\" checkbox is checked, this is a finding.\n\nNote: When \"Smart card authentication for users\" is set to \"Required\", this setting is automatically disabled and greyed out, and this control would be not applicable.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab.\n\n4. For each connection server listed, select the server and click \"Edit\".\n\n5. Click the \"Authentication\" tab.\n\n6. Locate the \"Accept logon as current user\" checkbox under \"Current User Authentication\".\n\n7. Uncheck the checkbox next to \"Accept logon as current user\".\n\n8. Click \"OK\".","ccis":["CCI-000366"]},{"vulnId":"V-286754","ruleId":"SV-286754r1291681_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must require DoW Public Key Infrastructure (PKI) for client logins.","description":"Before clients can select a desktop or application to access, they must first authenticate to the broker, which is the connection server itself. If the client is accessing the broker directly, then the allowed authentication methods must be specified. These include RADIUS, SecurID, username/password and smart card.\n\nIn the DoW, common access card (CAC) login must be enforced at all times, for all client connections. This can be accomplished through the native capabilities of the connection server or through a paired (separately configured) SAML 2.0 IdP.\n\nIf the client is connecting through the Unified Access Gateway (UAG) appliance, this requirement does not apply.","checkContent":"If the connection server is paired with a UAG that is performing authentication, this requirement is not applicable.\n\n1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab.\n\n4. For each connection server listed, select the server and click \"Edit\".\n\n5. Click the \"Authentication\" tab.\n\n6. Locate the drop-down for \"Smart card authentication for users\" under \"Horizon Authentication\".\n\nIf \"Smart card authentication for users\" is set to \"Optional\" or \"Not Allowed\", a SAML Authenticator must be configured, and that external IdP must be configured to require CAC authentication. If these requirements are not met, this is a finding.\n\nIf \"Smart card authentication for users\" is set to \"Required\" on each of the listed Connection Servers, this is not a finding.\n\nIf another form of DoW-approved PKI is used and configured to be required for client logins, this is not a finding.","fixText":"If the connection server is paired with a UAG that is performing authentication, this requirement is not applicable.\n\nOption One - Use Horizon's native CAC authentication:\n\n1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab.\n\n4. For each connection server listed, select the server and click \"Edit\".\n\n5. Click the \"Authentication\" tab.\n\n6. Under \"Horizon Authentication\", in the drop-down below \"Smart card authentication for users\", select \"Required\".\n\n7. Click \"OK\".\n\nOption Two - Delegate CAC authentication to an external IdP:\n\n1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab.\n\n4. For each connection server listed, select the server and click \"Edit\".\n\n5. Click the \"Authentication\" tab.\n\n6. Under \"Horizon Authentication\", in the drop-down under \"Smart card authentication for users\", select \"Optional\" or \"Not Allowed\".\n\n7. In the drop-down under \"Delegation of authentication to Horizon (SAML 2.0 Authenticator)\", select \"Allowed\" or \"Required\" depending on the native capability settings in the previous step.\n\n8. Click \"Manage SAML Authenticators\".\n\n9. Click \"Add\", then complete the necessary fields.\n\n10. Verify \"Enabled for Connection Server\" is checked, then click \"OK\" on each subsequent screen to save the settings.\n\n11. Restart the Omnissa Horizon Connection Server service for changes to take effect.","ccis":["CCI-000366"]},{"vulnId":"V-286755","ruleId":"SV-286755r1291428_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must backup its configuration daily.","description":"Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.\n\nTo ensure the server configuration can be validated or reconfigured in the event of a security related incident, the server configuration must be backed up on a daily basis.","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab.\n\n4. For each connection server listed, select the server and click \"Edit\".\n\n5. Click the \"Backup\" tab.\n\n6. Verify that \"Automatic backup frequency\" is set to a least \"Every day\".\n\nIf the connection server is not set to be backed up daily (or less), this is a finding.","fixText":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Servers.\n\n3. In the right pane, select the \"Connection Servers\" tab.\n\n4. For each connection server listed, select the server and click \"Edit\".\n\n5. Click the \"Backup\" tab.\n\n6. Under \"Automatic backup frequency\" select a time period that is \"Every day\" or more frequent.\n\n7. Click \"OK\".","ccis":["CCI-000366"]},{"vulnId":"V-286756","ruleId":"SV-286756r1291431_rule","severity":"medium","ruleTitle":"The Horizon Connection Server Instant Clone domain account must be configured with limited permissions.","description":"Configuring the application to implement organizationwide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoW that reflects the most restrictive security posture consistent with operational requirements.\n\nIf Instant Clones are used within the Horizon environment, an Active Directory User Account must be created that will be used to manage cloned Computer objects in Active Directory. Following least privilege best practices, this User Account must only be able to perform operations on Computer objects within a specified container in Active Directory.","checkContent":"1. Log in to the Horizon Connection Server Console.\n\n2. From the left pane, navigate to Settings >> Domains.\n\n3. In the right pane, click the \"Domain Accounts\" tab.\n\n4. Validate the accounts listed are User accounts in Active Directory and have only the following permissions on the specified Instant Clone container:\n\nList Contents\nRead All Properties\nWrite All Properties\nRead Permissions\nReset Password\nCreate Computer Objects\nDelete Computer Objects\n\n5. Verify the permissions apply to the correct container and to all child objects of the container.\n\nIf the Instant Clone domain account has more than the minimum required permissions, this is a finding.\n\nIf Instant Clones are not used, this is not applicable.","fixText":"1. Log in to Active Directory Users and Computers.\n\n2. Navigate to the specified Instant Clone container.\n\n3. Set the permissions for the Instant Clone Domain Account to:\n\nList Contents\nRead All Properties\nWrite All Properties\nRead Permissions\nReset Password\nCreate Computer Objects\nDelete Computer Objects\n\n4. Verify the permissions apply to the correct container and to all child objects of the container.","ccis":["CCI-000366"]},{"vulnId":"V-286757","ruleId":"SV-286757r1291659_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must disable client initiated TLS renegotiation.","description":"The SSL/TLS renegotiation vulnerability is a potential cyber threat in cases when a client can initiate a renegotiation process. An attacker can abuse this situation by making the server unavailable with a Denial of Service attack or can execute a Man-in-the-Middle injection attack into the HTTPS sessions. To avoid potential TLS Renegotiation Denial-of-Service attacks the Client Initiated TLS renegotiation setting must be disabled.\n\nNote: The Horizon Connection Server disables this option by default.","checkContent":"1. On the Horizon Connection Server, launch the Registry Editor.\n\n2. Traverse the registry tree to \"HKEY_LOCAL_MACHINE\\Software\\Omnissa\\Horizon\\Plugins\\wsnm\\TunnelService\\Params\".\n\n3. Locate the \"JvmOptions\" key.\n\nIf \"JvmOptions\" does not exist or the path does not exist, this is not a finding.\n\nIf \"JvmOptions\" exists and does not include the \"-Djdk.tls.rejectClientInitiatedRenegotiation=true\" option, this is a finding.","fixText":"1. On the Horizon Connection Server, launch the Registry Editor.\n\n2. Traverse the registry tree to \"HKEY_LOCAL_MACHINE\\Software\\Omnissa\\Horizon\\plugins\\wsnm\\TunnelService\\Params\".\n\n3. Locate the \"JvmOptions\" key.\n\n4. If \"JvmOptions\" exists, right-click \"JvmOptions\", select \"Modify...\", and ensure the following option exists:\n\n-Djdk.tls.rejectClientInitiatedRenegotiation=true\n\n5. Click \"OK\".","ccis":["CCI-000366"]},{"vulnId":"V-286758","ruleId":"SV-286758r1291660_rule","severity":"medium","ruleTitle":"The Horizon Connection Server must have X-Frame-Options enabled.","description":"The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a ,