Rule ID
SV-286745r1291398_rule
Version
V1R1
CCIs
Preventing the disclosure of transmitted information requires that the application server take measures to employ strong cryptographic mechanisms to protect the information during transmission. This is usually achieved using Transport Layer Security (TLS). TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems. According to NIST and as of publication, TLS 1.1 must not be used and TLS 1.2 will be configured. Note: Mandating TLS 1.2 may affect certain client types. Test and implement carefully.
1. If the Horizon Connection Server is set to "Do not use Blast Secure Gateway", this control is not applicable. 2. On the Horizon Connection Server, navigate to: <install_directory>\appblastgateway If a file named "absg.properties" does not exist, this is a finding. 3. Open "absg.properties" in a text editor and find the "localHttpsProtocolLow" and "localHttpsProtocolHigh" settings. 4. Verify they are set as follows: localHttpsProtocolLow=tls1.2 localHttpsProtocolHigh=tls1.2 If the "localHttpsProtocolLow" or "localHttpsProtocolHigh" settings do not exist or are set to nothing, this is not a finding. NOTE: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.
1. On the Horizon Connection Server, navigate to: <install_directory>\appblastgateway 2. Open or create the "absg.properties" file in a text editor. 3. Add or update the following lines: localHttpsProtocolLow=tls1.2 localHttpsProtocolHigh=tls1.2 4. Save and close the file. 5. Restart the Omnissa Horizon Blast Secure Gateway service for changes to take effect. NOTE: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.