V-286746

Discussion

By default, during the initial setup of a Transport Layer Security (TLS) connection to the Horizon Connection Server, the client sends a list of supported cipher suites in order of preference. The Connection Server then replies with the cipher suite it will use for communication, chosen from the client list. This is not ideal because it allows the untrusted client to set the boundaries and conditions for the connection. The client could potentially specify known weak cipher combinations that would make the communication more susceptible to interception. By adding the "honorClientOrder" setting to the "locked.properties" file, the connection server will reject the client preference and force the client to choose from the server ordered list of preferred ciphers.

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor. Find the "honorClientOrder" setting. Verify it is set as follows: 

honorClientOrder=false

If "honorClientOrder" is missing or is not set to "false", this is a finding.