V-286736

Discussion

If HTTP connections are permitted, authentication credentials, session information, administrative data, and other sensitive communications may be transmitted without encryption. Unencrypted communications are susceptible to eavesdropping, man-in-the-middle attacks, session hijacking, and data manipulation by malicious actors with access to the network path. The Horizon Connection Server includes an optional configuration that can enable HTTP connectivity for specialized deployment scenarios, such as certain TLS off-load architectures. However, HTTP is not required for normal operation and does not provide the confidentiality and integrity protections necessary for DoW environments. Additionally, authentication mechanisms such as common access card (CAC)/Personal Identity Verification (PIV) authentication require TLS-protected communications and are not supported over HTTP connections. To ensure the confidentiality and integrity of information transmitted between clients and the Horizon Connection Server, only HTTPS connections must be permitted. Organizations must verify that HTTP access is disabled and that all client communications are protected using approved TLS protocols and cryptographic mechanisms. This http interface is not present in the default configuration but this must be verified and maintained over time.

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor. Find the "serverProtocol" setting. Verify it is set as follows:

serverProtocol=https

If "serverProtocol" is present and not set as above, this is a finding.

If "serverProtocol" is not present, this is not a finding.