So this is part two of my securing XenApp enviroment, this time I’ve moved my focus to Storefront. Now how does Storefront need to be secured ?
In most cases, Storefront is the aggregator that allows clients to connect to a citrix infrastructure. Im most cases the Storefront is located on the internal network and the Netscaler is placed in DMZ. Even if Storefront is located on the internal network and the firewall and Netscaler does alot of the security work, there are still things that need to be take care of on the Storefront.
In many cases many users also connect to the Storefront directly if they are connected to the internal network. Then they are just bypassing the Netscaler. But since Storefront is a Windows Server there are alot of things to think about.
So where to begin.
1: Setting up a base URL with a HTTPS certificate (if you are using a internal signed certificate make sure that you have a proper set up Root CA which in most cases should be offline. Or that you have a public signed third party CA. Which also in many cases is useful because if users are connecting directly to Storefront their computers might not regonize the internally signed CA.
2: Remove the HTTP binding on the IIS site. To avoid HTTP requests.
Use a tool like IIS crypto to disable the use of older SSL protocols on IIS server and older RC ciphers
You can also define ICA file signing. This allows for Citrix Receiver clients which support signed ICA files to verify that the ICA fiels they get comes from a verified source. http://support.citrix.com/proddocs/topic/dws-storefront-25/dws-configure-conf-ica.html
3: We can also setup so that Citrix Receiver is unable to caching password, this can be done by changing authenticate.aspx under C:inetpubwwwrootCitrixAuthenticationViewsExplicitForms
and you change the following parameter
<% Html.RenderPartial(“SaveCredentialsRequirement”,
SaveCredentials); %>
<%– Html.RenderPartial(“SaveCredentialsRequirement”,
SaveCredentials); –%>
4: Force ICA connections to go trough Netscaler using Optimal Gateway feature of Storefront –> http://support.citrix.com/article/CTX200129 using this option will also allow you to use Insight to monitor clients connection to Citrix as well, and depending on the Netscaler version give you some historical data.
And with using Windows pass-trough you can have Kerberos authenticating to the Storefront and then have ICA sessions go trough the Netscaler –> http://support.citrix.com/article/CTX133982
5: Use SSL in communication with the delivery controllers –> http://support.citrix.com/proddocs/topic/xendesktop-7/cds-mng-cntrlr-ssl.html
6: Install Dynamic IP restrictions on the IIS server, this stops DDoS happning against Storefront from the same IP-address
7: Windows updated! and Antivirus software running (Note that having Windows updated, having some sort of antivirus running with limited access to the server) also let the Windows Firewall keep runnign and only open the necessery ports to allow communication with AD, Delivery Controllers and with Netscaler.
8: Define audit policies to log (Credential validation, Remote Desktop connections, terminal logons and so on) https://technet.microsoft.com/en-us/library/dn319056.aspx
9: Use the Storefront Web Config GUI from Citrix to define lockout and session timeout values
10: Use a tool like Operations Manager with for instance ComTrade to monitor the Storefront Instances. Or just the IIS management pack for IIS, this gives some good insight on how the IIS server is operating.
11: Make sure that full logging is enabled on the IIS server site.
Stay tuned for more, next part is the delivery controllers and the VDA agents.