Archives

Try XenApp for free from the Application Delivery Cloud

I previously posted the steps to prepare your own XenApp server in the Cloud. Having gone through the process of creating additional servers in the cloud for my lab, I figured I would create some and make them publicly available for you to try. If there is an application you want streamed from the cloud to your device, comment, and I will do my best to get it loaded onto the server. Whether you are located in the Americas, Europe or Asia Pacific, Amazon has a platform for you, and Citrix has a XenApp Application Delivery Cloud waiting you.

Americas	Europe	Asia

The Citrix Community is powerful!

Configuring a backup persistence method

The NetScaler Load Balancer uses the backup persistence option when the primary persistence fails. For example, the primary persistence type is set to Cookie Insert, and backup persistence is set to Source IP. When the client browsers do not support cookies, Source IP persistence is used. To set the backup persistence option to Source IP, you must set the primary persistence to Cookie Insert.

If the traffic comes from behind a Network Address Translation (NAT) device or proxy, the traffic appears to come from a single source IP address and cannot be distributed evenly.

Backup persistence has a time-out value that you can set when the primary persistence type is set to COOKIEINSERT or RTSP session ID persistence, and the backup persistence type is set to SOURCEIP.

The NetScaler uses the backup persistence if the cookie or RTSP session ID is missing in the header.

To set backup persistence for a virtual server by using the NetScaler command line

At the NetScaler command prompt, type:
set lb vserver <vserverName> -persistenceType <PersistenceType> -persistenceBackup <BackupPersistenceType>
Example
set lb vserver Vserver-LB-1 -persistenceType CookieInsert -persistenceBackup SourceIP

To set backup persistence for a virtual server by using the configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure backup persistence (for example, Vserver-LB-1), and then click Open.
3. The Configure Virtual Server (Load Balancing) dialog box, click the Method and Persistence tab.
4. In the Persistence list, select COOKIEINSERT and in the Time-out text box, type the time-out value (for example, 20).
5. In the Backup Persistence list, select the backup persistence that you want to configure (for example, SOURCEIP).
6. In the Backup Time-out and Netmask text boxes type the backup time-out value and netmask (for example, 20 and 255.255.255.255).
7. Click OK.

Download the Citrix Load Balancer here

The Citrix Community is powerful!

hacking tool for Wordpress

Since the rollout of social media and blogging, I have wondered “why aren’t these sites using SSL”. When I told my wife my facebook account got hacked, she didn’t believe me. Then her’s got hacked. Session Hijacking has been around for a while now, so it’s nothing new, but the hacking tool Firesheep, an extension to Firefox, is a new illustration of that vulnerability. It has built in strings to capture session keys from all of the favorite web sites, including twitter, facebook and wordpress among others. This is not just about social sites, it is about Enterprise apps also, being exposed. Companies are using Twitter, Facebook and Wordpress as business tools. So it is now an Enterprise security issue, a real risk to applications that run the business. And with many of our execs going mobile, they are using these tools from places with open WiFi such as airports, coffee shops and hotels. Fixing the threat is easy, by putting a NetScaler VPX in front of these site(s) and automatically redirecting HTTP to HTTPS. Here are the steps necessary to implement the fix, along with a video that shows how easy it is to hack using session hijacking, and how easy it is to fix this problem.

Steps for securing Wordpress with SSL – Wordpress hosted at a service provider:

1. Download and install XenServer
2. Download and install NetScaler VPX for XenServer
3. Install SSL Certificate on the NetScaler
4. Create a Load Balancing VIP with new publicly routable IP Address
5. Edit DNS entry for your wordpress site to point to the NetScaler Load Balancing VIP
6. Set Service to the IP Address of your wordpress site at the service provider
7. Set Load Balancing VIP port 80 to automatically redirect to port 443

Connect to http://<yourwordpresssite.com> and it should automatically redirect to https://<yourwordpresssite.com>.

Steps for securing Wordpress with SSL – Wordpress hosted in your own DMZ:

1. Download and install XenServer
2. Download and install NetScaler VPX for XenServer
3. Install SSL Certificate on the NetScaler
4. Create a Load Balancing VIP with a new publicly routable IP Address
5. Edit DNS entry for your wordpress site to point to the NetScaler Load Balancing VIP
6. Set the Service to point to the IP Address of your locally hosted wordpress site
7. Set Load Balancing VIP port 80 to automatically redirect to port 443

Connect to http://<yourwordpresssite.com> and it should automatically redirect to https://<yourwordpresssite.com>.

Its easy

Download XenServer here

Donwload NetScaler VPX here

The Citrix Community is powerful!

for Video over WAN

The Citrix Branch Repeater plays a critical role in optimizing an existing WAN connection and improving the overall virtual desktop user experience in the branch office. The following key findings from a recent report emphasize the strategic cost savings and performance improvement a Branch Repeater solution can provide for any branch office XenDesktop deployment.

• Citrix Branch Repeater can reduce the overall average bandwidth consumed per session by up to 89%.
• Citrix Branch Repeater can reduce the amount of time it takes for a XenDesktop session to launch on a congested WAN connection by up to 40%.
• Citrix Branch Repeater can double the number of users able to execute similar virtual desktop activities on the same congested WAN connection.
• Citrix Branch Repeater can reduce the amount of time it takes for the print request to spool from the virtual desktop to the branch office print server by up to 60%.

Optimized Video Delivery

Citrix Branch Repeater is a branch optimization solution that accelerates and simplifies branch infrastructure. Branch Repeater solutions reduce IT costs and increase user productivity by simplifying branch startup and management, and providing users the best access experience. The Branch Repeater products achieve WAN optimization by combining a variety of technologies:

• TCP Optimization: Branch Repeater is a symmetric solution, where a Branch Repeater is located at each end of the WAN connection (in the datacenter and in the branch office) recognize each other’s presence and employ RFC compliant TCP optimization techniques that ensure optimal utilization of the network bandwidth.
• Traffic Prioritization (QoS): Administrators can classify network bandwidth based on TCP port numbers and IP ranges to prioritize the delivery of TCP segments based on the classification. Furthermore, Branch Repeater recognizes the priorities of the various ICA virtual channels and can ensure preferential treatment of real-time critical data such as audio.
• Compression: Branch Repeater can detect repeating patterns in the transmitted data and utilize very small tokens across the WAN to identify such repeating data patterns and serve the data to the user out of the appliance memory; therefore, restricting the amount of data required to traverse the WAN and improving user experience.
• Protocol Optimization: Branch Repeater can optimize a variety of common application protocols. Citrix XenDesktop leverages the ICA protocol, which employs a variety of optimization and security features natively. In order to apply compression, a WAN optimizer must be able to decrypt the ICA workload, identify repeating patterns within the ICA virtual channels, apply the optimization, and re-encrypt the data stream. This is why Citrix Branch Repeater is the only WAN optimization product capable of directly optimizing the ICA payloads on the protocol level.

Citrix High Definition (HDX)

Citrix is committed to providing the best high definition user experience through the introduction of HDX technology. Citrix HDX technology builds on existing Citrix user experience innovations from the datacenter to the device, adding enhancements for multimedia, voice, video and 3D graphics. Citrix HDX is comprised the following categories:

• HDX Broadcast – Ensures high-performance of virtual desktops and applications over any network, including high-latency and low-bandwidth environments.
• HDX WAN Optimization – Optimizes performance by utilizing Citix Branch Repeater to cache bandwidth intensive data and graphics and deliver them from the most efficient location.
• HDX MediaStream – Accelerates multimedia performance through compression or, when possible, redirection and client-side rendering.
• HDX RealTime – Enhances real-time voice and video using advanced encoding and streaming to ensure a no compromise end-user experience.
• HDX 3D – Optimizes the performance of everything from graphics-intensive 2D environments to advanced 3D geospatial applications using software and hardware based rendering in the datacenter and on the device.
• HDX Plug-n-Play – Enables simple connectivity for all local devices in a virtualized environment, including USB, multi-monitor, printers and peripherals.

Read the performance report here

Download the free Branch Repeater VPX Express virtual appliance

Read about HDX here

Get the optimized video delivery technology here

The Citrix Community is powerful!

Recommended by NIST for January 2011

Beginning January 1st, 2011, the NIST (National Institute of Standards & Technology) recommends all SSL certificates be upgraded to 2048-bit strength To protect data confidentiality. This transition can have a significant impact on performance and capacity of your SSL infrastructure.

Join us Wednesday, November 10th, 2:00pm Eastern/11:00am Pacific and discover how to efficiently manage this change and what actions you need to take now that will ease the transition to 2048-bit, and still maintain the highest performance and security standards.

In this TechTalk, learn about:

• Why SSL/TLS is moving to 2048-bit certificates and the impact on your organization
• How a major web hosting provider, GoDaddy.com is managing the transition to 2K certificates
• Recommendations and examples of Citrix NetScaler SSL/TLS features

Details:

TechTalk: 2048 bit SSL Certificates – Are you ready?
When: Wednesday, November 10, 2010 2:00 PM – 3:00 PM EST
Where: Register at http://www.citrix.com/sslcertwebinar
Speaker: Kurt Roemer, Chief Security Strategist, Citrix Systems

Get the most powerful SSL Performance here.

The Citrix Community is powerful!

Sprint, HTC, RIM, Samsung, Motorola

If you’ve been paying attention, you know that Citrix Receiver runs anyapplication, on anydevice, anywhere. If you are in Silicon Valley, you can see it in action by attending the session to be delivered by Chris Fleck of Citrix, at the Sprint Developer Conference. Mobile devices continue to proliferate across the enterprise creating new business challenges for users, IT and developers. Users want their devices to empower them to do more than just read e-mail and browse the web. They want simple and fast access to documents and the ability to run their business applications. IT needs a secure and scalable infrastructure for delivering business apps to mobile devices, anytime and anywhere. Developers want a common platform to create applications without duplication and little additional resources.

With Citrix Receiver™, accessing applications hosted on Citrix XenApp provides a common platform that both IT and developers can utilize to minimize development, run applications centrally and securely deliver apps to any device. The Citrix Receiver connects securely to the XenApp server using Citrix NetScaler SSL VPN technology.

In this session you will learn

• How to use existing development tools and resources like Visual Studio, Flash and Java to create business applications for any device
• How to use alternative, non-development tools to create compelling business applications and dashboards
• How Citrix Receiver enables tablets, smartphones, and other devices to quickly and securely enter the workplace
• How to optimize existing applications for Android, BlackBerry and even iPhone
  Session Demos: Citrix Receiver on Android and Blackberry devices: www.citrix.com/receiver

Session: Citrix: Build Once, Run Centrally and Deliver Business Applications Anywhere with Citrix Receiver
When: Tuesday, October 26, 2010 | 4:15 – 5:15 p.m.
Where: Santa Clara Convention Center, Room K
Who: Chris Fleck – VP Community & Solutions Development, Citrix Systems

Samsung Devices (Epic 4G Handsets, Transform Sprint ID Handset, Galaxy Tab)

Stop by the Samsung booth in the exhibit hall or attend the Samsung session Wed Oct 27, 10:00-11:00, and provide your contact information via business card to be eligible to win one of multiple Samsung Epic 4G handsets or Samsung Galaxy Tab Android Tablets via a business card drawing in the Samsung Booth and Samsung breakout session.

In addition, Samsung Epic and Transform handsets will be raffled off to attendees of the Android Coding Session, Thur 2:30-5:30.

A limited number of Samsung Galaxy Tab (Sprint’s first Android powered tablet) will be raffled off to Android Coding session attendees who have downloaded the Samsung Galaxy Tab SDK/Emulator http://innovator.samsungmobile.com/galaxyTab.do. Sprint employees will validate the emulator configuration on android coding session attendee laptops as attendees enter the android coding session.

HTC EVO 4G

Stop by the HTC booth in the exhibit hall or attend the HTC session Wed Oct 27, 11:15-12:15, and provide your contact information via business card to be eligible to win one of multiple HTC EVO 4G handsets via a business card drawing.

HTC will also be raffling off a limited number of HTC EVO 4G handsets following their presentation in the Android Coding Camp, Thur 2:30-5:30.

Motorola I1 (the first iDEN Android PTT capable handset.)

Forty attendees of the Motorola Motodev Session on Wed, Oct 27, 4:00-5:00 will be eligible to receive a Motorola I1 device. Specific information about how the devices will be awarded will be shared in the session itself. Must be present at the breakout session to be eligible for the device giveaway.

RIM Style (first Sprint RIM Blackberry 6.0 OS device, not yet available to the public)

This information is COMING SOON.

Get Citrix Receiver here

Get Citrix XenApp here

Get the most powerful Citrix Receiver Proxy here.

The Citrix Community is powerful!

Integrated with NetScaler HTTP Callout

Ever wonder, with all of this networking security, who is protecting the information at the endpoint, before it enters the VPN stack? Ever heard of Keyloggers and Framegrabbers? API’s that can read your passwords? (Even when connected to an SSL VPN or to a web application using HTTPS). You’re not out of the woods yet until you secure your internet browser, on your local machine. Internet Explorer, Chrome, Safari and Firefox don’t have this protection natively, so you will want to read this.

Quaresso Protect On Q enables web sites to mitigate information compromise risks introduced by web browsers, and by extension end users. Browsers have become the target or vector of many styles of attacks. While SSL protected packets (i.e., HTTP/S) and data center security solutions (e.g., web application firewalls) can significantly increase protections against compromise, the end point has become the relative weak link in this three link chain. Why? Some of the reasons:

• Breadth and depth of attacks – the monetization of malware have increased the number and sophistication level of attacks. Vulnerabilities, both in the code of browsers as well as plug-ins along with new methods of social engineering have increased year over year.
• Decreased efficacy of traditional anti-virus solutions – many recent studies have shown that the growth in the number of in-the-wild attacks have increased the vulnerability window for users.
• Increase in data at risk – more and more organizations are making heretofore sensitive content available across the Internet, whether customer-focused content like banking transactions, health care information or equity trades or enterprise content such as product design documents, customer account databases, internal communications like email. This creates a financial motivation for attackers.
• Lack of visibility – Although browser vendors have done a credible job of adding security features to their products in an attempt to mitigate the browsers’ vulnerabilities, high assurance web sites have very few tools to ensure users have enabled such features or have configured them correctly.

Protect On Q takes a fundamentally different approach to solve the problem of browser insecurity. Instead of relying on end users or the security state of users’ PCs, web sites with Protect On Q can take control of the client side risk by quickly delivering an ephemeral (i.e., temporary) security layer around the browsers that connect to their site. This layer – implemented as a protected browser – is controlled by the web sites via a site specific policy. It requires no extraordinary requirements of the end user or local system and does not require permanent software installation, minimizing operational overhead and desktop support complexity.

POQ provides the following security features:

• Keylogger/Framegrabber Defense
• Browser Privacy
• Browser Process Integrity
• SSL Certificate White Listing
• SSL User Orverride
• Network Destination Controls
• Hostname Resolution Bypass
• Information Leakage and Auditing
• Session Time Limits
• Blocking COM Snooping

The diagram below depicts the Protect On Q (POQ) architecture in a typical POQ usage scenario

• The NetScaler automatically redirects HTTP (cleartext) requests to HTTPS (encrypted). This protects the information in transit to the website.
• Request is made to https://citrix.demo.quaresso.com.
• The NetScaler intercepts the request, and determines if the browser is armored already. If not,…
• A page appears that explains to the user that they need the POQ armored browser before they access that application/website.
• The armored browser is started.
• The users session is then sent to the original request https://citrix.demo.quaresso.com using the armored browser.
• All requests to that website are sent to the HTTP Callout, including HTML, images, css, Javascript, etc.
• The NetScaler checks for a POQ-Verified value.
• The value is extracted from the “QuaressoPOQSessionID” and an HTTP Callout request is sent to the REST API, to verify that the POQ server did in fact sign that user agent value, and then allows or denies further access.

During the armored browser session:

• User must use an armored browser for the website/application https://citrix.demo.quaresso.com.
• User cannot navigate to other sites while using the armored browser.
• User cannot navigate to invalid certificate sites (certificate whitelisting).
• Information controls prevent saving, printing, pasting or copying information from the application/website through the armored browser.
• Malware detection is enabled preventing screen captures and keyloggers (however, we made a whitelist exception to record the video).

Watch it in action

Citrix NetScaler Process Flow

Citrix NetScaler Configuration

# HTTP Callout Policies
add policy httpCallout QuaressoCallout
add policy httpCallout poq_valid_session_id
set policy httpCallout QuaressoCallout -IPAddress 63.110.51.85 -port 8080 -returnType TEXT -hostExpr "\"63.110.51.85\"" -urlStemExpr "\"/poqserver/rest/\" + HTTP.REQ.HEADER(\"QuaressoPOQSessionID\") + \"/isValid\"" -resultExpr "HTTP.RES.BODY(5)"
set policy httpCallout poq_valid_session_id -IPAddress 63.110.51.85 -port 8080 -returnType TEXT -hostExpr "\"QuaressoCallout.ns.com\"" -urlStemExpr "\"/poqserver/rest/session/\" + HTTP.REQ.HEADER(\"QuaressoPOQSessionID\") + \"/isValid\"" -resultExpr "HTTP.RES.BODY(5)"
# Server Setup
add server 63.110.51.85 63.110.51.85
add server 63.110.51.87 63.110.51.87
add service HTTPS 63.110.51.87 SSL 443 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
add service POQServer 63.110.51.85 HTTP 8080 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
add service badstore 63.110.51.87 HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
set rewrite param -undefAction NOREWRITE
# Load Balancing Virtual Servers
add lb vserver QuaressoVIP HTTP 63.110.51.92 80 -persistenceType NONE -redirectURL "https://citrix.demo.quaresso.com/" -cltTimeout 180
add lb vserver QuaressoVIP-HTTPS SSL 63.110.51.92 443 -persistenceType NONE -cltTimeout 180
add lb vserver QuaressoVIP-POQServer SSL 63.110.51.92 8443 -persistenceType NONE -cltTimeout 180
# Responder Policies
add responder action invalidPOQKey_action respondwith "\"HTTP/1.1 200 OK\r\\r\\nContent-length: 116\\r\\n\\r\\n<HTML><HEAD><TITLE>Invalid POQ Session key </TITLE></HEAD><BODY><h1>Invalid POQ Session key found</h1></BODY></HTML>\""
add responder action noPOQKey_action redirect "\"https://citrix.demo.quaresso.com:8443/poqserver/client/citrixtest/poqRequired.html\""
add responder policy noPOQKey_policy "HTTP.REQ.HEADER(\"QuaressoPOQSessionID\").EXISTS.NOT && HTTP.REQ.HOSTNAME.EQ(\"QuaressoCallout.ns.com\").NOT" noPOQKey_action
add responder policy invalidPOQKey_policy "HTTP.REQ.HOSTNAME.EQ(\"QuaressoCallout.ns.com\").NOT && SYS.HTTP_CALLOUT(poq_valid_session_id).EQ(\"true\").NOT" invalidPOQKey_action
set responder param -undefAction NOOP
# Bind Policies to VServers
bind lb vserver QuaressoVIP-HTTPS HTTPS
bind lb vserver QuaressoVIP-POQServer POQServer
bind lb vserver QuaressoVIP-HTTPS -policyName noPOQKey_policy -priority 101 -gotoPriorityExpression END
bind lb vserver QuaressoVIP-HTTPS -policyName invalidPOQKey_policy -priority 102 -gotoPriorityExpression END
# SSL Certs
add ssl certKey ns-server-certificate -cert ns-server.cert -key ns-server.key
add ssl certKey quaresso-self-signed-cert -cert quaresso.cert -key quaresso.key
add ssl certKey quaresso-demo-cert -cert demo_quaresso_com.crt -key demo_quaresso_com.key
set ssl service HTTPS -eRSA DISABLED
# Bind SSL Certs to VServer
bind ssl service HTTPS -certkeyName quaresso-demo-cert
bind ssl vserver QuaressoVIP-HTTPS -certkeyName quaresso-demo-cert
bind ssl vserver QuaressoVIP-POQServer -certkeyName quaresso-demo-cert

To see how these threat protections work and read about additional security protections, scalability, and performance, go to www.quaresso.com or contact them at info@quaresso.com.

Get the most powerful HTTP Callout controller here.

Quaresso is Citrix Ready!