The Horizon Connection Server must force server cipher preference.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246885	HRZV-7X-000004	SV-246885r768615_rule		High

Description
By default, during the initial setup of a Transport Layer Security (TLS) connection to the Horizon Connection Server, the client sends a list of supported cipher suites in order of preference. The Connection Server replies with the cipher suite it will use for communication, chosen from the client list. This is not ideal since the untrusted client is setting the boundaries and conditions for the connection to proceed. The client could potentially specify known weak cipher combinations that would make the communication more susceptible to interception. By adding the "honorClientOrder" setting to the locked.properties file, the Connection Server will reject the client preference and force the client to choose from the server ordered list of preferred ciphers.

Description

By default, during the initial setup of a Transport Layer Security (TLS) connection to the Horizon Connection Server, the client sends a list of supported cipher suites in order of preference. The Connection Server replies with the cipher suite it will use for communication, chosen from the client list. This is not ideal since the untrusted client is setting the boundaries and conditions for the connection to proceed. The client could potentially specify known weak cipher combinations that would make the communication more susceptible to interception. By adding the "honorClientOrder" setting to the locked.properties file, the Connection Server will reject the client preference and force the client to choose from the server ordered list of preferred ciphers.

STIG	Date
VMware Horizon 7.13 Connection Server Security Technical Implementation Guide	2021-07-30

Details

Check Text ( C-50317r768613_chk )
On the Horizon Connection Server, navigate to "\VMware\VMware View\Server\sslgateway\conf". If a file named "locked.properties" does not exist in this path, confirm with the SA if forcing server-side cipher order was enforced at a global level via ADSI EDIT. If no such global change was made, this is a finding. Open "locked.properties" in a text editor. Find the "honorClientOrder" setting. Ensure they are set as follows: secureProtocols.1=TLSv1.2 preferredSecureProtocol=TLSv1.2 If there is no "honorClientOrder" setting, this is a finding. If the "honorClientOrder" is not set to "false", this is a finding.

Check Text ( C-50317r768613_chk )

On the Horizon Connection Server, navigate to "\VMware\VMware View\Server\sslgateway\conf".

If a file named "locked.properties" does not exist in this path, confirm with the SA if forcing server-side cipher order was enforced at a global level via ADSI EDIT. If no such global change was made, this is a finding.

Open "locked.properties" in a text editor. Find the "honorClientOrder" setting. Ensure they are set as follows:

secureProtocols.1=TLSv1.2
preferredSecureProtocol=TLSv1.2

If there is no "honorClientOrder" setting, this is a finding.

If the "honorClientOrder" is not set to "false", this is a finding.

Fix Text (F-50271r768614_fix)
On the Horizon Connection Server, navigate to "\VMware\VMware View\Server\sslgateway\conf". Open "locked.properties" in a text editor. Remove any existing "honorClientOrder" settings. Add or change the following line: honorClientOrder=false Save and close the file. Restart the "VMware Horizon View Connection Server" service for changes to take effect.