[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Re: Citrix ICA Basic Encryption
From:       Chris Knight <chris () aims ! com ! au>
Date:       2000-03-30 0:16:03
[Download RAW message or body]

Howdy,

> -----Original Message-----
> From: Bugtraq List [mailto:BUGTRAQ@SECURITYFOCUS.COM]On Behalf Of Weld
> Pond
> Sent: Wednesday, 29 March 2000 8:36
> To: BUGTRAQ@SECURITYFOCUS.COM
> Subject: Re: Citrix ICA Basic Encryption
>
> [snip]
>
> SecureICA is only available for Windows and DOS clients.
> Unix, Macintosh,
> and Java clients must use the insecure protocol. Due to the
> nature of the
> protocol it cannot be tunnelled through ssh.  A VPN is
> probably the only
> solution for Unix, Macintosh and Java clients.
>
> -weld
>
Not entirely correct. The ICA session can be tunnelled through ssh. You need
to forward port 1494 to the ICA server. However, the ICA browser service
uses UDP port 1604. You can get around this by using NAT techniques and the
ALTADDR command provided by Citrix.
From a security point-of-view, you probably shouldn't NAT the browser
service - simply use the ssh port forwarding to connect to a known server
and known application. The downside is you're not able to use seamless
windows, as you cannot get the list of published applications from the ICA
browser service.

Regards,
Chris Knight
Systems Administrator
AIMS Independent Computer Professionals
Tel: +61 3 6334 6664  Fax: +61 3 6331 7032  Mob: +61 419 528 795
Web: http://www.aims.com.au

[prev in list] [next in list] [prev in thread] [next in thread]