Citrix Cloud

Secure Deployment Guide for the Citrix Cloud Platform

The Secure Deployment Guide for Citrix Cloud provides an overview of security best practices when using Citrix Cloud and describes the information Citrix Cloud collects and manages.

The following articles provide similar information for other services in Citrix Cloud:

Control Plane

Guidance for administrators

  • Use strong passwords and regularly change your passwords.
  • All administrators within a customer account can add and remove other administrators. Ensure that only trusted administrators have access to Citrix Cloud.
  • Administrators of a customer have, by default, full access to all services. Some services provide a capability to restrict the access of an administrator. Consult the per-service documentation for more information.
  • Two-factor authentication for administrators is achieved using Citrix Cloud’s integration with Azure Active Directory.
  • By default, Citrix Cloud automatically terminates administrator sessions after 60 minutes of inactivity. This 60-minute timeout cannot be changed. Inactive means the session is completely idle and the administrator is not interacting with the Citrix Cloud console in any way. Activity refers to actions such as navigating the graphical interface, selecting configuration options, saving configuration changes, or waiting for a change to take effect.

Password compliance

Citrix Cloud prompts administrators to change their passwords if their current password is more than 60 days old. New passwords must meet all of the following criteria:

  • At least 12 characters long
  • Include at least one upper-case and lower-case letter
  • Include at least one number
  • Include at least one special character: ! @ # $ % ^ * ? + = -

Rules for changing passwords:

  • At least one character in the current password must be changed. The current password cannot be used as a new password.
  • The previous 24 passwords cannot be reused.
  • The new password must be in effect for at least one day before Citrix Cloud allows it to be changed again.

Encryption and key management

The control plane does not store sensitive customer information. Instead, Citrix Cloud retrieves information such as administrator passwords on-demand (by prompting the administrator explicitly). There is no data-at-rest that is sensitive or encrypted, and thus you do not need to manage any keys.

For data-in-flight, Citrix uses industry standard TLS 1.2 with the strongest cipher suites. Customers cannot control the TLS certificate in use, as Citrix Cloud is hosted on the Citrix-owned cloud.com domain. To access Citrix Cloud, customers must use a browser capable of TLS 1.2 with strong cipher suites.

Consult the per-service documentation for details about encryption and key management within each service.

Data sovereignty

The Citrix Cloud control plane is hosted in the United States, the European Union, and Australia. Customers do not have control over this.

The customer owns and manages the resource locations that they use with Citrix Cloud. A resource location can be created in any data center, cloud, location, or geographic area the customer desires. All critical business data (such as documents, spreadsheets, and so on) are stored in resource locations and are under customer control.

For Content Collaboration, consult the following resources for information about controlling where the data resides:

Other services may have an option to store data in different regions. Consult the Geographical Considerations topic or the Technical Security Overviews (listed at the beginning of this article) for each service.

Security issues insight

The website status.cloud.com provides transparency into security issues that have an ongoing impact on the customer. The site logs status and uptime information. There is an option to subscribe for updates to the platform or individual services.

Citrix Cloud Connector

Installing the Cloud Connector

For security and performance reasons, Citrix recommends that customers do not install the Cloud Connector software on a domain controller.

Also, Citrix strongly recommends that the machines on which the Cloud Connector software is installed be inside the customer’s private network and not in the DMZ. For network and system requirements and instructions for installing the Cloud Connector, see Citrix Cloud Connector.

Configuring the Cloud Connector

The customer is responsible for keeping the machines on which the Cloud Connector is installed up-to-date with Windows security updates.

Customers can use antivirus alongside the Cloud Connector. Citrix tests with McAfee VirusScan Enterprise + AntiSpyware Enterprise 8.8. Citrix supports customers who use other industry standard AV products.

In the customer’s Active Directory (AD) Citrix strongly recommends that the Cloud Connector’s machine account be restricted to read-only access. This is the default configuration in Active Directory. Also, the customer can enable AD logging and auditing on the Cloud Connector’s machine account to monitor any AD access activity.

Logging on to the machine hosting the Cloud Connector

The Cloud Connector contains sensitive security information such as administrative passwords. Citrix strongly recommends allowing only the most privileged administrators to log on to the machines hosting the Cloud Connector (for example, to perform maintenance operations). In general, there is no need for an administrator to log on to these machines to manage any Citrix product. The Cloud Connector is self-managing in that respect.

Do not allow end users to log on to machines hosting the Cloud Connector.

Installing other software on Cloud Connector machines

Customers can install antivirus software and hypervisor tools (if installed on a virtual machine) on the machines where the Cloud Connector is installed. However, Citrix recommends that customers do not install any other software on these machines. Other software creates possible security attack vectors and might reduce the security of the overall Citrix Cloud solution.

Inbound and outbound ports configuration

The Cloud Connector requires outbound port 443 to be open with access to the internet. Citrix strongly recommends that the Cloud Connector have no inbound ports accessible from the Internet.

Customers can locate the Cloud Connector behind a web proxy for monitoring its outbound Internet communications. However, the web proxy must support SSL/TLS encrypted communication.

The Cloud Connector might have other outbound ports with access to the Internet. The Cloud Connector negotiates across a wide range of ports to optimize network bandwidth and performance if other ports are available.

The Cloud Connector must have a wide range of inbound and outbound ports open within the internal network. The following table lists the base set of open ports required.

Client Port Server Port Service
49152 -65535/UDP 123/UDP W32Time
49152 -65535/TCP 135/TCP RPC Endpoint Mapper
49152 -65535/TCP 464/TCP/UDP Kerberos password change
49152 -65535/TCP 49152-65535/TCP RPC for LSA, SAM, Netlogon (*)
49152 -65535/TCP/UDP 389/TCP/UDP LDAP
49152 -65535/TCP 636/TCP LDAP SSL
49152 -65535/TCP 3268/TCP LDAP GC
49152 -65535/TCP 3269/TCP LDAP GC SSL
53, 49152 -65535/TCP/UDP 53/TCP/UDP DNS
49152 -65535/TCP 49152 -65535/TCP FRS RPC (*)
49152 -65535/TCP/UDP 88/TCP/UDP Kerberos
49152 -65535/TCP/UDP 445/TCP SMB

Each of the services used within Citrix Cloud extends the list of open ports required. For more information, consult the following resources:

Monitoring outbound communication

The Cloud Connector communicates outbound to the Internet on port 443, both to Citrix Cloud servers and to Microsoft Azure Service Bus servers.

The Cloud Connector communicates with domain controllers on the local network that are inside the Active Directory forest where the machines hosting the Cloud Connector reside.

During normal operation, the Cloud Connector communicates only with domain controllers in domains that are listed as Use for subscriptions on the Identity and Access Management page in the Citrix Cloud user interface.

In selecting the domains to configure as Use for subscriptions, the Cloud Connector communicates with domain controllers in all domains in the Active Directory forest where the machines hosting the Cloud Connector reside.

Each service within Citrix Cloud extends the list of servers and internal resources that the Cloud Connector might contact during normal operations. Also, customers cannot control the data that the Cloud Connector sends to Citrix. For more information about services’ internal resources and data sent to Citrix, consult the following resources:

Viewing Cloud Connector logs

Any information relevant or actionable to an administrator is available in the Windows Event Log on the Cloud Connector machine.

View installation logs for the Cloud Connector in the following directories:

  • %AppData%\Local\Temp\CitrixLogs\CloudServicesSetup
  • %windir%\Temp\CitrixLogs\CloudServicesSetup

Logs of what the Cloud Connector sends to the cloud are found in %ProgramData%\Citrix\WorkspaceCloud\Logs.

The logs in the WorkspaceCloud\Logs directory are deleted when they exceed a specified size threshold. The administrator can control this size threshold by adjusting the registry key value for HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\CloudServices\AgentAdministration\MaximumLogSpaceMegabytes.

SSL/TLS Configuration

The base Cloud Connector configuration does not need any special SSL/TLS configuration.

The Cloud Connector must trust the certification authority (CA) used by Citrix Cloud SSL/TLS certificates and by Microsoft Azure Service Bus SSL/TLS certificates. Citrix and Microsoft might change certificates and CAs in the future, but always uses CAs that are part of the standard Windows Trusted Publisher list.

Each service within Citrix Cloud might have different SSL configuration requirements. For more information, consult the Technical Security Overviews for each service (listed at the beginning of this article).

Security compliance

To ensure security compliance, the Cloud Connector self-manages. Do not disable reboots or put other restrictions on the Cloud Connector. These actions prevent the Cloud Connector from updating itself when there is a critical update.

The customer is not required to take any other action to react to security issues. The Cloud Connector automatically applies any security fixes.

Citrix Connector Appliance for Cloud Services

Installing the Connector Appliance

The Connector Appliance is hosted on a hypervisor. This hypervisor must be inside your private network and not in the DMZ.

Ensure that the Connector Appliance is within a firewall that blocks access by default. Use an allow list to allow only expected traffic from the Connector Appliance.

Ensure that the hypervisors that host your Connector Appliances are installed with up-to-date security updates.

For network and system requirements and instructions for installing the Connector Appliance, see Connector Appliance for Cloud Services.

Logging on to the hypervisor hosting a Connector Appliance

The Connector Appliance contains sensitive security information such as administrative passwords. Allow only the most privileged administrators to log on to a hypervisor hosting the Connector Appliance (for example, to perform maintenance operations). In general, there is no need for an administrator to log on to these hypervisors to manage any Citrix product. The Connector Appliance is self-managing.

Inbound and outbound ports configuration

The Connector Appliance requires outbound port 443 to be open with access to the internet. Citrix strongly recommends that the Connector Appliance have no inbound ports accessible from the internet.

You can locate the Connector Appliance behind a web proxy for monitoring its outbound internet communications. However, the web proxy must support SSL/TLS encrypted communication.

The Connector Appliance might have other outbound ports with access to the internet. The Connector Appliance negotiates across a wide range of ports to optimize network bandwidth and performance if other ports are available.

The Connector Appliance must have a wide range of inbound and outbound ports open within the internal network. The following table lists the base set of open ports required.

Connection Direction Connector Appliance Port External Port Service
Inbound 443/TCP Any Local Web UI
Outbound 49152-65535/UDP 123/UDP NTP
Outbound 53, 49152-65535/TCP/UDP 53/TCP/UDP DNS
Outbound 67/UDP 68/UDP DHCP and broadcast

Each of the services used within Citrix Cloud extends the list of open ports required. For more information, consult the following resources:

Monitoring outbound communication

The Connector Appliance communicates outbound to the Internet on port 443 to Citrix Cloud servers.

Each service within Citrix Cloud extends the list of servers and internal resources that the Connector Appliance might contact during normal operations. Also, customers cannot control the data that the Connector Appliance sends to Citrix. For more information about services’ internal resources and data sent to Citrix, consult the following resources:

Viewing Connector Appliance logs

You can download a diagnostic report for your Connector Appliance that includes various log files. For more information about getting this report, see Connector Appliance for Cloud Services.

SSL/TLS Configuration

The Connector Appliance does not need any special SSL/TLS configuration.

The Connector Appliance trusts the certification authority (CA) used by Citrix Cloud SSL/TLS certificates. Citrix might change certificates and CAs in the future, but always use CAs that the Connector Appliance trusts.

Each service within Citrix Cloud might have different SSL configuration requirements. For more information, consult the Technical Security Overviews for each service (listed at the beginning of this article).

Security compliance

To ensure security compliance, the Connector Appliance self-manages and you cannot log in to it through the console.

You are not required to take any other action to react to connector security issues. The Connector Appliance automatically applies any security fixes.

Ensure that the hypervisors that host your Connector Appliances are installed with up-to-date security updates.

Guidance for handling compromised accounts

  • Audit the list of administrators in Citrix Cloud and remove any who are not trusted.
  • Disable any compromised accounts within your company’s Active Directory.
  • Contact Citrix and request rotating the authorization secrets stored for all the customer’s Cloud Connectors. Depending on the severity of the breach, take the following actions:
    • Low Risk: Citrix can rotate the secrets over time. The Cloud Connectors continue to function normally. The old authorization secrets become invalid in 2-4 weeks. Monitor the Cloud Connector during this time to ensure that there are no unexpected operations.
    • Ongoing high risk: Citrix can revoke all old secrets. The existing Cloud Connectors will no longer function. To resume normal operation, the customer must uninstall and reinstall the Cloud Connector on all applicable machines.

Secure Deployment Guide for the Citrix Cloud Platform