6.0
Table Of Contents
- View Security
- Contents
- View Security
- View Security Reference
- View Accounts
- View Security Settings
- View Resources
- View Log Files
- View TCP and UDP Ports
- Services on a View Connection Server Host
- Services on a Security Server
- Configuring Security Protocols and Cipher Suites on a View Connection Server Instance or on a Security Server
- Index
Default Global Policies for Security Protocols and Cipher Suites
Certain security protocols and cipher suites are provided by default in View 5.2 and later releases. By
default, the global acceptance and proposal policies are very similar.
Table 1‑14. Default Global Policies
Default Security Protocols Default Cipher Suites
n
TLS 1.1
n
TLS 1.0
n
SSLv2Hello (acceptance policy only)
n
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
n
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
n
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
n
TLS_RSA_WITH_AES_128_CBC_SHA
n
SSL_RSA_WITH_RC4_128_SHA
You can change the default policies in the following ways:
n
If all connecting clients support TLS 1.1, you can remove TLS 1.0 and SSLv2Hello from the acceptance
policy.
n
You can add TLS 1.2 to the acceptance and proposal policies, which will then be selected if the other
end of the connection supports TLS 1.2.
n
If all connecting clients support AES cipher suites, you can remove SSL_RSA_WITH_RC4_128_SHA from the
acceptance policy.
Updating JCE Policy Files to Support High-Strength Cipher Suites
You can add high-strength cipher suites for greater assurance, but first you must update the
local_policy.jar and US_export_policy.jar policy files for JRE 7 on each View Connection Server instance
and security server. You update these policy files by downloading the Java Cryptography Extension (JCE)
Unlimited Strength Jurisdiction Policy Files 7 from the Oracle Java SE Download site.
If you include high-strength cipher suites in the list and do not replace the policy files, you cannot restart the
VMware Horizon View Connection Server service.
The policy files are located in the C:\Program Files\VMware\VMware View\Server\jre\lib\security
directory.
For more information about downloading the JCE Unlimited Strength Jurisdiction Policy Files 7, see the
Oracle Java SE Download site: http://www.oracle.com/technetwork/java/javase/downloads/index.html.
After you update the policy files, you must create backups of the files. If you upgrade the View Connection
Server instance or security server, any changes that you have made to these files might be overwritten, and
you might have to restore the files from the backup.
Configuring Global Acceptance and Proposal Policies
The default global acceptance and proposal policies are defined in View LDAP attributes. These policies
apply to all View Connection Server instances in a replicated group. To change a global policy, you can edit
View LDAP on any View Connection Server instance.
Each policy is a single-valued attribute in the following View LDAP location:
cn=common,ou=global,ou=properties,dc=vdi,dc=vmware,dc=int
View Security
22 VMware, Inc.