Howdy,
> -----Original Message-----
> From: Bugtraq List [mailto:[EMAIL PROTECTED]]On Behalf Of Weld
> Pond
> Sent: Wednesday, 29 March 2000 8:36
> To: [EMAIL PROTECTED]
> Subject: Re: Citrix ICA Basic Encryption
>
> [snip]
>
> SecureICA is only available for Windows and DOS clients.
> Unix, Macintosh,
> and Java clients must use the insecure protocol. Due to the
> nature of the
> protocol it cannot be tunnelled through ssh. A VPN is
> probably the only
> solution for Unix, Macintosh and Java clients.
>
> -weld
>
Not entirely correct. The ICA session can be tunnelled through ssh. You need
to forward port 1494 to the ICA server. However, the ICA browser service
uses UDP port 1604. You can get around this by using NAT techniques and the
ALTADDR command provided by Citrix.
>From a security point-of-view, you probably shouldn't NAT the browser
service - simply use the ssh port forwarding to connect to a known server
and known application. The downside is you're not able to use seamless
windows, as you cannot get the list of published applications from the ICA
browser service.
Regards,
Chris Knight
Systems Administrator
AIMS Independent Computer Professionals
Tel: +61 3 6334 6664 Fax: +61 3 6331 7032 Mob: +61 419 528 795
Web: http://www.aims.com.au
