IT Employment

Ask something
Discussion Locked

Citrix Enviornment

0 helpful
21 replies

by starbury 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi everyone,
we are currently expanding the amount of users that we have using our citrix metaframe connection. I was wondering how are people addressing the issue of web surfing. I dont want to personally use IE since it is located on the server, I do not want users navigating to sites that could potentially have malicious content and possible compromise the whole system. My suggestion is to use Mozilla or maybe even firefox as a web browser. The only thing is that my boss doesnt see a real need to switch. we also are utilizing more thin clients so this is the only means for people connecting to the system..... I'm curious about how people are running similar systems.

please advise
thanks

21 replies

by starbury

Yes
we have a small company (70 users)
and not everyone is using citrix at the current moment. Eventually that is where we want to move everyone over, obviously when that decision is made then we will have to beef that server up and get another one for load balancing, etc. I am fairly a rookie and i'm just curious to see if i am thinking in the right direction.
thanks

by itgirli

I am new to the IT world. less than three months into my first real IT job. My company has less than 100 people. We have 5 servers here and two in our branch location. Our branch location has 7 people. You need more servers. Your email should be handled by one. Citrix by another. another with firewalls and stuff. You cannot run all of that on one (I guess you can, but it's severly not advised). Talk to your boss and tell him you need more servers. at least one.

by cactus pete

Are the clients inside the office? If so, they should use their own desktop for surfing. If not, they should use their own connection for surfing.

There should be no surfing from the Citrix server(s) except for published intranet sites.

by starbury

I agree that there should be no surfing as well. Answering your questions, 1. there are some users (about 5, we have 70 users) who have thin clients. My company likes the idea of thin clients and essentially wants to roll this out to everyone. I guess my question is how would you best handle this situation, the nature of our business is such that our users need access to various sites. My boss suggests to just leave IE the way it is (at highest security level) and just educate users on how to add sites to the trusted domain. My problem with that is that users will just add any site to their trusted zone.

thanks

by cactus pete

Well, that's tough.

If the server MUST be a point from which to surf, then you will need a strong firewall and proxy server - AT THE LEAST. This is more complex, and more costly. But just one unlucky user who caught the wrong site once can bring down your entire system and make the whole compny rather unproductive!

For most firms, that is just too risky.

You would have to lock things down at the firewall/proxy way too far and hire an additional staff member simply to add sites to the Allow list all day long as the disgruntled users call them in...

by blueknight

Convincing the boss shouldn't be too hard. Just hand him a pile of the vast number of security alert notices involving IE and point out what they each mean. Before you get to the bottom of the pile he should see that Mozilla or Firefox (which I'm now using) are a better choice.

Many places discourage web surfing unless it's job related. You might ask the boss to think about implementing such a policy (if not already in place) in addition to changing browsers.
In the meantime, make sure you have good backups and that intrusion/virus protection is up to date.

by bfilmfan

Allow the surfing through a proxy server and only allow the users to see the sites that are approved.

This works for clients from 10 users to hundreds of thousands.

by starbury

Would setting up a proxy server be the only option to securely allow users to surf via the citrix connection. To my understanding a proxy server just basically screens (or caches ) the approved websites . The client machines have to contact the proxy and then depending on our settings the proxy lets them view the sites that they are requesting.

Also, would this work? We currently have software that controls the websites that users are currently allowed to view. Can we use this instead of the Proxy server. Therefore if the unfortunate user wanders to some random site, they would be blocked and we would know. Is this a viable alternative. Are they any vunerabilities involved with this approach..

Thank you for all your ideas and comments.

by ben "iron" damper

If you combine a good firewall, proxy, and use policy's to look down Internet Explorer options for the regular users you should be just fine. My company has 21 Citrix servers with about 700 users and we have been running just fine with IE using my above set up for three years now without a hitch. And naturally keep your AV up to date as well as server patch management.

by starbury

we have about 17 servers..... each running different things on them. we host a sleu of different websites, we only have 1 citrix server. sorry for the confusion.

by crazyhickman

Things that need to be considered when sizing a Citrix server or quantity of servers: 1)Number of concurrent users; 2) what applications and what are their resource requirements; 3) Size of Citrix server.
Another major point to be considered is redundancy, if you loose your Citrix server, how critical to the users to have access to their published applications or desktops. You may need an extra server for this.

by d-man7257

i have used several different browser base for Citrix. the best thing i have found is a good AV solution for internal system. for external that you can not control i would recommend using Content redirection for IE. if you where to publish IE as an application and set GPO or local policy to control activeX and other user prefs. this should keep your user a little more safer as well as your system more out of harms way.

by bullitch_1978

i guess updated antivirus, firewall, proxy is fine. during my early months at work my systems and network administrator doesn't have a good antivirus, no firewall and no proxy. sometime our systems crashed. he was fired. lol. i tried to using a good AV, updates it when there's available and now it works fine for five months.

by skc2

Use policy to lock down IE to desire level and keep AV definition up to date (religiously). Than using IE should be fine. Of cause there must be a firewall as well.

Gook luck!!

Kit

by crazyhickman

I have been involved in an environment where there are over 100 Citrix servers in one farm and there has been no issues using a good firewall, proxy and GPOs to lock down IE. I must agree completely with this suggestion.

by tundraroamer

While I agree about policies and redundant servers, I have all 50 or so users on a single Citrix server that also provides MS Office. All users are on thinclients. All users surf the net with IE 5.5 through Citrix. We have other application servers for the rest of our needs. The only consistent surfing problems are related to Adobe files. One website that several users may be on at one time reading plans and specifications can cause some server slowness because Adobe reader is a resource hog. Otherwise it works well. We even have branch locations that all go through the same server through VPN's. We have been doing this for about 6 years or so. While we need to upgrade to two servers, we are doing okay.
However, I should also note that we use Trend's ServerProtect, OfficeScan and ScanMail products along with a Barracuda device for anti-spam/AV. I am looking into another appliance for web monitoring and control that is Citrix compatible and configurable. This helps to maintain control on problems that may come up from users getting into trouble while on the net. User training is a must! I tried using a proxy server for Internet control/filter but it was cumbersome and slowed the response time too much (Surfwatch over IIS on separate NT server). Plus after it was all set up, users could disable the proxy server setting through IE and directly surf the net. The policy to prevent that does not always work for all users as I later found out. A problem with the NT Term Server profiles I suspect. If you farm out the servers, surfing should not be a real issue as long as users know that certain types of functions are not allowed like downloaded mpeg or mp3's for non business use.
Once, in testing our new Internet connection, at the end of the day, I had the majority of the users connect to a NASA website at the exact same time to view a mpeg of a shuttle launch. It slammed the server hard but it did not crash and everyone saw the video.

by jaymiller25

Here's what I'd look at:

- Does your organization place any restrictions on web surfing? If so, then just set it up so the Citrix servers can only browse to approved web sites.

- Firefox will work in a Citrix session (as you probably already know). There's a little more config. you have to do to the browser to get it how you want....but it's worth it.

As far as convincing your boss: Fire up Adware on his machine and scan for spyware. THEN, install firefox and tell him to use that for a week...then scan again. If that doesn't convince him, I don't know what will.

Good luck.

by isapp

We've been running three Citrix servers for almost four years with no major issues. One thing that saves us is that our users have NO rights to install anything. They can look but can't download. We also have AV, very specific policies, etc. It would be impossible for us to allow users to surf only approved sites as we do lots of research on line. We don't know what we need to see until we see it.

We see no need to use anything other than IE, nor will we be instituting access lists. Simply not an issue here.

by arcomm

I've been doing IT for over 20 years and am willing to bet you have too many. When I was new I thought more was better too, but experience taught me otherwise. I specialize in server consolidation projects and in utilizing standardized procedures for selecting, building and maintaining them in a manner that ensures nearly 100% uptime.

by arcomm

I would imagine that your users need certain web sites to perform their job duties and that those web sites require IE so it is unlikely you'll be able to go without it. You might be able to lock it down to only those who genuinely need it. Best bet is to survey your user community to find out what sites they need to visit and what browser is required for each, you can't just make blanket assumptions.

I also don't understand what the fuss is about. On well managed systems, IE is NOT a problem. It is usually user habits that need to be managed carefully. Certain people don't seem to understand why they shouldn't click on certain links provided by their outside "buddies" where they can download fancy stationaries, games, jokes, and the like. And while there are security holes that need to be patched, most of the issues you'll have to address will be a result these bad habits.

This discussion is closed to new replies.