Skip past navigation linksSecure Global Desktop 4.40 Administration Guide > Security > Security and SGD

Security and SGD

Read This Topic to...
  • Understand the security issues when using SGD.

SGD is only one of many components on your network. The information on this page is related to SGD and can only help raise security levels as part of an ongoing security strategy. The following areas must be considered when using SGD:

Network Connections

SGD connects client devices to application servers, acting as a go-between. SGD servers can also join together as an array.

Diagram showing connections between application servers on the left, SGD servers in the middle and client devices on the right

This means the following are the main network connections involved with using SGD:

In a default SGD installation, most connections are unencrypted (in the clear). The following sections describe how you can improve security on network connections.

SGD can also be configured to work with firewalls and proxy servers.

Improving Security Between Client Devices and SGD Servers

To secure connections between client devices and SGD servers, use a secure (HTTPS) web server on all SGD hosts and enable SGD security services. See Securing Connections Between Client Devices and SGD Servers for more details.

Improving Security Between SGD Servers and Application Servers

The connections between SGD servers and application servers are used to start applications on the application server, and to send and receive data from the application, such as key presses and display updates.

The level of security between SGD and your application servers depends on the types of application server and the protocols they use.

UNIX or Linux System Application Servers

When using protocols such as telnet or rexec, all communications and passwords are transmitted unencrypted (in the clear).

For secure connections to UNIX or Linux system application servers, use SSH (Secure Shell). SSH encrypts all communications between SGD hosts and encrypts passwords before they are transmitted. See Installing and using SSH with SGD for more information.

By default, SGD secures X displays using X authorization. This prevents users from accessing X displays they are not authorized to access.

Microsoft Windows Application Servers

The level of security depends on the protocol configured for the Windows application, as follows:

For secure connections to Microsoft Windows application servers, use the Microsoft RDP protocol.

Web Application Servers

The level of security depends on the type of web server you are using to host the web application:

For secure connections to your web application servers, use HTTPS.

Connections between SGD servers in an array

Connections between SGD servers are used to share static and dynamic data across the array. This includes the following:

See Securing Connections Between SGD Servers for details on how to secure these connections.

User Names and Passwords

When logging in to SGD and the SGD Client is in Webtop mode, passwords are only encrypted if there is an HTTPS connection. If the SGD Client is in Integrated mode, the initial connection between the SGD Client and SGD is always secure. After the user is authenticated, the connection might be downgraded to a standard (insecure) connection depending on configuration.

SGD uses external mechanisms for authenticating users:

SGD encrypts all passwords stored in the password cache. By default, the encryption key used for the password cache never changes. You can force the key to change whenever SGD servers start, as follows:

  1. In the SGD Administration Console, click the Global Settings » Security tab.
  2. Select the New Password Encryption Key check box.
  3. Click Save.

Alternatively, use the following command:

Skip past command syntax or program code$ tarantella config edit --security-newkeyonrestart 1

Data Protection

Secure Global Desktop Administrators can control users' ability to print and copy data from applications displayed through SGD. You can configure this as follows:

Related Topics