Presented by Jason Leonard, Citrix

1. © 2015 Citrix
How Citrix is Securing its
Helix Platform
September 2015
Jason Leonard
Staff Software Engineer, Source Control Team
jason.leonard@citrix.com

2. © 2015 Citrix
• Jason Leonard (jason.leonard@citrix.com)
• 14 years dealing with Perforce. Adobe (almost 5
years), Citrix (almost 10 years)
• Staff Software Engineer, Source Control Team
• 2 team members and a manager
• ~20 servers, ~40 Helix repositories
• ~3TB version data growing 200GB per year.
• ~400,000 commands per hour, almost 10M
commands per day.Not a security
engineer

3. © 2015 Citrix | Confidential
Why I chose to talk about security?

4. “On Covert Acoustical
Mesh Networks in Air”

5. © 2015 Citrix
Do you have a secure Helix?

6. © 2015 Citrix
Security
Layers
Data
Application
Operating System
Network

7. © 2015 Citrix
Data Security
• Redundancy
– Ensure your data can cope with some hardware failure
– Can increase performance 
• On Disk Encryption
– Disks can be stolen, or end up in the wrong hands
– But we incur a performance penalty
• Backup, Backup, Backup
– If its not in three places it doesn't exist
– But the data is in three places
– TEST IT
Data
Application
Operating System
Network

8. © 2015 Citrix
Application Security
• Authentication
– Username
– Password
– Or ticket if we have already
authenticated with ‘p4 login’
• Authorisation
– Groups
– Protections
Data
Application
Operating System
Network
• run.users.authorize = 1
– Otherwise ‘p4 users’ allowed
• security = 4
– Strong passwords
– Ticket based login required
– Authenticated service user

9. © 2015 Citrix
Authentication
• security = 1 or 2
• Password based login
– Command-line
– Environment
– Config file
– Windows Registry
p4 –u jasonleonard –P mySuperSecretPa55w0rd
P4PASSWD=mySuperSecretPa55w0rd
P4PASSWD=9ed1ae7793942a500012e97c9a605a74
Data
Application
Operating System
Network

10. © 2015 Citrix
Authentication
• security >= 3
• Ticket based login
– p4 login
– Tickets timeout
– Can lock to client IP
– Can remote invalidate
p4 –u jasonleonard login
Enter password: *********
perforce:1666=jasonleonard:c6a65e9365c1f5245….
Data
Application
Operating System
Network

11. © 2015 Citrix
Operating System Security
• Software firewall
– Don’t neglect the firewall on your servers
– Windows Firewall, iptables
• Anti-virus/malware
– Don’t let your anti-virus scan your metadata
• OS Hardening
– Ensure you follow guidelines
– Remove unnecessary software
– Turn off unnecessary OS features
– Ensure each machine runs only one service and runs it well
Data
Application
Operating System
Network

12. © 2015 Citrix
Network Security
• Firewalls
– Separate production networks from user
networks
• VPN
– To access production network for configuring
machines
• Intrusion Detection System
– Log watching
– Honey pot
Data
Application
Operating System
Network
• SSL
– Encrypt all traffic over the wire
• Wireless
– Disallow any wireless network to your
source control
• DNS/DHCP
– Prevent the man-in-the-middle attacks

13. © 2015 Citrix
Two way RPC Protocol
• Remote Procedure Call
• p4 login = user-login function
• client-Prompt displays
– Enter password:
• dm-Login contains the salted password
• client-SetPassword contains our ticket

14. © 2015 Citrix
Secure Helix Communications
• Available since 2012.1
• Authenticates end point
• Encrypts traffic
• Server
– Generate a certificate on the
master/broker/proxy
– Run with –p ssl::1666
• Client
– P4PORT = ssl:host:1666
– Accepts the certificate with p4 trust
C:>p4 -p ssl:perforce:1666 trust
The fingerprint of the server of your P4PORT setting
'ssl:perforce:1666' (10.0.0.1:1666) is not known.
That fingerprint is
89:8E:FD:55:42:A5:D8:DC:C2:9F:33:7C:B4:AD:C9:4B:3E:22:34:9D
Are you sure you want to establish trust (yes/no)?

15. © 2015 Citrix
Physical Security
• Server Room/Lab
– Door security, key, swipe?
– Access policy, who can open the door?
• Racks
– Locked by key, combination
• Servers
– Case intrusion prevention
– Disk drives locked
• Disposal
Data
Application
Operating System
Network

16. © 2015 Citrix
Monitoring
• Infrastructure Monitoring
– Nagios
• Log Monitoring
– Nagios Log Server

18. © 2015 Citrix
Monitoring
• IP Threat Analysis
– Helix Threat Detection

19. © 2015 Citrix
What if a user sync's code?

20. © 2015 Citrix
Virtual Desktops from a Datacentre
Keep the data in the datacentre

21. © 2015 Citrix
Do you have a secure Helix, now?

22. © 2015 Citrix
Work better. Live better.Work better. Live better.