NetScaler on Remko's Blog

Change NetScaler Password Hash from SHA1 to SHA512

Wed, 13 Dec 2017 13:53:08 +0000

This morning I wanted to install the NetScaler patch for the TLS padding vulnerability and of course I made a backup before deploying it.

Note: If you haven’t installed this patch yet I would recommended to do so: see CTX230238 and check out the ROBOT attack -Return Of Bleichenbacher’s Oracle Threat page to check which other products you may have that are vulnerable.

Upon checking the backups (I always download the backup and verify that the archive is intact) I noticed that one of my NetScaler’s uses SHA1 for the password hash whilst the other one uses SHA512:

I thought that this was a little strange as both NetScaler's are running the exact same build. However one of them (the one that uses SHA512) was reinstalled recently whilst the one using SHA1 has been upgraded.

Show Client IP Address when using NetScaler as a Reverse Proxy

Fri, 10 Feb 2017 14:10:45 +0000

Recently I switched over my blog from a hoster to a self hosted VM. In my setup I am using Citrix NetScaler as a reverse proxy.

Simular to when you’re using a 3rd party reverse proxy such as CloudFlare you will see the IP address from the reverse proxy instead of the actual Client IP Address on your webserver.

This means that your logging will all show the same, internal, IP address and that IP Based Access Rules will not work.

Fortunately this is easy to solve by having NetScaler add the Client IP Address in the headers and rewriting the address on your webserver.

Blog improvements

Tue, 07 Feb 2017 15:56:21 +0000

When I started this blog in 2007 (wow that’s almost 10 years ago) I went for a cheap web hoster with a reasonable performance to host it.

In the beginning performance was acceptable but over the years it has degraded and of course user experience standards have changed.

I decided it was time to do something about it so I’ve moved the blog from a shared platform to my own server.

This server is running on optimized flash storage where most writes are DeDuplicated and never actually hits the flash disks:

Citrix Receiver Unknown client error 1110

Tue, 07 Feb 2017 15:08:27 +0000

Citrix Receiver and StoreFront error messages are sometimes confusing or lacking details so I decided to make little blog notes about common issues when I see them. So without further ado here’s #1:

In Citrix Receiver I tried to logon remotely via NetScaler Gateway and got the following error message: “Cannot get your apps from the store”

Citrix Receiver