Remote access for Teachers

[pooley]

Our LA are looking to block access to RDP for external users, they are being proactive (their words) in the fight against Ransomeware.

 

So what are people using for remote access, I'm not going back to issuing USB devices to staff.

 

Looking at GAPS we have unlimited storage; so I could possibly upload my entire network drive up there, but then I'd have to ensure it was synced etc.

 

Any tips/ideas/advice?

 

Cheers

 

Si

[mavhc]

Better ask your LA what they are going to allow for remote access.

 

You should be able to set up certificates so that only approved devices can connect, although sounds like your users are connecting from the home computers, not school laptops.

[chazzy2501]

use direct access (as it's free) or VPN from windows server 2012+ over ssl. I can't see them blocking SSL.

[localzuk]

You could still use RDP, but set up web access and RDS Gateway - it all runs over port 443/SSL then. We did this here a while back, to eliminate the open RDP port.

[chazzy2501]

ohh, that's a way better solution.

[yac2016]

One plus RDS.

[sted]

use direct access (as it's free) or VPN from windows server 2012+ over ssl. I can't see them blocking SSL.

 

isnt direct access being phased out though in favour of something i forget the name of?

[DJ-1701]

isnt direct access being phased out though in favour of something i forget the name of?

 

Always On VPN.

[mavhc]

What's the actual threat of ransomware that they're trying to prevent? And how does your new solution not allow the same threat?

[MatthewL]

Do your users have laptops they take home or you reliant on them using their own devices?

[3s-gtech]

We use RemoteSpark which works through SSL, as an alternative to RDS web. Good product, but there is an additional cost.

[pooley]

Thanks guys, hopefully web access over 443 will appease the LA.

 

VPN is plan b

[BKGarry]

My setup with RDP is this.

 

LA has DMZ port on router, this goes into a Web Application Proxy (WAP) Server (there is an ADFS server backend for this as well)

RDP server publishes with a 443 gateway and web gateway

WAP server publishes the RDP web server to the outside world over 443.

Staff have the Web gateway shortcuts (automatically updated) in their start menus and can access on other machines through the web gateway.

 

The total cost of this is about £120 a year on a wildcard certificate we use.

[mavhc]

Can you use a let's encrypt wildcard cert now?

 

But the question remains: Why do they think blocking RDP reduces ransomware, and why are other solutions not affected by that reason?

[pooley]

Can you use a let's encrypt wildcard cert now?

 

But the question remains: Why do they think blocking RDP reduces ransomware, and why are other solutions not affected by that reason?

 

Not clear, they say they have been contacted by a 3rd party (police??) and our LA ip addresses are being targeted, specifically RDP ports.

 

I've enabled Web Access and they don't seem bothered, maybe as they can't brute force it ?

 

Si

[mavhc]

2 options I see are a) brute force, but that's not limited to RDP, could be used for anything, just enforce password complexity, lockouts, logging, 2 factor, change ports etc

b) infected client computers infecting the remote machines, but any VPN type system would be even more susceptible