2FA / Two Factor Authentication Windows RDP/RDS

[SHimmer45]

Enabling 2FA authentication is something which we would like to implement for our RDP server.

ideally would like a system which is straight forward to use and manage as we only have a limited number of users with access.

 

Duo security appears to fit that bill - has one one used it on here recently and would care to share their feedback?

 

Other suggestions for achieving the same thing, i know what MS offer MFA as part of azure (as a school we dont use any azure services / only use O365 for providing licensing to office products)

[tom99w7y2]

We have just implemented Rohos on a RDS server, looked at duo but felt that rohos was a lot simplier to set up. For the authentication we are using the google authenticater app but you can get it to send a sms or an email.

[pete]

We've been using Duo for a couple of years now to secure a RemoteApp deployment and have had no problems with it.

 

Is there anything specific you want to know?

[SHimmer45]

@pete how many users do you use with it and which version do you use.

 

i have watched some of the material on the website, it is actually as straight forward as they make out.

 

cheers

[pete]

We have 40 users currently (35 accounts actively in use) on the "Business" version (no new sign-ups) which is a bit cheaper than the current offerings. Our renewal (just paid it) was $480.

 

Setup is pretty straightforward if you're comfortable setting up rdp hosts and certs. Most common use cases are well-documented.

 

The main time sink was creating documentation (overview of how it works, how to request access, how to setup and configure it on Android,iOS, OS X, Windows, presentation at staff meeting) for users.

 

The free version supports up to 5 users IIRC, so sling it on a desktop / server as a second factor and test it.

[SHimmer45]

@pete

 

cheers for the feedback appreciated

[Cache]

I've also been looking at OpenOTP as that appears to be free for up to 40 users.

 

I'd be interested in feedback from @tom99w7y2 regarding Rohos as that is one that seems extermly reasonably priced that I've been looking at buying come September when my new budget is available.

[localzuk]

We're going to be going down the Azure MFA route ourselves. Apparently, we can pay £6.50 per staff member for the Azure AD Premium P1. If you cover the full FTE, you get pupil capability too.

[Cache]

We're going to be going down the Azure MFA route ourselves. Apparently, we can pay £6.50 per staff member for the Azure AD Premium P1. If you cover the full FTE, you get pupil capability too.

 

£6.50 per month or per year?

[fredbayker]

If you have a sophosutm box you have 2fa functionality built in to it. Works pretty well

[DrCheese]

We have 40 users currently (35 accounts actively in use) on the "Business" version (no new sign-ups) which is a bit cheaper than the current offerings. Our renewal (just paid it) was $480.

Is that yearly? If I go for their cheapest option now (MFA) for 40 users, I get $1440 which is a huge step up in price. If I want to cover all my staff (150 ish) that is $5400 a year which is around £4000. This seems pretty insane to me. It's really annoying tho, as it's the best option I've found. It took all of 30 seconds to integrate it into some of our custom apps.

[pete]

Is that yearly? If I go for their cheapest option now (MFA) for 40 users, I get $1440 which is a huge step up in price. If I want to cover all my staff (150 ish) that is $5400 a year which is around £4000. This seems pretty insane to me. It's really annoying tho, as it's the best option I've found. It took all of 30 seconds to integrate it into some of our custom apps.

 

Yes. Note the "no new sign-ups" caveat in the part you quoted. We're grandfathered into an option that they no longer offer to new customers.

[DrCheese]

Yeah saw that - It's such a shame they've discontinued that price as that's way more doable than what they are quoting now!

[index7600]

You can use a 3^rd party Two factor authentication OTP provider MFA-RDS-OTP (https://www.securemfa.com/downloads/mfa-rds-otp) for Microsoft Remote Desktop Gateway Service. This will allow to use one time passcodes for RDS.

[mavhc]

I made connecting to the VPN the 2nd factor, got to have a cert to connect to the vpn

 

Can also add TOTP as well if you wish https://tunsafe.com/user-guide/2fa

[john44555]

Hi, Do you still use Rohos? It looks very affordable, but I am a bit wary as I have never heard of them.

 

- - - Updated - - -

@tom99w7y2Hi, Do you still use Rohos? It looks very affordable, but I am a bit wary as I have never heard of them.

[tom99w7y2]

@john44555

 

Hi, Yes still use it with many schools. It's basic but it does the job and like you say its very affordable especially with it being a one off cost.

 

[john44555]

@tom99w7y2 Ok great, is the enrollment stored on the rdp server itself, ie if I set it up on a test one will we have to re-enrol when we set it up on our production one? Also their website still says about setting it up on Server 2008 or 2012, I assume its ok on Server 2016/2019?

[tom99w7y2]

@john44555

 

Yes the software sits on the RDS server its self, you get an activation key from Rohos, i would maybe install the trial version on the test to see what you think, you have to add the AD accounts manually to it as well and generate the QR codes or setup SMS etc. Yeah 100% works on server 2016/2019, all of the we ones we have it on are one of the two.

[john44555]

@tom99w7y2

 

Thats a bit a annoying, had hoped we go just tie it to a ad group, so I guess there is a bit of admin to do every time we have a new user.