Do i need a DMZ?

[Joko]

I am about to roll out an RDS setup of up to 10 machines (for now) and this will be the first time an external user can remote in from home etc as we're moving away from Frog.

 

We use Smoothwall for our proxy/firewall and also have another Fortinet firewall with our ISP. Although i'm pretty sure this isn't used much as Smoothwall does everything.

 

Am i right in thinking, it's better to have these servers within a DMZ? I have never actually set up a DMZ before or looked at one so sorry if my wordings not 100%.

 

Cheers

[Domino]

For remote RDP I'm in favour of using an Remote Desktop Gateway rather than allowing the connections directly from the big bad internet.

 

More here: https://turbofuture.com/computers/What-is-Remote-Desktop-Gateway-and-how-to-install

[SchoolsBroadband]

it's better to put it in a DMZ so that if it were ever compromised then it either can't access your LAN or the ports / IP's it can do are restricted.

 

Your Fortinet firewall comes with IPSEC and SSL VPN. I'd recommend you use that rather than allow RDP straight through from any IP. You can also do 2-factor authentication for even better security.

 

If you're with us then do send me a PM and I'll get our pre-sales tech to advise.

 

Thanks

 

Dave

[mavhc]

What are you going to be using RDS for? Whose computers are going to be connecting?

[Joko]

it's better to put it in a DMZ so that if it were ever compromised then it either can't access your LAN or the ports / IP's it can do are restricted.

Your Fortinet firewall comes with IPSEC and SSL VPN. I'd recommend you use that rather than allow RDP straight through from any IP. You can also do 2-factor authentication for even better security.

If you're with us then do send me a PM and I'll get our pre-sales tech to advise.

Thanks

Dave

 

Thanks for your reply! We are with you, yes.

 

So in essence from a client basis the process would be :

 

User Connects to VPN > Connected to the Gateway Broker within the DMZ > 2FA > Broker connects to RDP hosts ?

 

I assume i don't need to use Smoothwall's firewall apart from port forwarding to the DMZ?

 

What are you going to be using RDS for? Whose computers are going to be connecting?

I would like them to spin up machines within the server based on a gold image. Pretty sure i have done this before in a lab environment.

[mavhc]

I mean what is it for? Teachers connecting from work laptops off site? Teachers using home computers? Students doing either of those things?

[Joko]

Oh, my bad.

 

For now, MAT employee's & Staff at home to connect onto a PC for Office / Other system work that they can't get from 365 etc.

 

I hope to push it for student use in the future, but that would involve Hardware upgrades so, just staff atm.

[mavhc]

So probably want an SSL VPN rather than IPSEC https://openvpn.net/faq/why-ssl-vpn/

[win]

For RDS you need the 'gateway' server to be in the DMZ, the other roles like session hosts, licensing, and broker, can be within the domain network. You won't need smoothwall for anything, just route external traffic via Fortinet straight to your gateway server

[mavhc]

So options are:

1. It's just one server so forward 3389 from external ip -- attack surface is RDP protocol flaws, and username/pw brute forcing

2. 1, but with SSL vpn, can use 2FA if supported on vpn

3. RD Gateway, kind of a specific ssl vpn, switches attack surface from RDS 3389 to RDG 443, with the same u/p brute forcing

4. RD Gateway and SSL vpn, now you have 3 layers that need to be attacked

[SchoolsBroadband]

Yep. You can lock it down as much as you want.

 

I'd suggest

 

1. Use remote ssl vpn software

2. Tie authentication into windows ad for user username and password for simplicity purposes

3. Create a vpn use group in ad which then only allows users in that group to be allowed to authenticate via vpn

4. Use 2 factor authentication via a mobile software app (note there is a charge per physical fob or software app deployment for two factor authentication.

5. In the policy only allow vpn use access to the required ip addresses and ports.

6. Consider use of a DMZ although that may be going a little ott if you do the rest above as could complicate your rule sets but is ultimately the best thing to do.

7. Really go to town and setup Ips/ids and inline anti virus scanning on that profile to check for malicious traffic which could infect rdp or any other service/ port which is accessible via vpn

 

Theres more things on top of that you can do but doing the above is pretty strong.

 

Dave

[mrcrazy04]

If users are going to be connecting their own devices to a VPN, I’d recommend going with a DMZ (and making sure that’s all the VPN users can access) to avoid a malicious device running around your internal network.

 

I also second the use of 2FA, as odds are at least one user will have a rubbish password (even if it meets the password complexity requirements, “January@2020#” isn’t a good password).

 

If you don’t have AppLocker rules for teachers, I’d suggest looking at implementing them on the RDP servers, to reduce the attack surface. If Server 2016/2019 supports it, it’s also worth looking at the Windows Defender Attack Surface Reduction Rules, which can block malicious PDFs and macro behaviours.

 

There are other things you can do, like putting the RDP servers in a segregated network with tightly locked down access to other resources, or using Read Only Domain Controllers - but how far you want to take it will depend on your risk appetite and how much time you have to build and support this.

 

If you’re looking to roll such a solution out to students down the line, it’s worth noting that if an RDP server is compromised, it could expose a large number of user credentials (although Windows 2012R2 and later have made that more difficult). Taking extra steps on those, such as segregating them and not logging onto them with Domain Admin or other privileged domain accounts would probably be a good idea for those.

[Joko]

Thank you so much for all your advice!

 

Seems there is a good plan on what i need to do. Better get building some servers!

[mavhc]

Bit evil to charge for software based 2fa, TOTP doesn't require any servers to be running, should be free. Who's charging for it?

[SchoolsBroadband]

Fortinet charge for it. It's the same price whether a physical fob or a software app.

 

Dave

[Domino]

If you've got Azure AD Premium P1 or P2, you can use Azure MFA with a RADIUS plugin

[mavhc]

Or just run a VPN VM https://www.turnkeylinux.org/openvpn

[Domino]

That provides more auth options than a Username/PW how?

[mavhc]

Because you can add a 2fa plugin, eg https://github.com/evgeny-gridasov/openvpn-otp

[Domino]

Same as a RADIUS plugin? It's running over SSL anyway, the VPN only means all other traffic from the target machine will travel to your network (unless you're split tunneling, which has it's own issues)

 

RDP over SSL means the connection is protected whilst also leaving the rest of the machine's connectivity unaffected.

 

On that note - if we're discussing DMZ segregating the target machines, but they're expecting access to internal file shares, resources etc. Surely that will require a lot of holes being poked through to the internal network. At what point is the protection diminished?

 

I feel VPNs should be limited to trusted machines - there's better publishing options for other services

[mavhc]

I think we were talking about VPN/RDG to a DMZ machine, and from there there's 1 port open, 3389, to the RDS VM on the LAN.

 

Question is how best to protect the accounts of likely terrible teacher passwords, and protect the DMZ machine.

 

After the 2FA and VPN login, now you're logged into the DMZ gateway machine and can then RDP to the RDS either via RDG or normal RDP client over the VPN.

 

Still doesn't stop the keyloggers and screenshotters from stealing the info you type/view, but at least the TOTP stops them reusing your creds (except you synced that password to O365 and Google, so they need TOTP too)

[Joko]

Just a quick sanity check if i'm going to use a DMZ with the server roles.

 

Within my LAN:

• Host Server 1
  
• Host Server 2
  
• Broker Server
  

 

DMZ:

• Gateway Server
  

 

Where should i put the WebAPP Role? I'm reading that its not safe to add the WebApp role within the DMZ.

 

Cheers,

 

Joe.