Remote access (using RDS)

[toffee_paul]

Hi,

 

As a small school that have never used remote access before we're now in a position where we need it setting up. This isn't my strongest area exactly but I'm trying my best to get this set up at the request of the headteacher to allow staff to work from home.

 

When the server was installed it a VM was created as a member server and had the Remote Desktop Service role installed along with the File and Storage Services and IIS roles. The configuration of the RDS role doesn't appear to have been completed. Most of the options in the deployment overview are greyed out, which I have read, mean that those have been completed but the RD Gateway has a green + icon, as shown in attached.

 

Here's our current setup:

 

• Physical host with Hyper-V and three VMs- VMs: One DC running Server 2012 R2, two member servers both running Server 2019 Standard (One SIMS/FMS, One RDS server)
  
• Smoothwall UTM - no configuration related to remote access or changes to firewall rules/port forwarding has been done on the Smoothwall.
  
• An 'A' record has been created in our DNS hosting company, pointing the remote access URL we want staff to use, to the schools' public IP address. On the Smoothwall firewall log, I can see attempts I make to go visit the URL are hitting the Smoothwall before being dropped. I know this is expected due to there being no Smoothwall config done as yet to allow the connection through.
  
• When inside the school, browsing to the internal RDS URL (https://remote..lan/RdWeb) I get a "This page is not secure message". If I click 'More information' I get this message "The website's security certificate is not yet valid or has expired. The hostname in the website's security certificate differs from the website you are trying to visit. Error Code: DLG_FLAGS_SEC_CERT_DATE_INVALID DLG_FLAGS_SEC_CERT_CN_INVALID."
  
• As well as the certificate being expired (expired about 4 years ago), The reason the hostname differs is because the SSL cert that was purchased was done when the school was known by another name. We have a new school name now.
  
• I can select the 'Go on to the website (not recommended)' link and it will take me to the login page for where I can enter my AD credentials. I can access the RemoteApps programs such as Word, Excel etc and use the 'Connect to a remote PC' link to connect to a computer in the school.
  

So this is where I'm up to. I'm not sure what additional config I need to do on the Smoothwall or what, if any, changes are needed in DNS. I'm expecting to be told we need a new SSL certificate but can this be purchased from anywhere or does it need to be bought from the same company our school website is hosted by hosting provider? Our domain is also registered with the same company.

I know I'm not a million miles away but I could really use some help from the Edugeek community in getting this over the linem, particularly with the Smoothwall/DNS side of things. Any help offered is much appreciated.Thanks

Edited March 13, 2020 by toffee_paul

[Opendium_Steve]

Please please make sure everyone who has permission to log into the RDS server has a strong password _before_ you set up port forwards to it.

[MartinT]

You will need a Reverse Proxy entry (better) or port forward (less secure) for port 3389 through the Smoothwall. Install your certificate (preferably a wildcard for your domain) in the RDP server and also the Smoothwall if it's not already there for other services.

[localzuk]

You won't need to open 3389 at all - if you're using the Web Gateway, you need port 443 open.

[Chaniel]

You will need a Reverse Proxy entry (better) or port forward (less secure) for port 3389 through the Smoothwall. Install your certificate (preferably a wildcard for your domain) in the RDP server and also the Smoothwall if it's not already there for other services.

 

3389 should never be opened up to the outside world, super common attack vector. He's using RD Gateway which uses 443 so that's not an issue here

 

I'll edit quick with what I think you need to do next, you're pretty much set up though

 

Quickly looking through your post, it looks like you've got it working internally once you bypass the certificate error.

 

Smoothwall - You'll need to add a port forward for port 443 from your schools external IP to your RDS server, this is to enable access to https://remote.school.org/rdweb from external into your server. Once you've done that, you should be able to access the server via the domain name because you've set up an A record with your DNS provider.

 

Certificate - You will need a certificate, we use a wildcard certificate (as we can use that for any *.school.org subdomain). It can be purchased from anywhere, if you're just going to buy a certificate for your remote server then it might be worthwhile getting one that works easily with IIS (ours we have to convert if I remember correctly)

 

Security - You'll want to make sure that everyone has secure passwords, limit the users who can access the RD Gateway to a security group (e.g. staff) as you don't want an old service account being breached and used as your attack vector, apply GPOs to lock down the machine so that people can't access things like command prompt, powershell etc.

Edited March 13, 2020 by Chaniel

[Cazale]

Setup a VPN on the Smoothwall and have people VPN in, and then RDP internally. It's much safer.

 

If you log a call with Smoothwall, they'll even set it up for you!

[jthompson]

The icons for various parts in the deployment overview diagram are not actually greyed out: that's just the colour scheme of the Server Manager interface. A green '+' indicates that that part is waiting to be added. I'd add the RD Gateway and give it a name that matches the external name you want to use (e.g. remote.schoolname.org) rather than the internal name.

 

Then, in your internal DNS, add a forward lookup zone for the external name (e.g. remote.schoolname.org) and add a new Host (A or AAAA). Give that new host record the internal IP address of your gateway server (shouldn't need anything else). This will allow users on your local network to use the external name to get to RDS, without having to resolve it out through the web. Once you've added a suitable certificate that matches the external name, your clients' browsers will be happy to load the login page without throwing up warnings about the page being insecure.

 

I'd second the recommendation to get a wildcard certificate for your domain so that you can use it for other things you might want to publish.

[toffee_paul]

On the SSL front, I've just had a chat with PrimarySite who are designing our new school website. We've not launched yet and we still have our domain and hosting with a different provider. We apparently get a 'free' wildcard SSL certificate from PrimarySite to make our school website secure but the guy I spoke to said he's not aware of sending schools the certificate for importing into their own RDS server. I'm really confused now as to what to do with the this step! Any ideas?

With regards Smoothwall, would anyone be so kind as to help me fill in the fields for the new port forward rule for port 443?

 

[mavhc]

You can a) set up a Certificate Authority on Windows Server, the root CA public key will then be automatically distributed to your Windows domain attached clients. Then you create a cert for that server, and your domain clients trust it.

 

b) use lets encrypt to get free cert

 

c) get the private key of the wildcard cert, and put that on the server

 

d) buy another cert

 

Your firewall setup should be: source IPs: anything, port 443, destination IP: RDS Gateway, port 443

[ibpalle]

Have a look at the SSL VPN setup primer I have just posted in the Smoothwall support forum.

[slugshead]

You only need to forward 443 to the web access server from Any IP.

 

Client IP - Any

Local IP - your external IP that your external DNS is pointing remote.whatever.com at

Services - HTTPS

Target - Your web access server

 

Install a wildcard cert on your web access server

 

I've not published any remoteapp programs. Just leave that section blank. Use the box above instead and it'll generate an RDP shortcut.

Pick Domain users from the user groups

Load balance to your session hosts (dont forget to set up the internal DNS the same hostname but their retrospective IPs).

Enable user profile disks and create like a 100GB share on your file server and put the internal path in for that.

[jmak]

As a thought, rather than an answer:

 

Can you set up Microsoft Authenticator as 2FA for RDP?

[BOOT]

As a thought, rather than an answer:

Can you set up Microsoft Authenticator as 2FA for RDP?

Yes, and I'd definitely recommend it.

[paulkerton]

As a thought, rather than an answer:Can you set up Microsoft Authenticator as 2FA for RDP?

You absolutely can, but I can guarantee your staff will loathe it with a passion.

I required all teaching staff to have a physical yubikey for G Suite use at a school I used to work at. The moment I left, I got a phone call from the new support company asking me how to disable 2FA.

Whatever you do, do not bend to the will of people who think security is just something that "gets in the way".

[free780]

I would not allow RDP without 2FA or an organisation owned device. You can buy Ericom Access Now and put it behind N app Proxy to force 2FA. 2FA with NPS and RDS GW is messy and doesn't prompt on screen but is necessary.

Also for improved performance make sure UDP 3391 is allowed inbound to your gateway and from the gateway to the RDS hosts.

Edited March 16, 2020 by free780

[mavhc]

If they're using work laptops to connect probably a vpn is easier than 2fa

[Techie2000]

Sorry to jump on this post, does anyone have a good guide for setting up an RDS server? I'm after setting up SIMS for our trust leaders to be able to work remotely but haven't looked at this before!

[jthompson]

Sorry to jump on this post, does anyone have a good guide for setting up an RDS server? I'm after setting up SIMS for our trust leaders to be able to work remotely but haven't looked at this before!

 

Try this one https://msfreaks.wordpress.com/2018/10/06/step-by-step-windows-2019-remote-desktop-services-using-the-gui/. It has screenshots at every step. It covers setting up the high-availability mode as well, but you can go simple and just have all of the components running on a single server.