Securing Windows server 2003 Remote Desktop access for access through the internet

[albertwt]

Hi All,

 

I have configured Windows Server 2003 Web Edition in my DMZ, i can access it from my local LAN in the office through remote desktop.

 

Now, I'm wondering if I'd like to access the server through remote desktop from the internet how can i do it securely ?

 

is there anything that I should use eg. install a certificate or SSL secured, etc to make it safe ?

 

thanks,

 

Albert.

[ajbritton]

I will be interested to see what people say about this.

 

I hear conflicting opinions about the security of RDP. According to Microsoft, of course, it is secure but I've also heard that it is susceptible to a so-called man-in-the-middle attack.

 

One way to increase the security would be to tunnel in over SSH. You would need to run SSH software on the server (e.g. openSSH) and something simple like PuTTy from wherever you need to connect. You use PuTTy to establish an SSL session to the server then tunnel RDP through it. I'm sure someone else can explain the intricacies better than I.

 

http://www.softwaresecretweapons.com/jspwiki/windowsremotedesktopoverssh

Edited August 10, 2009 by ajbritton
Added link to RDP over SSH

[powdarrmonkey]

RDP is susceptible to attack, yes - brute force and MITM. I would much rather create a proper VPN and connect to that, then RDP through it (following the usual best practises, of course).

[FN-GM]

Tom from smootheall has some good advice about this.

 

Have you looked at server 2008 remote access? This kind of thing is supported allot better. I can't go into it much as I am on my iPhone.

[albertwt]

I will be interested to see what people say about this.

 

I hear conflicting opinions about the security of RDP. According to Microsoft, of course, it is secure but I've also heard that it is susceptible to a so-called man-in-the-middle attack.

 

One way to increase the security would be to tunnel in over SSH. You would need to run SSH software on the server (e.g. openSSH) and something simple like PuTTy from wherever you need to connect. You use PuTTy to establish an SSL session to the server then tunnel RDP through it. I'm sure someone else can explain the intricacies better than I.

 

Software Secret Weapons: Windows Remote Desktop Over SSH

 

Hi There,

 

yes, I was thinking to setup some sort of digital Certificate authentication process (sort of token) to authenticate who is logged in to the windows server from the internet.

 

but i'm not quite sure how to do it.

[Michael]

I suppose you could change the port RDP uses. You can do this in the registry

 

Type in RDP as follows: 192.168.0.5:12345 (for example).

[ezzauk]

In the past iv created a vpn connection in ISA, then rdp in to what ever server you needed to.

[Midget]

I agree with ezz, I would never open up RDP to the world. only VPN access should be open.

[albertwt]

Hi All,

 

Thanks for your responses, I've found guide from Microsoft:

 

http://support.microsoft.com/default.aspx/kb/895433

 

but somehow in both my XP Client and Windows Server 2003 Remote Desktop application (mstsc) version 6, i could not see the security tab ?

 

therefore from the above link, i am stuck in "Step 2: Configure authentication on the client computer"

 

Has anyone succeeded yet ?

 

Yes we do have a VPN using CISCO, but this Windows Server 2003 Web Edition box will be sitting in the DMZ and it will be accessed by our new contractors from different country to perform remote management access and we only want to isolate what he can access only within that box.

 

 

I wonder if this is possible ?

[EduTech]

Our LEA have blocked ports 3389 and 1723 as they say thier insecure and we have to use their crappy Cisco VPN

[Michael]

Our LEA have blocked ports 3389 and 1723 as they say thier insecure

 

That's probably their official line which is just ridiculous to be honest. You can Remote Desktop once you're connected to VPN.

[EduTech]

That's probably their official line which is just ridiculous to be honest. You can Remote Desktop once you're connected to VPN.

 

I say i have just replied to your PM, we are actually under Sandwell but yes this is a general policy. I Spoke to Synetrix about this and they cant see why the VPN port would be a problem but the LEA guy thinks it is

 

It's not line i am going to make that change to every user in AD so everyone can VPN onto the site lol!!

 

Just a reason for us to pay them 50 - 100 pound per VPN user! and then a cost every year so they can test the security!

 

I can see OpenVPN being setup! lol

 

James.

[albertwt]

Hi There Edutech,

 

I thought that by changing the default port 3389 into something else would be fine ?

 

You can move the terminal services port from 3389 to another port by changing the registry key at

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber

 

You will then need to specify the port when you connect to your system. Connect with something like "my.computerathome.com:1234" instead of "my.computerathome.com"

 

It's just too much efforts for the user to download the VPN Client, then set the profile and such...

[powdarrmonkey]

Hi There Edutech,

 

I thought that by changing the default port 3389 into something else would be fine ?

 

One day, I will introduce you to my friend the port scanner.

 

In the meantime, just moving the service to another port doesn't give you any kind of security, except again opportunism I suppose. Hiding things doesn't make them any less vulnerable.

[EduTech]

Yeah i know you can change the port RDP uses, but i didn't reall want to mess around with that lol i think i will result in OpenVPN its only for us anyway. staff with have to wait until we get SUN VDI

[GrumbleDook]

I will no longer authorise RDP into Northants schools and over the next 12 months will be asking schools to move to a more secure remote setup.

 

It is open to attack as previously mentioned and it is scary the number of people that have set it up on their MIS to allow for SLT to access the MIS at home in *clear* breach of the DPA!

 

Seriously folks ... it is not secure, go for a decent VPN solution or other alternatives such as Sun Secure Global Desktop or Citrix ... both over HTTPS with a valid certificate.

[albertwt]

aaaahhhhhh... >_< that is soo scary...

 

anyway using OpenVPN or anything with two factor authentication such as RSA SecurID is the secure way to do it but yes we will have to invest anyway ;-|

[SYNACK]

Or use TSGateway over HTTPS which comes built in to Server 2008 which also gives added security. Edited August 19, 2009 by SYNACK

[PiqueABoo]

Do any of the RDP MITMs people have in mind actually work if you turn on server TLS authentication (something you've had an opportunity to do for years now)?

 

The problem for RBCs/whatever is that you can't rely on people to configure these features, or have genuinely strong passwords etc. , so they're pretty much forced to mandate VPNs.

 

I expect the 2K8 [2k8R2]+ TS[RD] stuff over TLS will get people more in the security groove though... and I'm definitely prepared to argue the case for that vs. splashing out what can often be a *lot* of money on commercial VPNs.

Edited August 19, 2009 by PiqueABoo

[albertwt]

Yes, I agree with using the existing Windows features (2003/2008) ratherthan getting additional VPN connection with 3rd party.

 

So in this case I shall try to deploy Windows Essential Business Server 2008 Standard Security server as they are equipped with FireFront Threat management and also this edition of Windows Server does not need to be member of Active Directory.

[PiqueABoo]

I agree with using the existing Windows features (2003/2008) ratherthan getting additional VPN connection with 3rd party.

 

That's the spirit.

 

No one's answered the question yet, so after a very quick google I found this Configuring Terminal Servers for Server Authentication to Prevent “Man in the Middle” Attacks. Not necessarily the last word, but it's recent-ish and item 2b (pointing to KB895433) is the 2K3 update I had in mind.

 

And again with 2K8 you just run RDP over TLS with all that security stuff to play with. The only downside, as ever, is the client boxes: If they're "yours", locked down and configured nicely before they get home it's not too bad, otherwise..