Terminal Server over the internet 1

[PaulGillespie]

Hi Guys,

I'm going to be installing a terminal server soon to allow a remote office acess to HQ. It will also be used from time to time by staff from home.

My question is: is it safe to have port 3389 open on the firewall and allow users to connect straight to it over the internet or should i be using some other form of security.

Thanks

Paul

 

[porkchopexpress]

I would take a look at the MS terminal server secrity guide lines, one good way of protecting the TS is to run it on a port other than the default and then open that port on your firewall.

http://www.microsoft.com/downloads/...d1-9e4d-4007-8eaf-c30623e71250&displaylang=en

 

[PaulGillespie]

Thanks, didn't think i could change the listeing port or the port RDP client uses to transmit on. I'll look into it.

Cheers

 

[porkchopexpress]

Yep take a look at this link.

http://www.petri.co.il/change_terminal_server_listening_port.htm

There is also a good Deb Shinder Deb Shinder article on Windows Security that tells you the encryption options that you can use in windows. Also most firewalls will support tunneled connections as well.

http://www.windowsecurity.com/articles/Windows_Terminal_Services.html

 

[twicki]

I currently run two remote terminal servers and we allow access via the RDP port but authenticate the users from home using a Watchguard Firewall then Windows and once on a VPN link we then allow access to the terminal servers. With regards to your remote site you just need a secure VPN tunnel and they will just connect automatically

 

[PaulGillespie]

Thanks twicki, thats what i was wondering about. Is RDP traffic unsecure if not over a VPN? i thought RDP traffice was encrypted by default. Am i wrong?

 

[twicki]

No the data is only encrypted if you encrypt on send but for £300 you can pickup two netgear VPN firewalls and create a secure tunnel or if you have more cash we bought two Wathguard X700 firewalls for the ADSL line which is what we allow home users down and then 2 netgear for a secure tunnel but the watchguards where £1000 each. It really depends on the sensitivity of your data see we are an aerospace company so ours is sensitive

 

[porkchopexpress]

No RDP isn't by default but you can force "High: encrypts both the data sent from client to server and the data sent from server to client using a 128 bit key".

But as twicki says and i pointed out even budget models like cisco PIX will allow you to encrypt traffic.

 

[PaulGillespie]

I know about HW VPNs and have a few in place for site to site traffic and have experience of Netgear and Zyxel VPN firewalls. I'm just trying to gauge whether it is essential for home/mobile users to have to VPN in first then RDP over the tunnel. For this particular client, the information is not sensitive but i am concerned about malware/hackers/crackers/other internet threats etc.

If someone has to VPN in first using PPTP then logs into the terminal server, both authentications are the same, i.e. same usernanes and passwords. so if someone can guess one, they've got the other. Am i making sense?

Thanks for your input, i'm learning here

 

[Roadki11]

Here is a doc on encryption for TS:

http://support.microsoft.com/kb/275727

RoadKi11

 

[PaulGillespie]

Thanks Roadki11, very helpfull!