Re: Securing RDP - Is it possible?

[Mark Owen <mr.markowen () gmail com>]

On Tue, Apr 14, 2009 at 4:27 AM, Chip Panarchy <forumanarchy () gmail com> wrote:
> Hello
>
> Is Secure RDP an impossibility?
>
> I am now working (WOOT) and they seem to use entirely RDP, almost no VNC...
>
> This, by my reckoning would make the network most insecure.
>
> Would you agree?
>
> Or is it possible to Secure RDP?
>
> Thanks in advance for sharing ideas on this matter,
>
> Panarchy

It is difficult to say if RDP makes your network insecure without
knowing more about the architecture.  However, in a properly deployed
environment, RDP sessions are a minimal threat against network
security; and in most instances, less of a threat than a VNC
deployment.

Ensure that a firewall is in place between the Internet and RDP
servers and only forward the required ports (TCP 3389) if configured
for access from the Internet.  Standard measures for securing your
internal network against the public should be set in place and logging
should be enabled for any inbound connections to your servers.  In
addition, if you prefer the false sense of security through obscurity,
you may change RDP's listening port from 3389.  RDP sessions are RC4
encrypted but by default use the maximum key supported by the client.
Legacy clients may encrypt sessions with smaller keys and therefore,
the RDP servers should be set to require 128-bit encryption.
Additional measures to take involve granting access to those who only
need it, restricting the total number of concurrent users that may
connect, and setting a limit for the duration a user may be connected.

There are many more options available to take to secure it even
further, but this should be a good start to follow.
Here's a good link with a few more details:
http://www.windowsecurity.com/articles/Windows_Terminal_Services.html

If that is not enough, you may wish to look into utilizing
certificates, a VPN, and/or SSH tunneling.


Mark Owen

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Learn all of the latest penetration testing techniques in InfoSec Institute's Ethical Hacking class. 
Totally hands-on course with evening Capture The Flag (CTF) exercises, Certified Ethical Hacker and Certified 
Penetration Tester exams, taught by an expert with years of real pen testing experience.

http://www.infosecinstitute.com/courses/ethical_hacking_training.html
------------------------------------------------------------------------