0

I have a desktop and laptop both running Windows 7 Professional. My goal is to secure the desktop so that I can securely use "Remote Desktop" over the Internet from ONLY the laptop.

I have already done the following to secure the desktop:

  1. Required encryption on the host (as per this article)
  2. Forwarded the remote desktop port through my router to a random obscure port number.
  3. Setup a complex password for my account on the host.

None of these allow connections ONLY from my laptop.

What else can I do to increase the security?

Improve this question

5 Answers 5

Reset to default
1

A couple of options...

  1. If you use a Remote Desktop Gateway, you can configure a Remote Desktop Connection Authorization Policy (CAP) that requires computer to belong to a specified group. [EDIT] Information on setting up a RD CAP can be found here.
  2. There's a 3rd party utility called SecureRDP sold by 2X that does exactly what you want. It's also now freeware.
Improve this answer
1

On a router You may have possibility to restrict transmission by mac adres of Your laptop's network card. It is router dependent:here You have example: http://www.wikihow.com/Create-Machine-Address-Filter-List-on-a-Home-Router . Check Your router documentation.

Improve this answer
1

While one option would be to use ipsec, it can be a PITA to get set up to run reliably across any network - tunnelled protocols are much more robust.

If it were me I'd drop the built-in encryption/random obscure port number/complex password and route the connection using stunnel with client certificate validation (and using a simpler password). That way you can limit access to a device holding the right client certificate (or a certificate signed by the right CA).

Running your own Certification Authority may be overkill for just one remote user - several CAs provide signed certs for email use relatively cheaply (compared with certs for use in webservers / VPNs). Indeed, Thawte used to give them out for free, Entrust currently charge 20 USD/annum. But its not that hard to create your own CA (although I've never tried to setup a CA on MSWindows).

Then firewall direct access to the RDP post on the desktop and opnly allow connections from the ip address where the serverside stunnel is running.

I've previously used such a setup for VNC, mail and telnet (yes, I know - it's a long story) for road warriors. RDP will work on this kind of setup.

Improve this answer
1

Don't know if the RDP-client you are using, supports SOCKS5 proxies. But if it does, you can set up an ssh-encrypted tunnel with client-certificates.

SSH-tunnels are not that difficult to set up.

Improve this answer
1

I would add a two-factor authentication module, so attackers would not be able to brute force their way in (humans tend to use terribly simple passwords).

One such option is Duo Security, which can push prompts out to smartphones (through a proprietary app) or send one-time passwords via text messages. It is free for up to 10 users.

Another option is open source "mOTP-CP", or "MultiOneTimePassword Credential Provider", which allows you to use Google Authenticator, which you may already use for other services.

I'm sure there are many other options.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .