Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My customer currently blocks outbound RDP and SSH, which means that none of their employees can get access to external Windows and Linux boxes (at the console level). However, a need has recently arisen to give access to an assortment of RDP and SSH endpoints scattered throughout the internet. The endpoint IP addresses are a moving target, and an access list exists to define what those IP addresses are.

So now my customer wants to have a single Windows Server that they control as the sole outbound point for RDP/SSH to the internet. Consider it a jump box to the internet. If one of our admins have an access to this Windows box then they can log on, and from there bounce around to RDP/SSH endpoints on the internet.

Is a standard Windows 2008 box going to work as a jump box? For example, I seem to recall that Win2k8 limits the number of users that can log on simultaneously, which means that the jump box may not be accessible if lots of users are on it. Advice as to how to make this work..?

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Add a Windows server as your 'Jump Box' and then add the Terminal Services licensing role to an existing 2k8 box on the network. Then you can have as many users as a) the hardware will support and b) you can afford to buy licenses for. I use a 2k3 box as a RDP (terminal) server in a similar setup and it works fine. Piggybacking RDP isn't terrific, but it's a whole lot better than nothing. SSH on the terminal server is indistinguishable from SSH on the local box. 2k8 allows for you to do some other fancy things with App Virtualization, but I don't have a lot of expertise there; from what I know it would be overkill in your situation.

Edit: Summary info on TS Licensing here. From the quoted page:

To use TS Licensing to manage TS CALs, you will need to do the following on a server running Windows Server 2008:

  1. Install the TS Licensing role service.
  2. Open TS Licensing Manager and connect to the Terminal Services license server.
  3. Activate the license server.
  4. Install required TS CALs on the license server.

Licenses are per device or per user, I don't know which is a better fit for you, but step by step guide is here.

share|improve this answer
    
Cool. Is Terminal Service licensing role a feature that just needs to be enabled, or is it an additional product we need to buy? Excuse the ignorance, ain't my area either ;-). –  James Wright Jan 31 '11 at 22:50
    
Also, do you mind me asking how many users you run simultaneously on the box... I assume that 10 simultaneous user accounts would work, but that would likely be the maximum on a standard server. –  James Wright Jan 31 '11 at 22:54
    
@james - you need to license the server for TS users, so you will need to pay for it. There are two "admin" accounts included for remote administration of the server (which is what Jasmine is alluding to), so you could use these if you have < 2 concurrent users. –  Mark Henderson Jan 31 '11 at 22:58
    
See edits above. We have a 2k3 box with up to 10 users on it at a time using a DB/Accounting application, and none of them experience significant lag. That is a dual Xeon 2.8 box with 4GB RAM and a RAID-5 array. –  atroon Jan 31 '11 at 23:01
    
Just an FYI... TS CALs are required in addition to Server CALs, so 10 users requires 10 of each CAL. –  Joe Internet Feb 1 '11 at 3:56

Is installing a SSH server on the box an option? If so why not setup the an SSH server, and allow using it for forwarding ports only. Basically you setup an SSH server as a bastion host.

If that is not an option consider setting up a VPN on on that box. Have people establish a connection to the VPN, and then once the connection is established, permit them out.

The RDP may be easier. It seems like you could setup the Remote Desktop Gateway service, and setup the policies to allow the people you wish, to use that gateway for all connections.

share|improve this answer
    
+1 - You said exactly what I wanted to. (Wish I hadn't been on the phone so I could have... >smile<) The licensing expense and relative complexity seem to be overkill for using RDP as this "gateway" machine. SSH tunnels make a fine authenticated layer 7-based gateway. –  Evan Anderson Jan 31 '11 at 23:03

If you are planning to use RDP to connect to the "jump" and then use the jump to RDP into other boxes, then yes, you will have a problem. The jump box will only allow 2 connections, and running piggyback RDP sessions is very slow. It will work, but it won't be fun :)

share|improve this answer
    
Is this a max of 2 outbound RDP connection? Any better options --- for example, I have heard of RDP proxying, but I am not quite sure what that is. –  James Wright Jan 31 '11 at 22:43
    
No, it can create as many outbound RDP as you have resources for. But remote machines can only support two RDP sessions. So, you could have max of two users in your jump box at any one time, but those two users could connect to hundreds of other machines from there. –  Jasmine Feb 1 '11 at 18:27

Is this a max of 2 outbound RDP connection?

No, this is the maximum amount of concurrent users connecting to your jump box using RDP ( you can only have two incoming RDP sessions to a windows server not running terminal license ).

Any better options ?
I would setup a Linux box with ssh. Then allow your admins to use ssh for port forwarding both ssh and rdp sessions to remote machines.

You can easily control where to allow traffic to go to ( using iptables ) and easily control access to the box with no extra costs ( other then the hardware ).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.