Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my office, there is one Network Server running Windows 2003 SP2. This IS NOT A WEB SERVER. There are 7 workstations, each one is running Windows XP. Two of the workstations are setup with Credit Card scanners for my clients. I have a Static IP address, so as to connect to my office Server by using the Windows RDP feature.

The Credit Card Scanner people now want me to "configure terminal services to utilize SSL for authentication of the server." They are concerned about a "Man in the middle attack."

If I connect with a SSL seller, such as Godaddy, or for that matter, any seller, and in turn purchase a SSL Certificate, do I download this certificate? Do I have to configure it on the server to issue PKI's. I'm just not sure on what to do, after downloading a certificate. What exactly are the steps that follow once I purchase a SSL certificate?

This should go without saying, but I'll say it anyway, any help will be greatly appreciated.

share|improve this question
    
Thank you "Chris S" and "Hurbert Kario" for your suggestions. I'm anxious to try both of them out, and I will do so within the next few days. I've been out of my office for awhile because of some personal issues and haven't been able to complete your suggestions. But, I definately will post what happened. –  John Wesley Aug 18 '11 at 5:54
add comment

migrated from security.stackexchange.com Aug 13 '11 at 18:54

This question came from our site for Information security professionals.

1 Answer

You just have to configure the server to require TLS (No version of Terminal Server/Remote Desktop supports SSL; they're misusing this term so laymen will understand, hopefully) .

You need a certificate. You can setup Certificate Services on the server and issue your own, more work than it's worth for one certificate. Or you can get one from one of the Free Certificate Authorities. Or you can use a paid CA as you mentioned in the Question. In any case make sure the Subject Name (SN) is the DNS name you use to remote into the server.

Install the cert, the CA should provide directions. Short version: run mmc, add Certficates snap-in for Local Computer, under Personal Certificates, import the pfx file from the CA.

Then configure the server to use TLS and the Cert. Open the Terminal Services Configuration mmc, Connections, Properties, Edit Certificate, set the certificate to use and use TLS (might be called SSL here too, 2003 is an ancient system I haven't used in a while).

Edit:
Official How to configure a Windows Server 2003 TS to use TLS for server authentication

Edit 2:
The Common Name (CN) is the name that appears on the Certificate you get from the CA. This name must match what you enter to connect to the server. For instance you might be using server1.example.com. When you run "Remote Desktop Connection" and it asks for the "Computer" to, whatever you type in there must match the CN. If it does not match, say you type in an IP (which most public CAs will not issue a cert for) you'll get warning message every time you connect. That warning message can be turned off, but that would defeat the purpose of all this.

Being in a workgroup or a domain makes no meaningful difference. The only minor difference is that in a domain a server must have a full DNS name already (ie. the server1.example.com above); where in workgroups computers can be addressed by their NetBIOS name only (server1 in the running example). So you might have to figure out what domain name to use. If you don't have a domain name at all yet, you'll have to acquire one (this is a DNS domain name; not Active Directory Domains; I know, poor name choice).

The "Configure the server to use TLS and the Cert" are two on-screen options you'll see in the dialog. There will be a dropdown box listing the available certificates, and another dropdown box listing available security options (one of which will be Require TLS; or something similar).

If this is all well over your head, you might want to contact a local consultant. Getting this setup should take about an hour or less, and would be a great way to evaluate a local company's competency.

share|improve this answer
    
One note: If you don't use CA trusted by windows, you need to add its certificate to computers trust store, not user's, otherwise you won't be able to connect using Vista or 7. –  Hubert Kario Aug 14 '11 at 13:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.