up vote 1 down vote favorite
share [g+] share [fb]

I'm looking at securing a web server (Windows Server 2008). A GRC port scan recommended that I close down port 135 (https://www.grc.com/port_135.htm). However, I've done this before with Windows Server 2003 and after doing this I wasn't able to RDP to the box.

Why is port 135 needed for RDP (port 3389) and since I don't have physical access to the box should port 135 be blocked (if so what about RDP)?

Thanks.

link|improve this question
100% accept rate
feedback

3 Answers

up vote 3 down vote accepted

The RPC Endpoint Mapper (port 135) is definitely not required by RDP, and it is perfectly reasonable (and suggested) to block it on a firewall so non local hosts cannot attempt to enumerate and exploit services.

I only say this with certainty because I have many hosts configured like this, and actually just tested it to make sure I wasn't crazy ;-)

link|improve this answer
So you have it completely blocked and you can connect via the Internet (i.e. not local network) with RDP? Thanks. – pbz May 5 '09 at 15:38
I blocked port 135 and was able to connect afterwards... phew ;) Not sure why this didn't work with W2K3. Thanks. – pbz May 5 '09 at 15:51
yes sir. This is also how Amazon EC2 deploys their servers. – Michael Gorsuch May 5 '09 at 15:52
feedback
up vote 1 down vote

I think because parts of Terminal Services use it:

TCP Port 135 - RPC Terminal Services Licensing

TCP Port 135 - RPC Terminal Services Session Directory

So when you connect via 3389 - the server wants to see how your TS is licensed, etc so it uses TCP/135 to call your DC or wherever your TS Licensing is kept.

This article can help

http://support.microsoft.com/kb/908472/en-us

link|improve this answer
Only used within a network for licensing. You shouldn't be licensing your servers over the the internet. – Mark May 5 '09 at 15:41
It must be something specific to Windows Server 2003, because I tried it with Server 2008 and it worked. Thanks. – pbz May 5 '09 at 15:52
feedback
up vote 1 down vote

Yes! Close that port!

Done it? Whew...

Don't expose that port to the outside. Not a good idea. You'll be fine with just the RDP port open. Yes, I have empirically tested this with a server running RDP. Note that there are some DoS attacks against unpatched RDP servers, so be sure to get up-to-date.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.