Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking into providing remote access to some applications where I work.

We plan to use Terminal Services on Server 2003, and after reading up on it, it seems to encrypt all traffic that passes over RDP.

Even though the RDP traffic is encrypted, many people recommend that it should only be run over a VPN.

As I'm kinda new to TS, I'd like to know why people recommend the two levels of security, and why it is not wise to just use bare TS over the internet.

share|improve this question

8 Answers 8

up vote 0 down vote accepted

Wh have a couple of suppliers that insist on being able to RDP in to servers that they manage. Since one of them's our main financial box, this makes me uncomfortable in the extreme, but there wasn't any way around it - we needed to give them a remote desktop, or they wouldn't do anything to the server.

The compromise we hit on was for me to give them RDP as required, but at a few minutes notice; they call us, we run a script that opens the relevant firewall ports, they do whatever's needed then call us again, we run another script that closes the ports.

So yes, it's possible to do this with just RDP, although if you go for that I'd recommend:

1) Only having the service exposed when needed, rather than 24/7.

2) Locking down the range of addresses that are allowed to connect (as far as that's practically possible).

3) Renaming the admin account to something other than "Administrator" and giving it a strong pasword.

share|improve this answer
    
Unfortunately the users will need to be able to access it 24/7, so its going to mean me leaving the port open all the time. –  Chillihead Aug 21 '09 at 14:55
    
Ouch. I'd recommend a VPN, in that case, for safety's sake. Even if you change the port number, someone will eventually notice what service it's presenting. –  RainyRat Aug 21 '09 at 15:03
    
Hang on - an accepted answer with no upvotes? WTF? –  RainyRat Aug 24 '09 at 15:10
    
I would upvote, but my reputation is still too low. –  Chillihead Aug 25 '09 at 10:30

It's encrypted already as you said, the only issue I see is that it's a pain to move the port on which it runs without resorting to registry alterations. There are critics of security through obscurity but it does help thwart some probes and scripts. 99% of the time just running it straight over the webbertubes should be fine.

VPN does have the advantage of not poking holes in your firewall rules. It adds some overhead because you're processing encryption on the link plus the encryption for the VPN, but not much. You also need the VPN client on whatever endpoints you're linking, which depending on your clients can be a little bit of a nuisance while using RDP just requires a generic RDP client.

For the most part I think it comes down to would you rather open a port on the firewall or would you rather support the VPN connection and/or clients for that, and how much of a pain it will be for your users (if you are using roaming users who need it on laptops or home systems, thus supporting the software VPN client and training).

share|improve this answer

Even if you trust the RDP encryption (has it been validated by external experts?), not using a VPN means you have an important Windows server with ports open to the web. Any new remote exploit (and there are several new ones every month) leaves you vulnerable.

Using a VPN means that the only open port is one exhaustively checked for safety by lots of independent experts, making remote exploits extremely rare. Even if there's one that hits you, it's relatively easy to change one VPN for other, without impacting configuration and final usability.

share|improve this answer

VPN might be overkill, you could also use an ssh port forward in a script (plink from Putty works great). i set this up using VNC for the RDC service (it was a Mac house).

Using no pass keys and limiting the users on the internal ssh server would work. This limits the complexity of the networks and also protects the internal network somewhat from compromised client systems.

share|improve this answer

It's it's financially possible I certainly would as Terminal Services will more prone to vulnerabilities. No ports open on a firewall then either

share|improve this answer

I've used RDP over the 'net for a few years with a couple different companies and have not had any issues at all with connectivity and/or security. Granted, our companies have been a bit small so security wasn't that big an issue (not my call though).

A VPN would definitely keep things a little more secure but if you can't go that router than using RDP on it's own should be ok.

Here are a few links with some additional security guidelines for you -

Windows Terminal Services

RDP Security guidelines

share|improve this answer

if you going to use it's best to configure the server/router to only accept 3389 traffic from your source IP address.

share|improve this answer

As a compromise between VPN / no VPN you might look at the Hamachi "personal VPN" option. I've used it in the past with reasonable success. Install the client on the TS and the clients. Create a Hamachi network from the TS (passworded) and then have all the clients join that same network.

Clients then just RDP to the 5.x.x.x address of the TS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.