Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am planning to deploy a Windows server running a web application into a colocation for the first time. I have already run IIS lockdown and done a number of other security tweaks based on advise from the smart folks here on the site.

So now I am wondering what I do for providing secure remote desktop or similar access to the machine for tweaking and manipulating the app online. taking the app offline etc. Do I ask the provider to set up some sort of whitelist allowing my office IP forward to the RDP port or do I need to provide hardware or other software to lock the box?

If there is a similar question or tip, point the way and I will close this question.

share|improve this question
    
Similar question: serverfault.com/questions/9558/remote-desktop-security –  sleske Sep 1 '09 at 8:56
    
Yes thanks that provided some good tips. –  MikeJ Sep 1 '09 at 10:05

3 Answers 3

up vote 1 down vote accepted

When your server's in the colo does it just have Internet access, or do you also have a LAN extension or similar private circuit to manage it over? If so, then it's a non-issue and RDP won't be a problem. If not, then I'd definitely recommend locking RDP down past the defaults; different port, oddly-named Admin account with a strong password and a restriction on which IP addresses can connect to the service.

share|improve this answer
    
My understanding is that the colo provides the cage, the power and the power. My understand is that I probably need some sort of router in between the port and the box to filter access? –  MikeJ Sep 1 '09 at 10:12
1  
Yes, definitely. A firewall would be more suitable, but routers support access lists as well - assuming no private circuit, you'll want to allow the great unwashed of the Internet access to ports 80 (and possibly 443), while locking port 3389 (assuming you leave RDP running on the default port) down to just your own external IP from wherever you're managing it from. –  RainyRat Sep 1 '09 at 11:36

I usually run RDP on a port "other than" 3389 (security through obscurity). Also, I lock down RDP to allow only one certain user account.

share|improve this answer

In principle, RDP uses encryption, so you could just use it over the Internet as-is. However, it has a history of security vulnerabilities, and it's probably best to leave encryption to a dedicated protocol.

So I'd recommend setting up some kind of extra encryption, either a VPN, or a SSH tunnel or similar. Then you can use RDP across that.

See for example

http://serverfault.com/questions/60572/remote-desktop-over-ssh-to-windows-7-box

for using RDP over SSH. SSH is probably easier to set up if you need it just for RDP. If you need to access other services as well, a VPN might be more appropriate (but then, you can access everything locally over RDP anyway).

Restricting access by IP is an additional security measure, but also severely limits your ability to access the system. With a VPN/SSH tunnel, I don't think it's necessary.

share|improve this answer
    
Do you have any details on these vulnerabilities? –  Mark Henderson Sep 1 '09 at 9:18
    
I'm not intimately familiar with RDP, but AFAIK, early versions used no encryption at all, and later versions were vulnerable to MITM attacks in the default configurations; just google for details. I would just trust a dedicated security protocol like SSH or a VPN more than RDP which added security as an afterthought. –  sleske Sep 1 '09 at 10:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.