Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently run Remote Desktop on my home computer (Vista Ultimate). It is always on so I can access things from my home computer when I am not there. I have a linksys firewall and use port forwarding to allow access to the correct ports.

How secure is the RDP protocol? It seems to be as secure as the username/password combination you use but I am not sure. Is there a more secure alternative that still has the same functionality?

UPDATE: Lots of great answers. I am going to try SSH tunneling first. I will post with an update when complete.

share|improve this question
    
Do you mean "... access things from my work computer" in sentence #2? –  tomjedrz May 18 '09 at 18:18
    
Thanks for the post- this has been a concern of mine for some time and I have tried several <a href="proxynetworks.com/products/index.html">Remote Desktop</a> systems in efforts to avoid any security loopholes that might be able to be exploited by experienced programers/hackers... –  user74605 Mar 15 '11 at 21:51

9 Answers 9

up vote 2 down vote accepted

I run a linux virtual machine for playing around with ruby as well as running an SSH server.

Then I use putty and I tunnel my RDP session through the SSH tunnel to ensure its security.

Information on doing this available here:http://www.engr.wisc.edu/computing/best/rdesktop-putty.html

A bonus: you can just add a tunnel to putty and access another PC at home if you have one, or you can make web requests, etc straight to services at home without exposing them to the internet.

share|improve this answer
    
Just be careful with what you "expose" to the world. As any exposure could be a security problem. Make sure that your Linux VM is locked down and updated and that your router limits the ports that are exposed/forwarded. –  GreenKiwi May 18 '09 at 23:37
    
You're just exposing SSH, nothing else unless there is a reason for it. –  sparks May 19 '09 at 13:30

Remote desktop in Vista can be pretty secure. It can use SSL for transport encryption and does network level authentication to verify that the host is the one you where expecting. Getting your traffic is snooped on is unlikely. But that doesn't prevent someone from trying to login. I believe you can setup your system to do account lockout, so if an attacker does start to try lots of passwords they will lock the account.

Here is a good article on getting it secure.

share|improve this answer
    
+1 for suggesting already built-in security measures. Too often, users of an operating system and its related services and applications go outside of the default distribution for functionality already included in the core - due to simply not knowing it exists... –  Oskar Duveborn May 18 '09 at 20:12
    
Three reasons I prefer SSH tunnels with putty over Secured RDP. 1. Account lockouts annoy me 2. With SSH I can get access to anything internal by only exposing 1 port without having to deal with any RDP annoyances. 3. Auto-sign on using certificates with putty(can probably be done with terminal services as well but I've never tried). –  sparks May 19 '09 at 13:35
    
@sparks. All good points, but not really related to the question I was trying to answer which is 'How secure is the RDP protocol?' I agree that SSH can be very useful, and very secure. –  Zoredache May 19 '09 at 15:00

You could use VNC instead but if you want to stick with RDP here's a good article on Windows TS security. An added thing you can do is change the port your TS is listening on (and make sure you change your forwarder!).

NOTE: I am not advocating security by obscurity!! No flames there, please.

EDIT: Here's a good article on the basics of securing MS Terminal Svcs.

share|improve this answer

Does your linksys have any VPN capabilities you can play around with?

What you need is an encrypted tunnel through your firewall to connect to your windows host. I use SSH port forwarding to my Linux firewall to tunnel all communication to and from my Remote Desktop client through SSH.

share|improve this answer

I don't particularly care for RDP, but I don't believe it is any more or less secure than the alternatives. I prefer VNC or DameWare. I presume someone more knowledgeable in the specifics will fill us in on the relevant security concerns.

However .. I do know enough that I would not do remote access unsecured, nor would I open the RDP ports on the firewall. I would do one of the following:

1- Use a commercial service like GoToMyPC. It costs money, but it is very secure, easy to use, and performs well.

2- Use Hamachi or another free/equivalent VPN/remote access service.

3- Use a VPN through your existing firewall (or an inexpensive replacement). Many consumer models support basic VPN for this kind of thing.

4- A number of folks have answered with the SSH tunnel, which I have never done but which sounds very cool!

Note: I no longer use any of these, as I store most of my data online (I use DropBox). In addition to remote access my data is backed up automatically!

share|improve this answer

You could use one of the various distributions of VNC and configure them to use secure protocols and/or encryption but I do not believe the standard windows implementation of RDP has those sort of features.

share|improve this answer

Actually, RDP is not secure at all by default - but you can have it use TLS-enhanced SSL without any third party tools to fix that. This guide says it's supported since RDP 5.2 (we're at like 6.1+ now?) and this would be "the Microsoft way" of doing it I guess ^^

(it might not be trivial for a home environment though but see Zoredache's answer and linked guide)

share|improve this answer

I'd suggest tunneling RDP over SSH, for added security benefits. Take a look at the following guide for more details.

share|improve this answer
    
Same thing I suggested. You can run freesshd.com for an ssh server on windows, but I personally prefer the stability of openSSH on linux. –  sparks May 18 '09 at 19:22

I run a linux router, and I don't leave the RDP ports open - I SSH in, uncomment them in my firewall config, do my deeds, then close them back up. Call me old fashioned, but I trust SSH more than RDP.

share|improve this answer
    
Why uncomment instead of SSH tunneling if you trust SSH more? –  sparks May 18 '09 at 19:27
    
I trust the RDP protocol to be safe from eavesdropping - I don't trust my desktop enough to leave it sitting there giving a prompt to anyone who wants to try to login. For example, I log all attempted SSH connections to the linux box, and it emails me; but I don't know how to set that up for my windows box. –  Tom Ritter May 18 '09 at 19:35
    
I like the SSH approach for the same reason. It is simple(for people in IT at least), effective, and expandable. –  sparks May 18 '09 at 20:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.