1

I'm in the following situation, i will have a fresh server connected to the internet (if required with a firewall between the net and it simply droping all packets on ports other than the one my application is listening on).

It doesn't require any services / features, there is no third party installation except for my program running on it (console application responding to http requests directly).

Is there anything specifically i should do to reduce the exposed area? This is for a standalone server, no internal network, no domain , no nothing, just needing to be able to launch a console app and remote desktop into it (just me, for administration purposes).

Aside from blocking all ports except those used by my app and RDP at the firewall level is there anything i should change / disable that i may not have thought of or is a fresh install already pretty minimally exposed?

This server's security is critical so feel free to add "paranoid level" suggestions as long as they don't disallow an application to listen & respond to http traffic on a given port

14
  • 2
    One suggestion might be to run the Security Configuration Wizard on the server after you have your app installed and running. You may have to tweak the SCW security policy in order for your app to accept network connections properly.
    – joeqwerty
    Jun 14, 2015 at 20:41
  • 2
    Don't leave RDP open, much safer to configure an ipsec vpn
    – Drifter104
    Jun 14, 2015 at 20:59
  • Only open your App port BUT only allow your own IP for RDP. Close everything else.
    – krisFR
    Jun 14, 2015 at 21:28
  • @krisFR I'm on a dynamic IP :( i need to get that fixed but in the meantime i don't really have a workaround Jun 14, 2015 at 21:29
  • @krisFR Using a VPN sounds even more dangerous, it means trusting whoever hosts the vpn to see everything that comes through, has RPD ever proven to be unsecure? Jun 14, 2015 at 21:31

1 Answer 1

1

You can attempt to convert the server to run Server Core, stripping away most of the GUI. It will lower the attack surface, and as an extra bonus you'll need less patching to stay secure. Not all applications supports this however.

Windows Firewall has gotten really good with the years, and you can create extremely tight rules with the advanced firewall settings. I do not believe that leaving RDP open to the wild is any less secure than leaving VPN open to the wild. They are both encrypted connections, and they can both be easily bypassed by brute force attacks.

One way of evading most of RDP bruteforce attacks is to change the RDP listening port in the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber

Make sure that you add firewall rules to allow the RDP traffic on the custom port before you apply the changes!

I also suggest that you create a new admin account (if you haven't already) with a somewhat random username, use a very strong password and disable the built-in "Administrator" account.

4
  • I'm not overly worried about brute force attacks (i can use 100+ length passwords) , server core is an option and my app (single console window) should support it but i'm not sure i'd be able to setup my server quite as securely as i've never used it, i'll keep it in mind however Jun 14, 2015 at 22:36
  • +1 for the RDP listening port change. Jun 15, 2015 at 13:23
  • I, for one don't think changing RDP worth much. A scan with Nmap should find this port no matter where you put it. Though it take more time which is a plus...
    – EliadTech
    Jun 18, 2015 at 7:17
  • @EliadTech random brute-force attacks do not first scan all 65 thousand ports to see if RDP is listening on them. Changing the default port does a lot for minimizing the attack surface.
    – pauska
    Jun 18, 2015 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .