5

I currently run Remote Desktop on my home computer (Vista Ultimate). It is always on so I can access things from my home computer when I am not there. I have a linksys firewall and use port forwarding to allow access to the correct ports.

How secure is the RDP protocol? It seems to be as secure as the username/password combination you use but I am not sure. Is there a more secure alternative that still has the same functionality?

UPDATE: Lots of great answers. I am going to try SSH tunneling first. I will post with an update when complete.

Improve this question
2
  • Do you mean "... access things from my work computer" in sentence #2?
    – tomjedrz
    May 18, 2009 at 18:18
  • Thanks for the post- this has been a concern of mine for some time and I have tried several <a href="proxynetworks.com/products/index.html">Remote Desktop</a> systems in efforts to avoid any security loopholes that might be able to be exploited by experienced programers/hackers...
    – user74605
    Mar 15, 2011 at 21:51

9 Answers 9

Reset to default
2

I run a linux virtual machine for playing around with ruby as well as running an SSH server.

Then I use putty and I tunnel my RDP session through the SSH tunnel to ensure its security.

Information on doing this available here:http://www.engr.wisc.edu/computing/best/rdesktop-putty.html

A bonus: you can just add a tunnel to putty and access another PC at home if you have one, or you can make web requests, etc straight to services at home without exposing them to the internet.

Improve this answer
2
  • Just be careful with what you "expose" to the world. As any exposure could be a security problem. Make sure that your Linux VM is locked down and updated and that your router limits the ports that are exposed/forwarded.
    – GreenKiwi
    May 18, 2009 at 23:37
  • You're just exposing SSH, nothing else unless there is a reason for it.
    – sclarson
    May 19, 2009 at 13:30
12

Remote desktop in Vista can be pretty secure. It can use SSL for transport encryption and does network level authentication to verify that the host is the one you where expecting. Getting your traffic is snooped on is unlikely. But that doesn't prevent someone from trying to login. I believe you can setup your system to do account lockout, so if an attacker does start to try lots of passwords they will lock the account.

Here is a good article on getting it secure.

Improve this answer
3
  • +1 for suggesting already built-in security measures. Too often, users of an operating system and its related services and applications go outside of the default distribution for functionality already included in the core - due to simply not knowing it exists...
    – Oskar Duveborn
    May 18, 2009 at 20:12
  • Three reasons I prefer SSH tunnels with putty over Secured RDP. 1. Account lockouts annoy me 2. With SSH I can get access to anything internal by only exposing 1 port without having to deal with any RDP annoyances. 3. Auto-sign on using certificates with putty(can probably be done with terminal services as well but I've never tried).
    – sclarson
    May 19, 2009 at 13:35
  • @sparks. All good points, but not really related to the question I was trying to answer which is 'How secure is the RDP protocol?' I agree that SSH can be very useful, and very secure.
    – Zoredache
    May 19, 2009 at 15:00
2

You could use VNC instead but if you want to stick with RDP here's a good article on Windows TS security. An added thing you can do is change the port your TS is listening on (and make sure you change your forwarder!).

NOTE: I am not advocating security by obscurity!! No flames there, please.

EDIT: Here's a good article on the basics of securing MS Terminal Svcs.

Improve this answer
2

Does your linksys have any VPN capabilities you can play around with?

What you need is an encrypted tunnel through your firewall to connect to your windows host. I use SSH port forwarding to my Linux firewall to tunnel all communication to and from my Remote Desktop client through SSH.

Improve this answer
2

I don't particularly care for RDP, but I don't believe it is any more or less secure than the alternatives. I prefer VNC or DameWare. I presume someone more knowledgeable in the specifics will fill us in on the relevant security concerns.

However .. I do know enough that I would not do remote access unsecured, nor would I open the RDP ports on the firewall. I would do one of the following:

1- Use a commercial service like GoToMyPC. It costs money, but it is very secure, easy to use, and performs well.

2- Use Hamachi or another free/equivalent VPN/remote access service.

3- Use a VPN through your existing firewall (or an inexpensive replacement). Many consumer models support basic VPN for this kind of thing.

4- A number of folks have answered with the SSH tunnel, which I have never done but which sounds very cool!

Note: I no longer use any of these, as I store most of my data online (I use DropBox). In addition to remote access my data is backed up automatically!

Improve this answer
1

You could use one of the various distributions of VNC and configure them to use secure protocols and/or encryption but I do not believe the standard windows implementation of RDP has those sort of features.

Improve this answer
1

Actually, RDP is not secure at all by default - but you can have it use TLS-enhanced SSL without any third party tools to fix that. This guide says it's supported since RDP 5.2 (we're at like 6.1+ now?) and this would be "the Microsoft way" of doing it I guess ^^

(it might not be trivial for a home environment though but see Zoredache's answer and linked guide)

Improve this answer
0

I'd suggest tunneling RDP over SSH, for added security benefits. Take a look at the following guide for more details.

Improve this answer
1
  • Same thing I suggested. You can run freesshd.com for an ssh server on windows, but I personally prefer the stability of openSSH on linux.
    – sclarson
    May 18, 2009 at 19:22
0

I run a linux router, and I don't leave the RDP ports open - I SSH in, uncomment them in my firewall config, do my deeds, then close them back up. Call me old fashioned, but I trust SSH more than RDP.

Improve this answer
3
  • Why uncomment instead of SSH tunneling if you trust SSH more?
    – sclarson
    May 18, 2009 at 19:27
  • I trust the RDP protocol to be safe from eavesdropping - I don't trust my desktop enough to leave it sitting there giving a prompt to anyone who wants to try to login. For example, I log all attempted SSH connections to the linux box, and it emails me; but I don't know how to set that up for my windows box.
    – Tom Ritter
    May 18, 2009 at 19:35
  • I like the SSH approach for the same reason. It is simple(for people in IT at least), effective, and expandable.
    – sclarson
    May 18, 2009 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .