3

Right now, all developers in our organization have laptops so they can either work from home on occasion, or provide off-hours support. Our laptop hardware spec is, unfortunately, a business laptop spec, and we've had an uphill battle trying to get them to upgrade from 2 to 4 GB.

I'm pursuing an initiative to get better "developer class" machines for our devs, and looking at options for being able to still provide access from home.

One option we've been looking at is providing a supplemental netbook, locked down to allow RDP to their desktops, but would love to be able to allow the devs to simply VPN from their home computers and access their desktop via RDP.

Our organization, however, has very strict limitations on what can access our network, and (currently) requires that only company-owned and controlled devices are allowed to access. The reasoning for this is sound . . . they want to make sure that anything introduced on our network is sufficiently virus protected, and they want to ensure that company-confidential / privacy data isn't put into an uncontrolled environment.

What I was wondering, though, is there any way to provide secure RDP-only access to our devs? We have a SecurID infrastructure already in place. If this is possible, please help me talk intelligently to our infrastructure provider to see if we can make this a reality.

Improve this question

2 Answers 2

Reset to default
3

It depends on your VPN infrastructure. In general, if you can terminate the VPN behind a firewall device that is sufficiently configurable as to limit VPN clinet traffic then you're in business.

As an example, I terminate a Microsoft PPTP VPN at one Customer site behind a Linux-based firewall. There are iptables rules to permit the VPN server to access the RADIUS server on the LAN and rules to allow VPN clients RDP access to various LAN subnets. All the rest of the traffic coming in from the VPN clients to the LAN is dropped.

I've been very pleased with this configuration. I don't worry about malware on the VPN client computers getting to my LAN (at least, not yet... Eventually somebody will write a targeted attack that uses the secondary-channel capability of the RDP protocol to do nasty things to the remote end, or to log keystrokes or screen data within the RDP session, etc.)

Post a little more about what you're using to terminate your VPN, specifically, and we can probably be more helpful. Ultimately, the key is being able to inspect the decapsulated VPN traffic at a "choke point" before it hits your LAN.

Improve this answer
2
  • Ok, so this puts us in the "realm of possibility," which means I can open the dialog. I honestly don't know what the infrastructure is, but I'll ask and post more if they'll let me know.
    – Robaticus
    Commented Jun 29, 2011 at 21:20
  • @Robaticus: Oh, yeah-- definitely within the realm of possibility. I've even done some filtering on edge firewalls when the VPN has been terminated inside an MPLS "cloud" by the WAN provider. As long as the clients funnel thru a choke-point that you can put some filtering rules on you'll be in business.
    – Evan Anderson
    Commented Jun 29, 2011 at 21:25
1

Another option is to provide Devs with a VM for, say, VirtualBox that is configured by your IT team as they'd like it. Allow the VM to access the VPN. You could try limiting the outbound traffic in the VM to only allow RDP over the VPN. (of course this last idea is beyond my ability :-) )

Improve this answer
3
  • This is also a good idea. We tried to do this by virtualizing a live box, but had a bit of trouble getting the VPN to work over the bridged network connection. Honestly, though, we probably gave up more quickly than we should have.
    – Robaticus
    Commented Jun 29, 2011 at 23:41
  • I've done this successfully. We use Cisco VPN and when I wanted to use 64bit windows, we didn't have a 64bit client. I built a WinXp virtual using VBox and ran this way for 6 months.
    – uSlackr
    Commented Jun 30, 2011 at 1:11
  • Though I think this is the way I'm going to suggest to our infrastructure folks, I had to select the other answer as having answered the question. I wish I could select two answers.
    – Robaticus
    Commented Jul 1, 2011 at 22:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .