2

I have been assessing this software for securing our cloud server's RDP connection.

The problem is, it requires you to use RDP encryption, without TLS. This is because with TLS the IP addresses are not logged.

When RDP encryption is chosen, the login screen shows the accounts with which you could log in immediately upon connection. When TLS is chosen, you have to enter an account name and password into the dialog box before you connect.

This makes it appear to me that setting encryption to RDP gives away your usernames, whereas TLS doesn't (or am I missing something)?

Is this lack of SSL and showing the login screen worth it to log the IP addresses and block them?

Improve this question

1 Answer 1

Reset to default
2

No... native RDP encryption isn't really that bad per se, but it's nowhere near as good as TLS.

The last couple of serious security flaws that were found with Remote Desktop only affected those old versions that let you see GINA before ever providing credentials. Those exploits did not affect RDP servers that were properly secured with TLS.

Using RDP without TLS/SSL in 2013 is, in my opinion, unacceptable. Especially in an internet scenario.

Not only that but RDP without TLS is becoming less and less acceptable to security auditors too.

Improve this answer
3
  • So how do you stop continued login failures per ip?
    – Jordan Morris
    Jul 23, 2013 at 12:53
  • Also, does TLS confer any actual advantage if several people are logging in and never checking the public key of the server when they connect?
    – Jordan Morris
    Jul 23, 2013 at 12:55
  • Personally, I wouldn't concern myself with trying to blacklist IPs. If you put something out there on the internet, you accept that strangers with portscanners are going to hit it. If you don't like that, put a firewall in front of it. Secondly, yes of course TLS confers advantages. Like I said, the big exploits that have been found in RDP lately didn't affect TLS-protected servers. Secondly, TLS is just a lot harder to break than RC4 56-bit.
    – Ryan Ries
    Jul 23, 2013 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.