1

I'm in the following situation, i will have a fresh server connected to the internet (if required with a firewall between the net and it simply droping all packets on ports other than the one my application is listening on).

It doesn't require any services / features, there is no third party installation except for my program running on it (console application responding to http requests directly).

Is there anything specifically i should do to reduce the exposed area? This is for a standalone server, no internal network, no domain , no nothing, just needing to be able to launch a console app and remote desktop into it (just me, for administration purposes).

Aside from blocking all ports except those used by my app and RDP at the firewall level is there anything i should change / disable that i may not have thought of or is a fresh install already pretty minimally exposed?

This server's security is critical so feel free to add "paranoid level" suggestions as long as they don't disallow an application to listen & respond to http traffic on a given port

  • 2
    One suggestion might be to run the Security Configuration Wizard on the server after you have your app installed and running. You may have to tweak the SCW security policy in order for your app to accept network connections properly. – joeqwerty Jun 14 '15 at 20:41
  • 2
    Don't leave RDP open, much safer to configure an ipsec vpn – Drifter104 Jun 14 '15 at 20:59
  • Only open your App port BUT only allow your own IP for RDP. Close everything else. – krisFR Jun 14 '15 at 21:28
  • @krisFR I'm on a dynamic IP :( i need to get that fixed but in the meantime i don't really have a workaround – Ronan Thibaudau Jun 14 '15 at 21:29
  • @krisFR Using a VPN sounds even more dangerous, it means trusting whoever hosts the vpn to see everything that comes through, has RPD ever proven to be unsecure? – Ronan Thibaudau Jun 14 '15 at 21:31
1

You can attempt to convert the server to run Server Core, stripping away most of the GUI. It will lower the attack surface, and as an extra bonus you'll need less patching to stay secure. Not all applications supports this however.

Windows Firewall has gotten really good with the years, and you can create extremely tight rules with the advanced firewall settings. I do not believe that leaving RDP open to the wild is any less secure than leaving VPN open to the wild. They are both encrypted connections, and they can both be easily bypassed by brute force attacks.

One way of evading most of RDP bruteforce attacks is to change the RDP listening port in the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber

Make sure that you add firewall rules to allow the RDP traffic on the custom port before you apply the changes!

I also suggest that you create a new admin account (if you haven't already) with a somewhat random username, use a very strong password and disable the built-in "Administrator" account.

  • I'm not overly worried about brute force attacks (i can use 100+ length passwords) , server core is an option and my app (single console window) should support it but i'm not sure i'd be able to setup my server quite as securely as i've never used it, i'll keep it in mind however – Ronan Thibaudau Jun 14 '15 at 22:36
  • +1 for the RDP listening port change. – Christopher Bruce Jun 15 '15 at 13:23
  • I, for one don't think changing RDP worth much. A scan with Nmap should find this port no matter where you put it. Though it take more time which is a plus... – EliadTech Jun 18 '15 at 7:17
  • @EliadTech random brute-force attacks do not first scan all 65 thousand ports to see if RDP is listening on them. Changing the default port does a lot for minimizing the attack surface. – pauska Jun 18 '15 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.