1

I once had Windows server 2008 and the VPS provider had VNC access that I could log in to VPS as locally.

Now I upgrade 2008 to Windows server 2016 Hyper-V. Then I found they don't provide VNC access. The only way to access Windows Server 2016 is remote desktop.

In the past I secure RDP by firewall policy and IP Security rules. These measurements are so useful that it might also lock me out. However as I'm unable to log in as locally, I have to issue a support ticket and let them disable firewall, and turnaround time is long. It's very inconvenient when I'm setting up these rules.

Do you have any suggestions on protecting brute force RDP attack to my VPS?

If I somehow blocked attacker's subnet, if he so happens to be in the same subnet with me, I'm also locked out.

How can I stop attackers while the VPS still allows me to log in?

  • Put it behind a VPN. Or better yet, change to a provider that lets you set your own firewall rules. – EEAA May 2 '17 at 4:28
0

The same way you protect pretty much anything:

  • Use strong passwords
  • Keep your server up to date. Religiously. Never skip a patch day.
  • Sane firewall rules. Don't open things to the internet if you don't need to.
  • Put it behind a VPN if you can (I'm unclear on this for your setup)

Driveby scans and automatic break in attempts are just part of having a service on the internet unfortunately.

Seeing as you are specifically looking at RDP, another option would be to use the RDP gateway role. Essentially this tunnels RDP over TLS/SSL on port 443, and allows you to access an entire farm of servers through a single IP/Port, and you can set access controls and all sorts of things via the gateway.

In years past I would have downplayed the risk of having RDP open to the internet, but I've seen multiple Windows Server 2012 R2 internet-accessible RDP servers crypto-lockered in the past 12 months. I wasn't involved in the investigation so I don't know how they got infected, but an RDP remote-execution vulnerability was a potential culprit.

| improve this answer | |
  • Here is the dilemma. If I touch firewall, it might lock me out and I lose the access forever. Can you come up with a way to recover except asking support and waiting for 3 days.. – Gqqnbig May 4 '17 at 1:38
  • @LoveRight A VPN. A better VPS provider. – Mark Henderson May 4 '17 at 10:03
  • Can you elaborate the VPN option? – Gqqnbig May 4 '17 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.