0

In the process of setting up an HTTPS website and in the best practices of it, firstly I disabled ssl v3 (no problem with that) and then I disabled older insecure ciphers and only enabled:

TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384

However, after doing this, I cannot log in anymore via remote desktop. Probably some cipher incompatibility ? The RD client is on Windows XP, the server is windows 2012 R2. How can I solve this ? I don't want to re-enable older insecure ciphers for IIS.

Thank you in advance

closed as off-topic by Greg Askew, Ward, ThoriumBR, yagmoth555, Jenny D Sep 18 '17 at 18:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Greg Askew, Ward, ThoriumBR, yagmoth555, Jenny D
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You don't want to use insecure ciphers but you are using an insecure OS? Windows XP is dead and I guess that's also the cause of your problem. – duenni Sep 11 '17 at 11:12
  • duenni windows xp is the OS where the RD client is. That is not my problem – MirrorMirror Sep 11 '17 at 11:20
1

Older versions of RDP do not support anything above TLS 1.0. There is a patch for Windows 7 and Windows Server 2008 R2 here. Windows 2012 supports this OOTB. TLS 1.1 & TLS 1.2 are enabled by default on post Windows 8.1 releases. Windows XP is EOL, there is no patch. So if you disable TLS 1.0 on the server side you can not connect with a Windows XP client.

  • I am not sure I have disabled TLS 1.0. Through registry I only disabled SSL v3. Unless I disabled TLS by removing insecure ciphers ? – MirrorMirror Sep 11 '17 at 12:02
  • I am not an expert when it comes to SSL but there are ciphers which are shared between these protocols (meaning ciphers categorized as SSL-ciphers are used in TLS, too). I could not figure out which ciphers are needed for RDP but I guess it's one (or more) of the ciphers you disabled... – duenni Sep 11 '17 at 12:25
1

In addition to keeping TLS 1.0 enabled, you also need to enable 3DES if you absolutely must RDP to the server from an XP client.

This is the wrong answer though, the right answer is to use an up to date, secure and supported client OS; currently Windows 7 or newer.

No one should be using Windows XP today except in highly exceptional circumstances, in which case the machine should be air-gapped. You certainly should NOT be using it to administer a web server!!

Not the answer you're looking for? Browse other questions tagged or ask your own question.