Steve Riley on Security

Formerly of Microsoft's Trustworthy Computing Group.

Securing Terminal Services over the Internet

Securing Terminal Services over the Internet

  • Comments 3
  • Likes

In my presentation on remote access at TechEd, I gave three scenarios:

  • web-based access to internal resources, published with ISA Server
  • "desktop over the Internet" using Terminal Services and the remote desktop web connection
  • full IP-based virtual private networks with L2TP+IPsec

In the discussion on TS over the Internet, I failed to mention a very important bit. There is no mechanism built into RDP to authenticate the server to the client. This creates an opportunity to conduct a man-in-the-middle attack. Tools now exist to do exactly this.

In Windows Server 2003, you can configure TS to use TLS for server authentication and data encryption. This is extremely important for anyone running TS over the Internet. See KB 895433 for the step-by-step details.

Comments
  • Steve Riley has posted a link to some information about RDP security over the Internet. Check it out...

  • Just back from a hectic Tech Ed Europe in Amsterdam last week and thought I would drop in a note about...

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment