The Myth of RDP Insecurity
-
@scottalanmiller said in The Myth of RDP Insecurity:
I know the
site there is this persistent myth that RDP is insecure and that the solution to its insecurity is to wrap it in a VPN. This seems very silly as RDP is natively VPN'd already. If a VPN provided security, surely the very well researched and secured VPN that is integrated with RDP would be the best choice. That VPN is already completely "shrunk" to expose nothing but RDP, which of course you can do manually with some other VPN solution, but requires much more work and is a "one off" rather than a well known, battle tested configuration.Azure itself exposes RDP directly because it is considered extremely secure. It's roughly identical to SSH in security. Of course, exposing "nothing" is better than exposing "something", but the option there is to close down the services completely, not to wrap either in "yet another VPN." Things like port locking, port knocking, only opening when needed, and so forth add some serious security on top of the existing security mechanisms, but a VPN wrapper is just redundant.
Where does this idea come from? This feels, to me, to be one of those "Windows Admins who distrust Windows" myths where there is an irrational distrust of Microsoft and the product is just believed to be insecure. We hear stories, on the spicy site of course, of people constantly getting hacked through RDP... of course they are, if you expose it with common usernames and weak passwords, any VPN will get hacked. But, as people usually do, they accept no blame and no one is willing to point out the obvious faults in the setup as professional review is discouraged there, and people point fingers at an innocent vendor who could only defend themselves by throwing customers under the proverbial bus.
But honestly, has anyone ever heard of an actual hack of RDP? One where the end users didn't leave it wide open in a way that would have compromised any service? VPNs are only as secure as the passwords that you put in front of them.
RDP is very secure and there is no need for additional security around it. Just standard good security practice and it is as secure as anything is reasonably going to get. If you need something more secure, you can't be exposing anything like this to the outside world.
What would you describe as an actual hack of RDP? What does that mean, end users leaving it wide open?
-
I have always open RDP to WAN externally through firewalls but only reducing to location that need access (whitelisting) instead of using VPN, VPN for anyone else has been recommended by me since I have no idea what type of security they will have.
-
RDPGuard is the only solution that allows some kind of rate limiting functionality on RDP that I'm aware of. Any other solutions?
-
@nashbrydges said in The Myth of RDP Insecurity:
RDPGuard is the only solution that allows some kind of rate limiting functionality on RDP that I'm aware of. Any other solutions?
It is same as what SSHguard, a lot of protocols get brute force attacks.
-
How practical is this?
Setting up a vpn and turning on rdp for user desktops = easy.
Setting up policies in firewall for each Remote Desktop user = PITA. -
@nashbrydges said in The Myth of RDP Insecurity:
@scottalanmiller said in The Myth of RDP Insecurity:
port locking
That's not always a viable solution though so, what else would you suggest can be done to reduce alerts in those cases?
What makes it not always viable?
I know Sodium is working on a solution specifically to make that "always viable"
-
@momurda said in The Myth of RDP Insecurity:
@scottalanmiller What about directly exposing RDP for a user's desktop computer?
Say for instance CEO or COO dont like using vpn, open rdp to their desktop on firewall?Absolutely. The VPN makes no difference. RDP already has a VPN, so if a VPN was good enough, RDP is good enough.
-
@scottalanmiller What about things like Chrome Remote Desktop which does this in a web browser?
-
@dbeato said in The Myth of RDP Insecurity:
What would you describe as an actual hack of RDP? What does that mean, end users leaving it wide open?
An actual RDP hack would be one where RDP was hacked (broken in through a vulnerability or breaching the encryption), not one where the users used "password" as their password, didn't have account lockouts, or published the login info, for example.
-
@nashbrydges said in The Myth of RDP Insecurity:
RDPGuard is the only solution that allows some kind of rate limiting functionality on RDP that I'm aware of. Any other solutions?
Your firewall can potentially do that, too.
-
@dbeato said in The Myth of RDP Insecurity:
@nashbrydges said in The Myth of RDP Insecurity:
RDPGuard is the only solution that allows some kind of rate limiting functionality on RDP that I'm aware of. Any other solutions?
It is same as what SSHguard, a lot of protocols get brute force attacks.
And fail2ban.
-
@momurda said in The Myth of RDP Insecurity:
How practical is this?
Setting up a vpn and turning on rdp for user desktops = easy.SO practical.
Just... don't set up the VPN. It's that easy. What is the VPN doing? You already have a VPN, the extra VPN just confuses users.
-
@momurda said in The Myth of RDP Insecurity:
@scottalanmiller What about things like Chrome Remote Desktop which does this in a web browser?
Totally different technology, but pretty secure from what I know. That it uses a web browser really isn't much of a factor as it is just using the browser for display purposes. You can do that with RDP, too.
-
You have to make a separate firewall policy for each computer using RDP.
I have 40 users. Some of them refuse to use vpn so i have setup RDP this way for awhile.
It certainly isnt practical. -
@momurda said in The Myth of RDP Insecurity:
You have to make a separate firewall policy for each computer using RDP.
I have 40 users.
It certainly isnt practical.Changing port translation makes it easy through the firewall.
-
@momurda said in The Myth of RDP Insecurity:
You have to make a separate firewall policy for each computer using RDP.
I have 40 users. Some of them refuse to use vpn so i have setup RDP this way for awhile.
It certainly isnt practical.Oh, you are using a VPN to make port mapping more easy, not for security?
You don't use RDP config files for the end users? Even for hundreds of users, it's pretty trivial to have them click on the icon to log in.
-
@momurda said in The Myth of RDP Insecurity:
You have to make a separate firewall policy for each computer using RDP.
In the case where you are mapping many ports to many internal end points, that would be correct. But those are trivial firewall entries that you only need once. Few minutes of setup there is no big deal.
Consider the alternative is to have to deploy a VPN infrastructure and maintain it and deploy and configure for every end point, that's way more work per machine than firewall rules are.
-
@scottalanmiller said in The Myth of RDP Insecurity:
@momurda said in The Myth of RDP Insecurity:
You have to make a separate firewall policy for each computer using RDP.
I have 40 users. Some of them refuse to use vpn so i have setup RDP this way for awhile.
It certainly isnt practical.Oh, you are using a VPN to make port mapping more easy, not for security?
You don't use RDP config files for the end users? Even for hundreds of users, it's pretty trivial to have them click on the icon to log in.
You can also use an RDP Gateway for this.
-
@dbeato said in The Myth of RDP Insecurity:
@scottalanmiller said in The Myth of RDP Insecurity:
@momurda said in The Myth of RDP Insecurity:
You have to make a separate firewall policy for each computer using RDP.
I have 40 users. Some of them refuse to use vpn so i have setup RDP this way for awhile.
It certainly isnt practical.Oh, you are using a VPN to make port mapping more easy, not for security?
You don't use RDP config files for the end users? Even for hundreds of users, it's pretty trivial to have them click on the icon to log in.
You can also use an RDP Gateway for this.
Yes, at scale that can work well.
-
@nashbrydges said in The Myth of RDP Insecurity:
RDPGuard is the only solution that allows some kind of rate limiting functionality on RDP that I'm aware of. Any other solutions?
There are two alternatives that I use. Both are free and easy to setup.
Cyberarms - Used to be a pay product but now open source https://archive.codeplex.com/?p=idds
You can download the msi from https://cyberarms.net/LF Intrusion Detection - https://litfuse.io/lf-intrusion-detection
