full-disclosure - Re: RDP, can it be done safely?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <optid.57771de757.58DB1B68E62B9F448DF1A276B0886DF11C6D274C@EX2010.hammerofgod.com>
Date: Thu, 10 Jun 2010 14:10:58 +0000
From: "Thor (Hammer of God)" <Thor@...merofgod.com>
To: Marsh Ray <marsh@...endedsubset.com>, "full-disclosure@...ts.grok.org.uk"
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: RDP, can it be done safely?

To be specific, it actually doesn't require a "client" cert in the strictest sense.  You can configure certificate parameters on the server in such a way that certificate trust chains must be honored (close enough) but if you want true client authentication based on a certificate, you would have to publish the RDP over RPC/HTTP(s) via something like ISA where you can specifically configure a listener to require client authentication certificates to be "presented" to the publisher, but that's not really the same thing.

t

>-----Original Message-----
>From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-
>bounces@...ts.grok.org.uk] On Behalf Of Marsh Ray
>Sent: Thursday, June 10, 2010 3:44 AM
>To: full-disclosure@...ts.grok.org.uk
>Subject: Re: [Full-disclosure] RDP, can it be done safely?
>
>On 6/10/2010 4:44 AM, Larry Seltzer wrote:
>> All right, I guess you've got a point. I reflexively say VPN at times
>> like this because the very few reported RDP attacks I've seen have
>> been MITM attacks of the sort that VPNs effectively block. But a
>> client certificate/TLS implementation accomplishes the same thing and
>> all you have to open is the RDP port.
>
>MS Terminal Services Gateway can be set up to require client cert
>authentication and comes in over SSL/TLS over port 443 (RPC over HTTPS I
>think).
>
>Allowing raw RDP to come in through the firewall is not something I would feel
>real good about.
>
>- Marsh
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/