[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 152
  • Last Modified:

Question on terminal server access security

In order to ad a level of security I have created a custom client version that allows me to deny terminal server access to anyone that does not have this version.  This works great when not using a VPN to connect.

However I have a situation where I am implementing wyse win terminals which do not support custom clients.

So my question is what other techniques are out there for blocking access to terminal servers.   Such as mac address perhaps.

Thanks in advance
0
Zoldy2000
Asked:
Zoldy2000
  • 6
  • 4
  • 2
  • +1
1 Solution
 
mikeleebrlaCommented:
it all depends on your network setup really which you didn't tell us about... for example if you have  a quality firewall you would want to only allow access to your terminal server ports (3389) from particular IP addresses.
0
 
Zoldy2000Author Commented:
That is not possible as the clients IP changes.   I thought changing the port number but that is not quite as secure...
0
 
ChipM0nk JGLeaderCommented:
Don't know if this is what you're fishing for, but...

You can set-up your Terminal Server as an IPSec secured server ('require IPSec' in the IPSec policy).  You will need to enable IPSec clients ('respond' policy) on all your clients and to issue them with certificates from your cert server (normally on one of your A/D servers) that will be used to set up the IPSec tunnel with the TS.  This will provide you with a high level of security through encryption and authentication for your TS users and works below the app level, so you need not worry about the client type.
0
Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

 
Zoldy2000Author Commented:
I am not sure I can do that with the Win Terminals but I will certainly check.   thank you.
0
 
ChipM0nk JGLeaderCommented:
BTW: with IPSec, you will need to allow port 500 and IPSec packets through your firewalls/routers, but can effectively block port 3389 once all your clients are using IPSec.
0
 
Zoldy2000Author Commented:
can you explain to me how this works to prevent only system I allow access to the server.   How is the client configured to be unique?
0
 
mikeleebrlaCommented:
actually changing the default TS port number would make it MORE secure,, not less.  since anytime anyone does  a port scan on you and sees that port 3389 is open,, they automaically know which app to use to hack into that port,, if you changed it they would have no clue that port xxxx is your TS port.
0
 
Zoldy2000Author Commented:
The way it is currently is the most secure with a custom client.   If you don't have it you don't get in.
0
 
ChipM0nk JGLeaderCommented:
With IPSec your clients need to authenticate in order to set up the tunnel.  This guarantees that the client is one that you have authorized to access the machine.  You can use certificates to do this, placing them on USB keys makes this very secure as the user can pocket the key when away from his/her system.  If you don't want to use certs, you can use a shared secret (i.e. password), but this must be the same on both sides and hardcoded.

If you secure the infrastructure, you don't need to worry about the applications...
0
 
Zoldy2000Author Commented:
After considering all of my options I have decided to continue doing what I am doing (adding the client version found on the wyse terminals) and setup connections through a custom port on my firewall for another layer of securiity.

How is that done.   Do I have to setup my terminal server to accept connections on another port or is all of this done on my firewall.  

My firewall is a fortinet product and has all of the necessary features.
0
 
ChipM0nk JGLeaderCommented:
You have 2 options.  Either setup your firewall to mask port 3389 as another port on the outside, i.e. the firewall accepts connections on port 9999 and forwards them to your server on port 3389.  The other option is simpler and just involves changing the port that your TS runs with on your server, to 9999 for example, and then setting up port forwarding on the firewall to forward all packets received on port 9999 to your TS box.
0
 
Zoldy2000Author Commented:
I posted a simlar question to the firewall experts and they agree with my original thoughts.   that changing the port number really does not do anything.   A port scanner will still pick it up.   back to the drawing board.

the reason the custom client is so secure is not only do you have to know what the number is.   You have to know how to change it.   Which is not that simple.
0
 
robrandonCommented:
Not sure if you implemented a solution, but you may be able to setup MAC address filtering on your switch.  I know that most Cisco and Nortel switches support such.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 6
  • 4
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now