Remote Desktop Security

I have several servers and want restrict what computers have access to those servers by NOT locking down clients. I run 2000 and 2003 over a cisco backbone. Anything I can do like MAC address filtering over a port for a specific open RD port? Or some sort of MAC access list configured on the server to deny all connections except certain MAC addresses for Remote Desktop only (since we have DHCP and DNS servers).
FubyouAsked:
Who is Participating?
 
farpostConnect With a Mentor Commented:
okay, you can solve this using windows features:

Create domain group and add allowed computer accounts to the group.
Then open 'terminal services configuration' snap-in on the server, go to Propeties of 'RDP-tcp', go to Premissions. Remove Users group and add your new group.
0
 
OliWarnerCommented:
MAC isnt secure... anybody who's anybody can change their MAC address...

Try implementing some kind of IPSEC authentication
0
 
farpostCommented:
do not filter by mac, filter by ip addresses.
Create inbound access list on your server interface, allow inbound connections to port 3389 (remote desktop) only from allowed clients ips.

something like:

access-list 101 permit tcp  host 1.1.1.200 host 1.1.1.1 3389
access-list 101 permit tcp host 1.1.1.201 host 1.1.1.1 3389
access-list 101 deny tcp any any 3389
access-list 101 permit ip any any

Where 1.1.1.1 - server ip, and 1.1.1.200, 1.1.1.201 - client ips
0
 
FubyouAuthor Commented:
IPS are dynamic and in some cases having a static ip is not possible.
Why a IP and not a MAC both can be spoofed.
0
 
Rich RumbleSecurity SamuraiCommented:
Rdp just got less secure...
Cain & Abel v2.7.3 released
New features:
- RDPv4 session sniffer for APR
Cain can now perform man-in-the-middle attacks against the heavy encrypted Remote Desktop Protocol (RDP), the one used to connect to the Terminal Server service of a remote Windows computer. The entire session from/to the client/server is decrypted and saved to a text file. Client-side key strokes are also decoded to provide some kind of password interception. The attack can be completely invisible because of the use of APR (Arp Poison Routing) and other protocol weakness.
-rich
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.