• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 261
  • Last Modified:

Remote Desktop Security

I have several servers and want restrict what computers have access to those servers by NOT locking down clients. I run 2000 and 2003 over a cisco backbone. Anything I can do like MAC address filtering over a port for a specific open RD port? Or some sort of MAC access list configured on the server to deny all connections except certain MAC addresses for Remote Desktop only (since we have DHCP and DNS servers).
0
Fubyou
Asked:
Fubyou
1 Solution
 
OliWarnerCommented:
MAC isnt secure... anybody who's anybody can change their MAC address...

Try implementing some kind of IPSEC authentication
0
 
farpostCommented:
do not filter by mac, filter by ip addresses.
Create inbound access list on your server interface, allow inbound connections to port 3389 (remote desktop) only from allowed clients ips.

something like:

access-list 101 permit tcp  host 1.1.1.200 host 1.1.1.1 3389
access-list 101 permit tcp host 1.1.1.201 host 1.1.1.1 3389
access-list 101 deny tcp any any 3389
access-list 101 permit ip any any

Where 1.1.1.1 - server ip, and 1.1.1.200, 1.1.1.201 - client ips
0
 
FubyouAuthor Commented:
IPS are dynamic and in some cases having a static ip is not possible.
Why a IP and not a MAC both can be spoofed.
0
 
farpostCommented:
okay, you can solve this using windows features:

Create domain group and add allowed computer accounts to the group.
Then open 'terminal services configuration' snap-in on the server, go to Propeties of 'RDP-tcp', go to Premissions. Remove Users group and add your new group.
0
 
Rich RumbleSecurity SamuraiCommented:
Rdp just got less secure...
Cain & Abel v2.7.3 released
New features:
- RDPv4 session sniffer for APR
Cain can now perform man-in-the-middle attacks against the heavy encrypted Remote Desktop Protocol (RDP), the one used to connect to the Terminal Server service of a remote Windows computer. The entire session from/to the client/server is decrypted and saved to a text file. Client-side key strokes are also decoded to provide some kind of password interception. The attack can be completely invisible because of the use of APR (Arp Poison Routing) and other protocol weakness.
-rich
0

Featured Post

What Security Threats Are We Predicting for 2018?

Cryptocurrency, IoT botnets, MFA, and more! Hackers are already planning their next big attacks for 2018. Learn what you might face, and how to defend against it with our 2018 security predictions.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now