Solved

RDP over DNS name or IP

Posted on 2010-09-17
13
579 Views
Last Modified: 2012-05-10
Hi,

I have heard that a RDP Session over DNS name is less safe than over TCP?

Is that right?

regards
insi01
0
Comment
Question by:insi01
13 Comments
 
LVL 3

Expert Comment

by:arweeks
ID: 33706095
I can't possibly imagine why.  I assume you mean using the name of the server, rather than the IP address.
The client will resolve the name to an ip address and connect using the IP anyway.  The client can't connect to a hostname over TCP/IP - only an IP address.  The only difference is whether you ask the client to resolve the name, rather than typing in the IP yourself.
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 33706180
Agreed - where did you hear this?
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 33706206
No, this is not correct. RDP sessions over DNS is not less secure. The reason for dns is to resolve host names to ip addresses in the form of A records. To make browsing the internet user friendly instead of having to type in number in the form of ip addresses. If you have a properly configured router/firewall and are using strong passwords then you should have nothing to be concerned about. I do see the point your coming from, if you have dns records pointed at your public ip of your server then this can give some information over the internet. Where as if you just have a public ip of your network but no associated records then it's less invasive. But like I said, there is nothing wrong with RDP sessions via dns or ip address. Remember that a lot of engineers have to have host records in place for backup purposes, emails etc. Just make sure that the security of your network is intact. Strong passwords, properly configured router/firewall. You can use an external port scanner to scan your public ip to see what ports are open and you can do the same internally on you LAN.

Hope this helps.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33708623
Doesn't really matter since if you use actual name it will resolve to an IP address.
0
 

Author Comment

by:insi01
ID: 33712499
Hi All,

I try to clarify that in that way that I will contact the MCT who told that.

insi01
0
 

Author Comment

by:insi01
ID: 33729259
Hi All,

Sorry, I was wrong. He meant I should never use IP mapping network drives. I should use
Hostname or FQDN.

insi01
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33729332
You can use IP Mapping network drives actually IP network drives is a better solution then Hostname sometimes. If you have resolution issues then your network drives would not work this is why using IP address will allow you not rely on network name resolutions it instead it directly connects by IP address
0
 

Author Comment

by:insi01
ID: 33729603
dariusq,
yes but it is less safer than using Hostname because Kerberos is not used.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33734036
No, it all resolves to an IP address.
0
 

Author Comment

by:insi01
ID: 33762046
dariusq,

This is what the MCT said to me (translated with Office Translator):

...I said, when a network logon, such as network drive mapping, you better don't map it trough IP address, because Kerberos is levered this. Kerberos doesn't work with IP, only with host name or FQDN. If you use \\<server-ip>\Share e.g. using the UNC path, the server must use the NTLM authentication to forward your credentials to a DC (pass-thru). In this case a Kerberos ticket for the service (release) is not requested.  NTLM passthrough is not nearly as secure as Kerberos because you can capture the password hash and crack it easier. Would you mind used \\<serverNAME>\Share, a highly secure Kerberos get service ticket for a period of 10 hours (domain policy). During this time, the server must contact any DC. After 10 hours, the ticket is automatically renewed.</servername></server-ip>.

I hope it was translated understandable.

Regards
insi01
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33769712
Here is the thing when use \\servername this must be translated to an IP address. The client doesn't know where the server is unless it can find the IP of the server
0
 

Accepted Solution

by:
insi01 earned 0 total points
ID: 33798746
Work or use always with FQDN or host name, because the Kerberos SSP (security service provider) accepts only FQDN or hopstname. IP resolution happens in another layer and NOT through Kerberos.

insi01
0
 

Author Comment

by:insi01
ID: 33917786
The answer was given by an external Instructor
0

Featured Post

Do email signature updates give you a headache?

Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

Join & Write a Comment

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
A safe way to clean winsxs folder from your windows server 2008 R2 editions
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now