• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 607
  • Last Modified:

RDP over DNS name or IP

Hi,

I have heard that a RDP Session over DNS name is less safe than over TCP?

Is that right?

regards
insi01
0
insi01
Asked:
insi01
1 Solution
 
arweeksCommented:
I can't possibly imagine why.  I assume you mean using the name of the server, rather than the IP address.
The client will resolve the name to an ip address and connect using the IP anyway.  The client can't connect to a hostname over TCP/IP - only an IP address.  The only difference is whether you ask the client to resolve the name, rather than typing in the IP yourself.
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
Agreed - where did you hear this?
0
 
JBond2010Commented:
No, this is not correct. RDP sessions over DNS is not less secure. The reason for dns is to resolve host names to ip addresses in the form of A records. To make browsing the internet user friendly instead of having to type in number in the form of ip addresses. If you have a properly configured router/firewall and are using strong passwords then you should have nothing to be concerned about. I do see the point your coming from, if you have dns records pointed at your public ip of your server then this can give some information over the internet. Where as if you just have a public ip of your network but no associated records then it's less invasive. But like I said, there is nothing wrong with RDP sessions via dns or ip address. Remember that a lot of engineers have to have host records in place for backup purposes, emails etc. Just make sure that the security of your network is intact. Strong passwords, properly configured router/firewall. You can use an external port scanner to scan your public ip to see what ports are open and you can do the same internally on you LAN.

Hope this helps.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Darius GhassemCommented:
Doesn't really matter since if you use actual name it will resolve to an IP address.
0
 
insi01Author Commented:
Hi All,

I try to clarify that in that way that I will contact the MCT who told that.

insi01
0
 
insi01Author Commented:
Hi All,

Sorry, I was wrong. He meant I should never use IP mapping network drives. I should use
Hostname or FQDN.

insi01
0
 
Darius GhassemCommented:
You can use IP Mapping network drives actually IP network drives is a better solution then Hostname sometimes. If you have resolution issues then your network drives would not work this is why using IP address will allow you not rely on network name resolutions it instead it directly connects by IP address
0
 
insi01Author Commented:
dariusq,
yes but it is less safer than using Hostname because Kerberos is not used.
0
 
Darius GhassemCommented:
No, it all resolves to an IP address.
0
 
insi01Author Commented:
dariusq,

This is what the MCT said to me (translated with Office Translator):

...I said, when a network logon, such as network drive mapping, you better don't map it trough IP address, because Kerberos is levered this. Kerberos doesn't work with IP, only with host name or FQDN. If you use \\<server-ip>\Share e.g. using the UNC path, the server must use the NTLM authentication to forward your credentials to a DC (pass-thru). In this case a Kerberos ticket for the service (release) is not requested.  NTLM passthrough is not nearly as secure as Kerberos because you can capture the password hash and crack it easier. Would you mind used \\<serverNAME>\Share, a highly secure Kerberos get service ticket for a period of 10 hours (domain policy). During this time, the server must contact any DC. After 10 hours, the ticket is automatically renewed.</servername></server-ip>.

I hope it was translated understandable.

Regards
insi01
0
 
Darius GhassemCommented:
Here is the thing when use \\servername this must be translated to an IP address. The client doesn't know where the server is unless it can find the IP of the server
0
 
insi01Author Commented:
Work or use always with FQDN or host name, because the Kerberos SSP (security service provider) accepts only FQDN or hopstname. IP resolution happens in another layer and NOT through Kerberos.

insi01
0
 
insi01Author Commented:
The answer was given by an external Instructor
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now