Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.

I can configure the server to listen on port 6060 or any other port, but what kind of security measure I need to take to secure the connection. I know how to authenticate the client before establishing the connection i.e. using login page and chaptcha to prevent phishing attack and dictionary attack.

Another issues would be if I enable the client to upload a file to server, then how can I detect that the files is safe, is there any program to detect malicious files, or it only depends on the anti virus software.

share|improve this question

2 Answers 2

Lots of questions here.

How you secure a connection depends on how much control you have over both ends (and the connection in between). There's lots of code and tools available to support TLS, so it's relatively easy to implement security using this - but there is a lot more overhead than, say IPSEC - but that's a lot more difficult to configure.

The problem with seperating the encryption layer is that you start losing control over the buffering / naggling - you want to get a near real-time response. Generally this would favour using UDP rather than TCP, however my experience using VNC is that within around 60ms distance it's still usable.

The big problem for this kind of application is getting your operating to talk to a virtual screen. The X Window system was always designed with this in mind - but for other user interfaces it can be a lot more complex.

A big question is whether the world needs another remote display protocol - have you had a look at novnc? This requires no client other than a browser and uses VNC, hence all sorts of server (in the RDP/VNC sense rather than the X Window sense) are supported.

how can I detect that the files is safe

Exactly the same way you check the fle is safe using any other protocol - quarantine files / convert them to a format which doesn't support embedding of malware.

share|improve this answer

I would advice you to run this from a VPN and not from the internet. And yea AV isn't covering all viruses, not much you can do about that.

share|improve this answer
    
If said I implement the web based application, how to use VPN? –  user236501 Dec 22 '12 at 10:48
    
A web application can run on a webserver within the VPN, so that it's not visible to the outside world. –  Lucas Kauffman Dec 22 '12 at 10:49
3  
And at that point you're probably better off using a native Remote Desktop solution like RDP or VNC, over the VPN. –  Polynomial Dec 22 '12 at 12:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.