Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct network connectivity between the two environments. I know it's possible to transfer files in either direction via RDP, but I'm assuming it also possible to disable this via policy on one side or the other?

Any other risks with this approach, or similar (E.g. VNC type interfaces)? I assume they all have their vulnerabilities but am trying to avoid an environment with 2 machines on every desktop.

share|improve this question
add comment

1 Answer 1

RDP stands for "Remote Desktop Protocol", so what it provides to people who connect is a full fledged session on the server. By default, this gives these people the same kind of power that they could have by sitting in front of the machine (except that they won't be able to attack the machine "physically").

If you want to prevent users from, e.g., uploading arbitrary executable files to the RDP server and running them from the server, then you have to restrict the Windows session down by deactivating right-click on most items, removing most or all of the "Start menu" entries, preventing copy&paste of files through RDP, and generally speaking nerf it down. All of this can be down through Group Policy Objects pushed from the Active Directory server. However, there are a lot of details to think about, and since this is a blacklist-like activity, it is difficult to know if you thought of everything (for instance, if you want to allow users to connect to a second server through Internet Explorer but do not wish them to access the configuration menus of IE, remember that the "Alt" key can make these menus reappear, if you just "hide" them). As a general rule, I would advise against using an intermediate RDP server as the foundation for your security; you'd better treat the RDP machine as "potentially hostile".

The security situation is similar with VNC, since it exports a desktop. The comparison between RDP and VNC will be mostly over performance and integration (if using a Windows server, RDP will be easier to setup for multiple concurrent clients, and will offer better performance over slow networks; for Linux systems, consider FreeNX).

share|improve this answer
1  
I don't want to post as another answer since I think Thomas hit it on the head, but just to be direct. Using RDP is effectively going to be the same as if you put a second desktop on each person's computer as long as you are running Terminal Services. (The difference being that they run on a common OS, so user isolation is tricky.) Another popular approach is to use something like VMWare View which gives better isolation for users (as each can have their own virtual desktop) but also is a little bit more resource intensive (since each user has their own running instance of Windows). –  AJ Henderson Feb 19 '13 at 14:51
    
I agree with the above comments. In addition however, if your concerned about security. You might want to consider investing (a lot of money) in Citrix which also provides remote desktop functionality, however, it allows for extensive controls over the user environemnt. Additionally. You secure RDP sessions using things like 2 factor authentication (RSA tokens), SSL Certificates and NLA and configuring the remote computer to have further restrictions around what remote users can do/access. –  NULLZ Feb 20 '13 at 1:34
    
Comparison of RDP vs. VNC also brings up authentication mechanisms. Last I checked VNC only allowed single-password login with no audit trail. It also allows viewing and control of active sessions. –  Iszi Feb 20 '13 at 1:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.