Regarding:
http://unix.stackexchange.com/questions/12924/ssh-tunnel-with-vnc
Which one would be better, if we look it @security side?
I heard that RDP is very very poor when it comes to security.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|||
|
|
|
RDP has some issues, but these are broadly mitigated by getting the config right. Wicked Clown demonstrated a wonderful privilege escalation attack from restricted user to admin in less than 5 minutes at the recent B Sides London security conference which relied on a common misconfiguration - paper here. TLS can provide a strongly authenticated tunnel - which will help. An alternative could be VNC - which also has potential issues, however using an SSH tunnel for this gives you a much better position with respect to security as you can use strong mutual authentication. The key point to look at is what your key risks are - if you are worried about an attacker pretending to be a user, SSH or TLS with certificates gives you the authentication and encrypted tunnel part of the puzzle, is a good idea, however you still have the risk of an attacker stealing the mobile device:-) |
|||||||||||||
|
