New answers tagged

0

Your firewall is just working. Nothing to complain about. It's allowing only that IP, the others are getting blocked and logged so that you know someone else is trying to reach your RDP.


3

You do not need to have the password, RDP or access to your computer to send an email from you. SMTP is the protocol used to send mail and this protocol does not do any kind of authentication. Take a look at the code below from the library nodemailer.js: // setup e-mail data var mailOptions = { from: '"Charles Sarver" <charlessarver@gmail.com>', /...


1

I wrote a windows service a few years ago that monitors the event log for this, and firewall block IPs after a configurable number of failed attempts to authenticate over RDP. Details, download links (incl. source code) here: http://huagati.blogspot.com/2014/02/blocking-rdp-brute-force-logon-attacks.html


0

It's also possible it was done with powershell or other terminl connection that could manually send smtp commands to a poorly configured email server. You should be able to tell from the email header, or the server logs, exactly where the email came from. If it came from your machine, you are looking for RDP or powershell sessions connected to your machine. ...


1

You should probably consider using the options in GPOs to restrict RDP to a specific set of known and trusted IPs.


5

I realize that this question has already been marked as answered, but Microsoft has a service included in Server 2008 R2 called Microsoft TS (or RDP) Gateway What this does is allow you to put another server (the Terminal Services Gateway) in front of your actual terminal server which listens on TCP 443 rather than 3389. In addition to cloaking the ...


8

Not exactly proven security, but Port Knocking can allow you to open up closed ports by sending a special set of packets to the server first. You could also rent out a cheap server with a dedicated IP address and set up a VPN, then explicitly set the firewall to only allow connections from the VPN IP.


7

Most of the RDP attacks are being targeted on standard 3389 port. Changing that port to any non-standard port like 8123 will make your remote desktop service listening to it. How-to-change-the-listening-port-for-Remote-Desktop Once you change it, you will need to specify the port number while initiating remote desktop connection. eg. IPaddress:8123


4

You may want to check out RDPGuard (Essentially fail2ban for rdp) and of course try your best to enforce a good password policy.


2

There are a few ways to protect RDP. Don't use public port #3389. Is the best way to decrease brute force atemps. Allow only certain IPs(or range of IPs) address to public IP. Use smart routers. I use mikrotik (http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention) or Cisco. Configure firewall blocking to many attempts. I use third party tools to block ...


1

Truthfully the best way would to protect yourself from having your credentials stolen is to protect them. If you are building a login script make sure the password is not hardcoded into the script. Have a strong password against bruteforce Change your password every 30 days or so (Windows has a built in reminder that can be turned on) Do not share the ...



Top 50 recent answers are included