1

I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.

I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in the firewall for our local office's IP and RDP directly w/o VPN?

It's just way, way more convenient to be able to just double click an RDP icon and not have to turn off another VPN I already have to use for another hosting environment so that I can turn on the Azure VPN every time I want to log on to an Azure VM. But I also don't want to be doing something that's stupidly insecure.

1 Answer 1

2

VPN with 2FA authentication is the way to go.

First of all you can't do 2FA with RDP, meaning you increase security risk significantly.

RDP has had several vulnerabilities, a few of the most recent 'BlueKeep' CVE-2019-1181, CVE-2019-1182, CVE-2019-0708.

This is the scenario where convenience shouldn't win.

8
  • There's not really a question of whether I will be using RDP. Any suggestion that I don't use RDP is a nonstarter. It's just a question of whether doing it without a VPN over a hole in the firewall that is restricted to incoming requests from the IP of my local office is unreasonably unsafe as compared to doing it over VPN.
    – BVernon
    Aug 28, 2019 at 22:37
  • Though maybe you are simply implying that because of RDP's insecurities, I should use a VPN. If that's the case, I would be more interested in knowing why access to public IP that will only listen to requests from my IP is particularly unsafe if you have anything to say about that.
    – BVernon
    Aug 28, 2019 at 22:39
  • Or if you were suggesting to not use RDP at all, then that's literally like saying I should quit doing my job because there is no feasible way I complete the tasks I need to do without it. That is, there may exist ways to do each individual task I do without RDP, but I would literally be spending all my time learning how to do that rather than actually doing my job.
    – BVernon
    Aug 28, 2019 at 22:46
  • @BVernon having the rdp as less publicly exposed creates less risk. Why not just setup site to site VPN with your Azure infrastructure? It will essentially be the same from a usability perspective, but you will avoid potential configuration mistakes. Aug 29, 2019 at 7:29
  • @BVernon no pun intended here, but RDP was actually never intended for system management in the first place :). That being said I use it as well for most non-automated tasks. Aug 29, 2019 at 7:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .