1

I have a question about protecting myself against attacks on the RDP service.

I note that I have already done the appropriate configuration:

  • I am using a local user (not administrator) to connect
  • the administrator group is excluded from remote desktop users
  • the RDP service port is changed

Local Group Policy Editor - Remote Desktop Services

  1. Security:

    • encryption level: high,
    • the appropriate RDP security layer enabled,
    • Network level authentication enabled

  2. Connections:
    • limited number of connections: 1

  3. I set session timeouts

As you can see, these are not standard settings. In addition, I have implemented Eset Internet Security. What worries me and I am asking you for help in better securing the RDP service.

In the event viewer (Win7Pro) I noticed a frequent error No. 56 TermDD: The server security layer detected an error in the protocol stream and disconnected the client. Client IP address: xxx.xxx.xxx.xxx

I have a lot of such errors. Someone is trying to get to the RDP service. I changed the RDP service port a while ago, but to no avail.

Additionally:

In the anti-virus firewall I have observed dozens of attempts to: " exploit the vulnerability in the temporary blacklist of addresses (Incoming Attack Generic).

How can I additionally secure the RDP service against such attacks? I have heard about the RDPGuard program - the question of whether it is effective.

Improve this question
7
  • 1
    Think about what you are asking: you have built a strong door and lock. People try to open the door but can't. You are asking how to prevent people from accessing the door. You can't and still be free to connect to it yourself.
    – schroeder ♦
    Commented Mar 18, 2020 at 10:08
  • As for your AV alert, you are going to need to look up the documentation or support to find out what that means. It's a pretty generic message. What blacklist? What port? etc.
    – schroeder ♦
    Commented Mar 18, 2020 at 10:09
  • Changing a port number is not necessarily the most effective step. Port scanning is common and standard services can be easily identified on non-standard ports if an attacker cares. Since you have already set it up, I wouldn't bother undoing it, but it isn't normally worth the effort. Also you are missing two important items: keep your software updates and use strong passwords. There have been plenty of cases where a computer with RDP is compromised by bot networks that find open servers, guess common username+password combinations, and succeed.
    – Conor Mancone
    Commented Mar 18, 2020 at 10:27
  • I mentioned earlier that I changed the RDP port because I could not connect to the remote desktop because someone was constantly attacking the remote desktop service. As I mentioned, I have a limited number of connections turned into 1 - and I had to hit the right time to connect. The attack worked in such a way that it occupied sessions - despite the fact that ultimately did not get to the server. You can see that something is happening at an external address, so I'm asking about the possibilities of increasing security? hardware firewall? additional firewall configuration ?
    – mlik
    Commented Mar 18, 2020 at 10:30
  • The computer is being updated. Once in a while, I change passwords (for very strong). Thanks for reply.
    – mlik
    Commented Mar 18, 2020 at 10:34

2 Answers 2

Reset to default
1

I would never expose an RDP service directly (without VPN or RDP gateway) to the internet. In the past, a lot of vulnerabilities in the protocol were discovered and also abused by malicious actors. The problem is that the Remotedesktop / Terminal services require high privileges to run. If there is a serious vulnerability in the RDP server (again), neither RDP settings nor user passwords or privileges will help.

Improve this answer
0

The attacks you experienced are probably due to zombies nodes that scan the network to identify vulnerable targets on known ports and protocols; It is now a constant whenever you enter the net. Changing port cut a large chunk of these automated scanners. The antivirus will have created a list of the IPs involved in the scan, identifying them based on the probe received. Be careful because the RDP protocol is susceptible to authentication attacks even if protected by a specific password: In fact, you can authenticate yourself without even knowing it. It is important that you update your system often to install related patches. You did well, in my opinion, by configuring the service as indicated. I see no other solution than to resort to VPN to be more peaceful.

Improve this answer
2
  • 1
    I will have to think about VPN. Thank you all for the answers.
    – mlik
    Commented Mar 18, 2020 at 17:33
  • @milk, there isn't a competent IT professional on the entire planet that would recommend opening RDP protocol to the internet. Close the port, regardless of what number it is.
    – KidACrimson
    Commented Mar 20, 2020 at 4:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .