0

I know Remote Desktop Protocol can be incredibly insecure if handled wrong. Knowing no system is 100% safe, are there any easy to exploit vulnerabilities in the described system below;

ZeroTier VPN:

  • Private network. Join via NodeID.
  • Every member must be manually approved by admin before granted access to the network.
  • Only one admin account, and it's protected by 2FA.
  • Every member has their own static local IP provided by ZeroTier.

Host Device:

  • 3389 Port is blocked with Windows Firewall to every single IP address, except for the ZeroTier IP of client device(s).

Under these circumstances I can't find any weakness within reason, and it seems to me the only non-super-advanced way to hijack the host device is to break through ZeroTier 2FA and manually let themselves in, and also change their IP to the correct one. The configuration seems practically impervious to bot attacks, and poses quite a strong security layer against targeted attacks. What are your expert opinions on this setup? Is there anything I'm missing?

Improve this question
8
  • What do you want to protect? The RDP accounts or the RDP environment? And against what threats? Just creating an Allowlist of IPs without a VPN defeats bots.
    – schroeder ♦
    Commented Jan 3, 2022 at 11:22
  • I want to protect the Host device from being accessed by anyone else but me. In this scenario I have only one Host device, multiple users permitted to be on the same network, only two devices on the network, that should be able to access the Host device via RDP. Host device has only one user on it, and it has Admin privileges. I'm sure there are better ways to achieve my intended level of security, and certain aspects may be overkill. Thank you very much for your interest and time, and I'd appreciate a "case study" approach.
    – Hethradiah
    Commented Jan 3, 2022 at 11:53
  • You talk about multiple users, though. Are there multiple users or just one?
    – schroeder ♦
    Commented Jan 3, 2022 at 11:56
  • Why use SD-WAN when there are only 2 devices and they are on the same network? Overkill is fine, but controls need a purpose and an identified threat to counter. It's unclear what your details are, what your threats are, and who these controls are meant to address those threats. Without these things a "case study" is impossible.
    – schroeder ♦
    Commented Jan 3, 2022 at 12:00
  • I think you are going to have to explain quite a lot more about the context, the network, how port 3389 is exposed, and what the threats are.
    – schroeder ♦
    Commented Jan 3, 2022 at 12:02

1 Answer 1

Reset to default
0

To protect RDP, you need to limit what devices can connect (limit the exposure and "threat surface") and to protect the accounts from brute force attacks (or stolen credentials). Your proposal sort of does this.

You place the ZeroTier IPs in the allow list, but, as you say, it might be possible for an unauthorised person to obtain one of those IPs. You limit the threat surface, but allow some kind of a backdoor. Better than nothing, but there is an obvious weakness. How much of a weakness that is will depend on how easy it might be to obtain an IP.

You protect one user account with 2FA, but all accounts should be protected by 2FA. This is a significantly effective means of protecting accounts from brute force.

Yes, you have a single point of failure in the ZeroTier service. If that is compromised, then all your controls are compromised. But you can make a risk assessment about that and whether the ease of unified control is a benefit worth the risk.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .