Security

Ask something
Discussion Locked

Secure way for using Terminal Services

0 helpful
5 replies

by allan13

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
When setting up clients servers for remote admin using Win 2K Terminal Services, I have 2 options. One would be to setup a second nic in the server giving it a public IP address on the Internet so that I could access it directly with the Terminal Services client. The second way would be to use a Linksys firewall/router, open the necessary port for Terminal Services and access the Terminal Server this way. Option 1 is easy to do, but puts the servers second nic directly on the Internet. Option 2 is also easy to do but opens up a port in the firewall which is directly router to the private IP address of the server. Which of these methods would be best or most secure?

5 replies

by k.o.z.

I may be missing something but your put the server behind the firewall no matter which method you choose.

You want to avoid a dual NIC whenever possible. If you have 1 NIC on your private network and 1 NIC on the public Internet, if the box is compromised (which shouldn't be much of problem without even a firewall) the hacker will have full access to your private network (via the dual NIC). It's much more secure to put the box behind the firewall and open the necessary ports.

Remember the firewall is only the first line of defense (the doorman) - you need to lock down the server at the OS level (but of course you know all this...) Good Luck!

by mckaytech

Generally, the Linksys firewall/router would be the better approach and if you want to make it even a little more secure, you could change the default Terminal Services port from 3389 to something really obscure (Microsoft has an article on their TechNet site on how to do this - Q187623). Technically, the port is not routed "directly" to the private IP of the server but rather by Network Address Translation (NAT) so there is still some protection.

Even better would be a fully configurable firewall where you could not only use a non-standard Terminal Services port but could set it up to not respond to pings or port scans. For about the price of a Linksys, you could build such a firewall using Linux Router Project software on a surplus 486 and have the functional equivalent of a $35k PIX firewall.

paul

This discussion is closed to new replies.