thats the best you could come up with? you sir, need to browse the internet some moar.
On Thu, Jun 10, 2010 at 12:15 AM, Larry Seltzer <[email protected]>wrote: > Click here to retrieve your free beer. > > > > http://bit.ly/4a8VOA > > > > *From:* Benji [mailto:[email protected]] > *Sent:* Wednesday, June 09, 2010 7:08 PM > *To:* Larry Seltzer > *Cc:* Thor (Hammer of God); [email protected]; Daniel Sichel; > [email protected] > > *Subject:* Re: [Full-disclosure] RDP, can it be done safely? > > > > I like this idea. > > On Wed, Jun 9, 2010 at 11:58 PM, Larry Seltzer <[email protected]> > wrote: > > I might be able to buy you one beer with the money, but it won’t be > anything good. > > > > *From:* Thor (Hammer of God) [mailto:[email protected]] > *Sent:* Wednesday, June 09, 2010 6:56 PM > *To:* Larry Seltzer; [email protected]; Daniel Sichel > > > *Cc:* [email protected] > *Subject:* RE: [Full-disclosure] RDP, can it be done safely? > > > > And you didn’t include me?? I’m HURT! ;) > > t > > > > *From:* Larry Seltzer [mailto:[email protected]] > *Sent:* Wednesday, June 09, 2010 3:54 PM > *To:* Thor (Hammer of God); [email protected]; Daniel Sichel > *Cc:* [email protected] > *Subject:* RE: [Full-disclosure] RDP, can it be done safely? > > > > <digression> > > 10 years ago I wrote a book on Terminal Services for Windows 2000. Believe > it or not, I still get trivial royalties on it, $6.81 for the first quarter > of this year, and the book has been out of print for years. > > > > Someone out there in 2010 is buying a book on Windows 2000, sucking out the > last copies of it left in the channel. > > </digression> > > > > *From:* [email protected] [mailto: > [email protected]] *On Behalf Of *Thor (Hammer of > God) > *Sent:* Wednesday, June 09, 2010 6:33 PM > *To:* [email protected]; Daniel Sichel > *Cc:* [email protected] > *Subject:* Re: [Full-disclosure] RDP, can it be done safely? > > > > This is not correct. While the default setting for an RDP connection is > “client-negotiate” that does not mean that you will automatically get a > no/low bit encryption session. And one should note that this has nothing > to do with “local” or “remote” users: To be pedantic, **all** RDP > sessions are “remote.” You can easily configure the server to require > certificate-based TLS encryption and have a host of other transport security > options. > > > > I’m not sure what you mean by “if the users are remote you might find it > easier to user another remote access solution.” That makes no sense to me. > > > > Daniel – If I understand your question, your concern with having standard > users connecting up to and running software on a server machine, correct? > This is typically where most people fall short in application deployment via > terminal services. You should certainly make sure that the users are > standard user and that you’ve properly ACL’d off the application and data. > The model you describe sounds relatively straight-forward in that the server > will be a dedicated application server (if I understand correctly). When > you have high numbers of users where some are local administrators and they > all have home directories with various access points to shares, etc, there > are other, more complicated methods you must consider when deploying TS. > > > > I’ve done fair amount of work with RDP, so I’m happy to help if you can > give me some more information. > > > > t > > > > *From:* [email protected] [mailto: > [email protected]] *On Behalf Of *Jeffrey Walton > *Sent:* Wednesday, June 09, 2010 2:19 PM > *To:* Daniel Sichel > *Cc:* [email protected] > *Subject:* Re: [Full-disclosure] RDP, can it be done safely? > > > > Hi Dainiel, > > > > > You might find it easier to use another remote access solution. > > I probably should have elaborated: if users are local, understand that RDP > is probably un-encrypted or weakly encrypted. If the users are remote, you > might find it easier to use another remote access solution. > > Jeff > > On Wed, Jun 9, 2010 at 5:04 PM, Jeffrey Walton <[email protected]> wrote: > > Hi Dan, > > > > Where are the users located (local LAN or from an untrusted network such as > the Internet)? > > > > If I recall correctly, RDP encryption is "turned on" from a GPO setting > that applies to the host/server, and not just RDP [or was it strong > encryption?] (corrections, please). So you can get a secure RDP connection > at the cost of possibly breaking other functionality. > > You might find it easier to use another remote access solution. > > > Jeff > > > > On Wed, Jun 9, 2010 at 4:35 PM, Daniel Sichel <[email protected]> > wrote: > > We have a boneheaded group of software developers who even in this day > and age eschew the client server model of software for the easier dumber run > it from the console school of design. So I have this idiotic Windows > accounting application that MUST run on an application server, cannot be run > from a client. Rather than have my accounting department log in directly to > the physical box, I would like to have them use some flavor of terminal > services on my Windows server. My question therefore is, can I turn on RDP > safely, without exposing my Windows server to risk of exploitation? > > Thanks for any help you can give. > > Dan S. > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > > > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > >
<<image001.gif>>
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
