TS Web Security

[shauncarter1]

I would like everyone to share their thoughts on this probable configuration.
I'm aware that the most secure method of deploying TSweb for external access
is more than likely VPN. However, I have potentially 200 users that will
need to connect. The administrative overhead of VPN would stretch our limited
staff to it's capacity.

I decided to set TSweb up on the DMZ of a PIX firewall. I will only allow
external RDP traffic to that particular device. To ensure security I will
configure policy for only two login attempts and check the security logs on
an ongoing basis. Most importantly I will continously monitor the RDP
security vulnerabilites. I like second opinions so can someone provide me
with a critque?

Thanks

[-=D@n=-]

Post by shauncarter1
I would like everyone to share their thoughts on this probable
configuration. I'm aware that the most secure method of deploying
TSweb for external access is more than likely VPN. However, I have
potentially 200 users that will need to connect. The administrative
overhead of VPN would stretch our limited staff to it's capacity.
I decided to set TSweb up on the DMZ of a PIX firewall. I will only
allow external RDP traffic to that particular device. To ensure
security I will configure policy for only two login attempts and
check the security logs on an ongoing basis. Most importantly I will
continously monitor the RDP security vulnerabilites. I like second
opinions so can someone provide me with a critque?
Thanks

Hi Shaun

I'm in a similar situation to you, but with a few less users. We host
applications for our customers, so VPN was out of the question due to the
same reasons you state. Our PIX lets through port 80 for the web page, and
port 22xxx (not telling you;) ) for RDP. You can change the listening port
on the server from 3389, and the web client can be changed using the
'MsRdpClient.AdvancedSettings2.RDPPort = "xxxx"' setting. At least then if
anyone sniffing sees an open port, it won't be as obvious what it is.

Other than that, decent passwords, and a beady eye, there's not much you can
do.