Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion GroupsWindows VistaWindows XPWindows MeWindows 98Windows 95Virtual PCInternet ExplorerOutlook ExpressWindows MediaSecurity
Related Topics
MS Server ProductsMS OfficePC HardwareMore Topics ...

Windows Forum / Windows XP / Remote Desktop / November 2005

Tip: Looking for answers? Try searching our database.

How secured is Remote Desktop?

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Techmanblues - 29 Nov 2005 08:07 GMT
How secured is Remote Desktop in its default settings when both machines are
XP Pro with the latest patches? Obviously the initial handshaking when
username and password are sent is encrypted, but is subsequent data tranfer
also encrypted as well? If so how strong is the encryption?
Sooner Al [MVP] - 29 Nov 2005 11:07 GMT
See this page for information concerning RDP encryption...

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/termserv/termse
rv/remote_desktop_protocol.asp


Personally I run RDP through a Secure Shell (SSH) tunnel both for added
security and for easy access to multiple PCs on my home LAN. In my case I
use a 2048-bit RSA private/public key pair (encrypted with a strong pass
phrase) versus a password (strong or otherwise) for authentication.

http://theillustratednetwork.mvps.org/Ssh/RemoteDesktopSSH.html

You could do the same thing, ie. tunnel RDP, through a IPSec/L2TP or SSL VPN
if you wished.

Signature

Al Jarvi (MS-MVP Windows Networking)

Please post *ALL* questions and replies to the news group for the mutual
benefit of all of us...
The MS-MVP Program - http://mvp.support.microsoft.com
This posting is provided "AS IS" with no warranties, and confers no
rights...

> How secured is Remote Desktop in its default settings when both machines
> are
> XP Pro with the latest patches? Obviously the initial handshaking when
> username and password are sent is encrypted, but is subsequent data
> tranfer
> also encrypted as well? If so how strong is the encryption?
Chris Priede - 29 Nov 2005 11:15 GMT
Hi,

> How secured is Remote Desktop in its default settings when both
> machines are XP Pro with the latest patches? Obviously the initial
> handshaking when username and password are sent is encrypted, but is
> subsequent data tranfer also encrypted as well?

Yes.

> If so how strong is the encryption?

The highest available encryption level is used by default, which amounts to
128-bit RC4.  There are some flaws with it -- plaintext checksums make a
cryptoanalysis attack potentially easier than it should be -- however, it's
still quite well encrypted and the keys are unique to each session.

The single layer of authentication (username and password only) is usually a
more serious problem.  For high security requirements, consider wraping RDP
access with a VPN and smart card or certificate authentication.

For personal use, make sure your Windows user accounts have decent
passwords.  If you only connect from certain locations (e.g. from the office
to your home computer) you can configure your firewall (or router, if there
is one) to only allow RDP connections from certain IP addresses or address
blocks.

Signature

Chris Priede

I

 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.