FQDN not Resolving

JaredBusch

@scottalanmiller I got it working!!!! I fell so accomplished. Jk

Great!, now I can through a password cracker at it..

JaredBusch

@christophergault said:

@scottalanmiller I got it working!!!! I fell so accomplished. Jk

Great!, now I can through a password cracker at it..

Note: I really will not, but this is part of RDS I hate. I need to find a fail2ban equivalent for Windows.

christophergault

@JaredBusch Well whats a best practice for protecting RDS?

scottalanmiller

I'm not the expert here, but a common practice is to keep it inside of the network and require people to connect via a VPN before connecting to RDP. The VPN, for security, would be best handled by being exclusive to a DMZ where the RDS server sat isolated from other traffic.

brianlittlejohn

I thought common practice now was to use rds gateway so you only open port 443 and everything is passed through it.

scottalanmiller

@brianlittlejohn said:

I thought common practice now was to use rds gateway so you only open port 443 and everything is passed through it.

Which is a form of VPN SSL VPN for a single port and application. But yes, that's the best way. Not sure if it is the most common in the SMB yet.

Dashrender

@JaredBusch said:

@JaredBusch said:

@christophergault said:

@scottalanmiller I got it working!!!! I fell so accomplished. Jk

Great!, now I can through a password cracker at it..

Note: I really will not, but this is part of RDS I hate. I need to find a fail2ban equivalent for Windows.

While not the same, one should have account lockouts set after some amount of bad attempts.

scottalanmiller

That would make DoS attacks super easy on your users, though.

Dashrender

@scottalanmiller said:

That would make DoS attacks super easy on your users, though.

can something like nginx (SP) sit in front for a fail2ban type server?

scottalanmiller

@Dashrender said:

@scottalanmiller said:

That would make DoS attacks super easy on your users, though.

can something like nginx (SP) sit in front for a fail2ban type server?

Not sure what you mean. NGinx would still use fail2ban to automate the firewall.

scottalanmiller

Here is a Windows product that works like fail2ban..

http://rdpguard.com/

Dashrender

@scottalanmiller said:

@Dashrender said:

@scottalanmiller said:

That would make DoS attacks super easy on your users, though.

can something like nginx (SP) sit in front for a fail2ban type server?

Not sure what you mean. NGinx would still use fail2ban to automate the firewall.

Can you think of a solution to provide fail2ban like service infront of RDS?

scottalanmiller

@Dashrender said:

@scottalanmiller said:

@Dashrender said:

@scottalanmiller said:

That would make DoS attacks super easy on your users, though.

can something like nginx (SP) sit in front for a fail2ban type server?

Not sure what you mean. NGinx would still use fail2ban to automate the firewall.

Can you think of a solution to provide fail2ban like service infront of RDS?

IPBan does exactly that, and is open source.

https://github.com/jjxtra/Windows-IP-Ban-Service

stacksofplates

You could also put an SSH tunnel in front. SSH into a VM and tunnel 3389. I do the same thing for my container VDI, just port 22 instead of 3389.

JaredBusch

@johnhooks said:

You could also put an SSH tunnel in front. SSH into a VM and tunnel 3389. I do the same thing for my container VDI, just port 22 instead of 3389.

That is not useful for an RDS deployment. RDS deployments are meant to be either public to the LAN or public to the WAN. that is really the point of using RDS.

Dashrender

@johnhooks said:

You could also put an SSH tunnel in front. SSH into a VM and tunnel 3389. I do the same thing for my container VDI, just port 22 instead of 3389.

Which problem are you solving with this? attaching the RDS box?
What would you start the SSH tunnel with? and the VM would have to forward your traffic through itself to the RDS server, just like an RDS Gateway.

I suppose you're mentioning using an SSH box because then you could use Fail2Ban?

stacksofplates

@Dashrender said:

@johnhooks said:

You could also put an SSH tunnel in front. SSH into a VM and tunnel 3389. I do the same thing for my container VDI, just port 22 instead of 3389.

Which problem are you solving with this? attaching the RDS box?
What would you start the SSH tunnel with? and the VM would have to forward your traffic through itself to the RDS server, just like an RDS Gateway.

I suppose you're mentioning using an SSH box because then you could use Fail2Ban?

You could use whatever you want to initiate the connection. That was one reason I mentioned it (fail2ban) but it has some other uses too. I have a jump box that has 2FA and pubkey only, so I just initiate the connection, type in the code, and just open the RDP session.

stacksofplates

@JaredBusch said:

@johnhooks said:

You could also put an SSH tunnel in front. SSH into a VM and tunnel 3389. I do the same thing for my container VDI, just port 22 instead of 3389.

That is not useful for an RDS deployment. RDS deployments are meant to be either public to the LAN or public to the WAN. that is really the point of using RDS.

How is that any different than using RD Gateway or a VPN?

Dashrender

@johnhooks said:

@JaredBusch said:

@johnhooks said:

You could also put an SSH tunnel in front. SSH into a VM and tunnel 3389. I do the same thing for my container VDI, just port 22 instead of 3389.

That is not useful for an RDS deployment. RDS deployments are meant to be either public to the LAN or public to the WAN. that is really the point of using RDS.

How is that any different than using RD Gateway or a VPN?

I guess I've never heard of using SSH as a VPN for other things.

stacksofplates

@Dashrender said:

@johnhooks said:

@JaredBusch said:

@johnhooks said:

You could also put an SSH tunnel in front. SSH into a VM and tunnel 3389. I do the same thing for my container VDI, just port 22 instead of 3389.

That is not useful for an RDS deployment. RDS deployments are meant to be either public to the LAN or public to the WAN. that is really the point of using RDS.

How is that any different than using RD Gateway or a VPN?

I guess I've never heard of using SSH as a VPN for other things.

Ya you can do ssh -L 8080:<rdphost>:3389 user@host and it will tunnel 3389 on the remote host to 8080 on your localhost. Plus it's fully encrypted this way.

One good random use for it is if you're behind a proxy and you need to get to a site, you can do the same thing. ssh -L 8080:sitename:80 user@host and then visit localhost:8080 and you'll be at the site.