Re: exposing TS directly to Internet
From: michael (admin_at_pcs.minsk.by)
Date: 10/15/04
- Next message: Miha Pihler: "Re: How do you move a certificate authority to a another domain contrl"
- Previous message: Miha Pihler: "Re: Can I install two Enterprise CA on same domain in two different DC"
- In reply to: Steven L Umbach: "Re: exposing TS directly to Internet"
- Next in thread: Steven L Umbach: "Re: exposing TS directly to Internet"
- Reply: Steven L Umbach: "Re: exposing TS directly to Internet"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 15 Oct 2004 04:24:01 -0700
"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message news:<HOybd.182537$wV.14835@attbi_s54>...
> Of course you can do that and a firewall to protect all other ports will go
> a long way to protect the computer. Be sure to do other normal securing
> procedures such as requiring the use of complex passwords, having an account
> lockout policy with a lockout threshold of no less than ten and a reset
> interval of around ten minutes to deter brut force password attacks, using
> antivirus, disabling unneeded services, and keeping current with critical
> updates. Since the built in administrator account can not be locked out and
> is the top target of attacks I would disable that account from logon through
> TS in it's account properties.
>
> It would increase security quite a bit if you could configure the firewall
> to only accept inbound port 3389 from authorized IP addresses of your users.
> That may not be possible if they roam or do not have static IP addresses.
> Also using a VPN to access the TS would increase security particularly if
> you can use l2tp that would require computer certificates for authentication
> to logon to the VPN. Users could then logon to the VPN and then access the
> TS via it's LAN IP address and it would not have to be exposed to the
> internet. --- Steve
>
Well, Steve. Thanks. I understand that using VPN is the best choice to
secure data communication through the Internet. But let's suppose we
can't build a VPN. I'd like to collect information on any experience
in using MS 2003 directly connected to the Internet with respect to
its resistance to certain attacks on its 3389 port and RDP protocol.
- Next message: Miha Pihler: "Re: How do you move a certificate authority to a another domain contrl"
- Previous message: Miha Pihler: "Re: Can I install two Enterprise CA on same domain in two different DC"
- In reply to: Steven L Umbach: "Re: exposing TS directly to Internet"
- Next in thread: Steven L Umbach: "Re: exposing TS directly to Internet"
- Reply: Steven L Umbach: "Re: exposing TS directly to Internet"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
