12 ms·

ssh is much more secure than rdp imho - I guess unless it's all behind a vpn, in which case you could just ssh over the vpn as well and the ssh port is never ex

ssh is much more secure than rdp imho - I guess unless it's all behind a vpn, in which case you could just ssh over the vpn as well and the ssh port is never exposed on the actual internet, so the attack surface would be the same. That being said, there's always a way -- you could use rdp to constantly run a reverse ssh tunnel somewhere, then just connect to the other end of the tunnel...

hobs 7y ago
Yeah - the internet can hack RDP as well as SSH - they both expose a port and Microsoft recent had a global RDP bug (though not for recent versions) that enabled that very problem. A VPN is a good suggestion, and I would probably position it as an industry best practice whether you are using RDP or other network protocols to access their resources.
- mattbillenstein 7y ago
  Yeah, in that case, just compare the relative security events between rdp and ssh and you'll probably convince them they should not be running rdp on the open internet...
  - pcgeller 7y ago
    Good point, thank for the input. I found some other discussion on RDP and SSH security here: https://ubuntuforums.org/showthread.php?t=1545145 https://ubuntuforums.org/showthread.php?t=1545145 https://security.stackexchange.com/questions/133342/how-secure-is-rdp https://security.stackexchange.com/questions/133342/how-secu... https://forums.anandtech.com/threads/ssh-vs-vpn-vs-vnc-vs-software-vs-rdp-which-to-choose-and-why.2358432/ https://forums.anandtech.com/threads/ssh-vs-vpn-vs-vnc-vs-so...
pcgeller 7y ago
I've been reading about tunneling but don't think it'll work because I can't make any changes to the RDP gateway box. The gateway acts as a proxy (bastion?) which then directs traffic. Is my thinking correct?
- mattbillenstein 7y ago
  if it has an ssh client, you can reverse proxy out - since that machines lives on the internal network as well, then you have access to everything else. You can even forward ports to other machines over the reverse tunnel and stuff...

hobs 7y ago

Yeah - the internet can hack RDP as well as SSH - they both expose a port and Microsoft recent had a global RDP bug (though not for recent versions) that enabled that very problem. A VPN is a good suggestion, and I would probably position it as an industry best practice whether you are using RDP or other network protocols to access their resources.

mattbillenstein 7y ago
Yeah, in that case, just compare the relative security events between rdp and ssh and you'll probably convince them they should not be running rdp on the open internet...
- pcgeller 7y ago
  Good point, thank for the input. I found some other discussion on RDP and SSH security here: https://ubuntuforums.org/showthread.php?t=1545145 https://ubuntuforums.org/showthread.php?t=1545145 https://security.stackexchange.com/questions/133342/how-secure-is-rdp https://security.stackexchange.com/questions/133342/how-secu... https://forums.anandtech.com/threads/ssh-vs-vpn-vs-vnc-vs-software-vs-rdp-which-to-choose-and-why.2358432/ https://forums.anandtech.com/threads/ssh-vs-vpn-vs-vnc-vs-so...

pcgeller 7y ago

I've been reading about tunneling but don't think it'll work because I can't make any changes to the RDP gateway box. The gateway acts as a proxy (bastion?) which then directs traffic. Is my thinking correct?

mattbillenstein 7y ago
if it has an ssh client, you can reverse proxy out - since that machines lives on the internal network as well, then you have access to everything else. You can even forward ports to other machines over the reverse tunnel and stuff...