3 ms·

As someone who supports a lot of Windows environments - yes, it's incredible the rate at which this occurs. I'd strongly point people at the RD Gateway MFA plug

As someone who supports a lot of Windows environments - yes, it's incredible the rate at which this occurs. I'd strongly point people at the RD Gateway MFA plugin as a requisite for publishing RDS these days: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg https://docs.microsoft.com/en-us/azure/active-directory/auth... It's also supported to publish behind the Azure App Proxy, avoiding the need for any port forwards at all: https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-integrate-with-remote-desktop-services https://docs.microsoft.com/en-us/azure/active-directory/app-...

vladvasiliu 4y ago
> I'd strongly point people at the RD Gateway MFA plugin Is this working well? I've tried setting this up a few weeks ago and found it to be somewhat brittle. The MFA requests would sometimes be delayed long enough that the GW would timeout. I've tested this on Windows 2022.
- technion 4y ago
  I've a whole range of clients running it without an issue. I will say however, the only MFA it supports is push (ie, TOTP doesn't work), and if you're not familiar with that, be aware many Android installations snooze that app and the push doesn't work unless you specifically have the app open at the time you logon.
- ptk 4y ago
  We’ve been using it for years and it’s always been irritating in the way you describe. It seems if you miss the first push notification, you’ll receive a flurry more, many of which don’t really seem to do anything even if you do approve them. It’s possible that I have the timeouts set incorrectly, but I’ve followed Microsoft’s guidelines. Unfortunately we don’t have a better solution, so we suffer with it.
- greatquux 4y ago
  We use Rublon for adding MFA to Remote Desktop and other VPNs too and it works very well. It’s not an over engineered monstrosity like Microsoft solutions.
stinos 4y ago
You'd recommend a standard trick like changing the port? Just doing that dropped the number of attempts to almost zero here.
- technion 4y ago
  I think that's down to the problem you're trying to solve. Much like SSH brute force, if you know the only account is yours and it has an appropriately reasonable password and you can trust yourself not to get phished (say, you have a system managing the logon) then that's probably fine. The second there are other people with dumb passwords, or many other risk factors at play, I'd really suggest you need something doing MFA which unfortunately, MS doesn't offer out of the box on RDP.
- r00f 4y ago
  You never know which 0-day gets discovered tomorrow, so even strong password might not be enough. I always change default ports on both SSH and RDP. It helps falling out of scope of unsofisticatrd scanners, keeps logs a bit cleaner plus doesn't waste CPU on useless auth attempts. Keeping ports behind VPN or port knocking is even better, but not always feasible

vladvasiliu 4y ago

> I'd strongly point people at the RD Gateway MFA plugin Is this working well? I've tried setting this up a few weeks ago and found it to be somewhat brittle. The MFA requests would sometimes be delayed long enough that the GW would timeout. I've tested this on Windows 2022.

technion 4y ago
I've a whole range of clients running it without an issue. I will say however, the only MFA it supports is push (ie, TOTP doesn't work), and if you're not familiar with that, be aware many Android installations snooze that app and the push doesn't work unless you specifically have the app open at the time you logon.
ptk 4y ago
We’ve been using it for years and it’s always been irritating in the way you describe. It seems if you miss the first push notification, you’ll receive a flurry more, many of which don’t really seem to do anything even if you do approve them. It’s possible that I have the timeouts set incorrectly, but I’ve followed Microsoft’s guidelines. Unfortunately we don’t have a better solution, so we suffer with it.
greatquux 4y ago
We use Rublon for adding MFA to Remote Desktop and other VPNs too and it works very well. It’s not an over engineered monstrosity like Microsoft solutions.

stinos 4y ago

You'd recommend a standard trick like changing the port? Just doing that dropped the number of attempts to almost zero here.

technion 4y ago
I think that's down to the problem you're trying to solve. Much like SSH brute force, if you know the only account is yours and it has an appropriately reasonable password and you can trust yourself not to get phished (say, you have a system managing the logon) then that's probably fine. The second there are other people with dumb passwords, or many other risk factors at play, I'd really suggest you need something doing MFA which unfortunately, MS doesn't offer out of the box on RDP.
r00f 4y ago
You never know which 0-day gets discovered tomorrow, so even strong password might not be enough. I always change default ports on both SSH and RDP. It helps falling out of scope of unsofisticatrd scanners, keeps logs a bit cleaner plus doesn't waste CPU on useless auth attempts. Keeping ports behind VPN or port knocking is even better, but not always feasible