5 ms·
It's very good at being a remote _desktop_ protocol, but the fact that it lacks features like tunneling and that authentication is the usual MS mess makes me wi
by qsort 2y ago
It's very good at being a remote _desktop_ protocol, but the fact that it lacks features like tunneling and that authentication is the usual MS mess makes me wish they just went with SSH as transport protocol.
- tomjakubowski 2y agoWindows does support SSH now, so maybe you could rig RDP-over-SSH yourself with port forwarding.
- p_ing 2y agoRD Gateway leverages SSL for encrypted transport for RDP between client and host. Maybe it is possible :-)
- chupasaurus 2y agoRD Gateway has nothing to do with tunneling, it's just a reverse proxy for RDP connections. Funny note: as you've mentioned in other comment, my guess is that RDG was also licensed from Citrix but at the later point.
- awakecoding 2y agoRDP-over-SSH will break Kerberos authentication for two reasons: 1) you'll point the RDP client to localhost and a random port and 2) you won't get a KDC line-of-sight. The irony is Microsoft has demoed this with SSH over Azure Arc, which can only result in an NTLM downgrade. IronRDP is designed to work with Devolutions Gateway (https://github.com/Devolutions/devolutions-gateway https://github.com/Devolutions/devolutions-gateway) for just-in-time RDP connections made from the web or through the desktop client. Devolutions Gateway also supports just-in-time KDC proxying alongside the main RDP connection, making Kerberos possible. You can install the free standalone web access package of Devolutions Gateway to try it out, it will give you a simple web interface where you can enter the hostname, username and password. But if you really want the simplest solution, it's with the rest of the Devolutions stack with Remote Desktop Manager and Devolutions Server. In the end, you'll be able to make RDP connections from RDM or through the web with just a double-click, and it'll automatically generate short-lived tokens and make RDP + Kerberos work seamlessly: https://devolutions.net/gateway/ https://devolutions.net/gateway/
- cryptonector 2y agoKerberos has a protocol for when you don't have a line of sight to the KDC: IAKERB. IIRC MSFT is very interested in it in order to kill off NTLM finally.
- awakecoding 2y agoIAKerb still hasn't shipped - it's a preview feature. Meanwhile, we've been doing KDC proxying successfully in Devolutions Gateway for several years. Sometimes you can wait forever for a supposedly better solution, or you can just make it work in the most obvious way. In the end, all you need is to forward KDC messages, right? It's annoying that it's out-of-band, but the KDC proxying protocol is just an HTTP POST that takes a request message, and sends the response message back.
- cryptonector 2y agoRight, but while I know a lot about Kerberos I know very little about AVD. Does Microsoft expose an HTTPS proxy for the KDCs?
- awakecoding 2y agoYou need to deploy the KDC proxy yourself, and then add it to the .RDP file options in your AVD feed. It's not something that works out of the box: https://learn.microsoft.com/en-us/azure/virtual-desktop/key-distribution-center-proxy https://learn.microsoft.com/en-us/azure/virtual-desktop/key-...
- cryptonector 2y agoAha. Thanks!
- mmooss 2y agoHere's RDP over ssh, per one commenter: https://news.ycombinator.com/item?id=43441584 https://news.ycombinator.com/item?id=43441584
- password4321 2y ago> lacks features like tunneling TCL over RDP is technically barely possible with a ridiculously custom client and a server-side stub: https://rdp2tcp.sourceforge.net/ https://rdp2tcp.sourceforge.net/
- Joe_Cool 2y agoYeah I messed with that. Sidechannel DLLs for RDP aren't fun. XFreeRDP actually also supports that on Linux. I used it for signalling phone calls from the client to an RDP RemoteApp and initiating calls from the RemoteApp. I would decline that project if I was asked today.
- donnachangstein 2y ago> that authentication is the usual MS mess You mean seamless integration with AD and supports smart cards? > makes me wish they just went with SSH as transport protocol. RDP predates OpenSSH by a year.
- Fidelix 2y agoAccording to Wikipedia, RDP = June 16, 1998 SSH = 1995. OpenSSH = 1999
- p_ing 2y agoRDP is based on Citrix ICA which builds on Citrix Multiuser released in 1991 for OS/2, and 1992 for DOS, 1993 for Windows. https://www.basvankaam.com/2017/03/29/a-lesson-in-history-the-citrix-ica-and-microsoft-rdp-early-days/ https://www.basvankaam.com/2017/03/29/a-lesson-in-history-th... The Citrix/Microsoft relationship is a bonkers story. The world didn't yet know that licensing your tech to Microsoft meant you were going to grab your ankles.
- KennyBlanken 2y agoIn the several decades since, nothing has stopped them from coming out with a "RDP v2." I trust SSH to be public-facing. Don't have the right private key? Pound sand. You're not getting in. I trust RDP to allow someone to break into my machine, get admin privileges, and infect / bot it, likely in under an hour. Smart cards rolls eyes
- joking 2y agoThat’s why you have an vpn or the rdp gateway instead of exposing the machines directly to internet.
- Nextgrid 2y agoSmart cards is just certificate-based authentication really. Microsoft did indeed fail hard - if they just made certificate authentication easy to configure on stand-alone machines like SSH key authentication is (and allow to keep the key as a file if desired, instead of in a smart card), a lot of pwnage would've been avoided.
- naikrovek 2y agoDo you not remember the Microsoft of the late 1990s? We’re lucky it didn’t cost $250/seat. And we’re luckier that it’s effectively an open protocol, today, though there are still license considerations if you are reaching into Windows. I was a remote system admin BEFORE Remote Desktop. It was not fun. I would have gladly paid $500/seat at the time for RDP, if that’s what it cost.
- mmooss 2y agoWeren't there any other solutions? (Searching ...) Norton? Citrix? VNC?
- naikrovek 2y agoNone worked well at all. They existed, and I tried them, but they were all either unreliable or unusable because of their bandwidth requirements coupled with 56k modems. There was no good solution for this until RDP came along.
- spudnik 2y agoSometimes i'm using remote desktop inside a remote desktop, and it amazes me every time that it works so well, like there's no visible performance penalty or quality degradation in that. So yes, maybe it doesn't tunnel TCP but does the main task pretty well. And TCP can be tunneled with ssh, which also does its thing very well. Bitvise SSH client (a great application BTW) has a nice feature that allows you to open tunneled RDP connection to the machine where you're connected via ssh, with a single button click and without the need for another authentication. Plus all the TCP tunneling you need. Highly recommended.
- stuartd 2y agoI remote desktop from my Mac into Windows for work. I used to then remote from that Windows into another Windows server, at which point figuring out what the keyboard mappings were became extremely difficult!