forwarding port, what should I know about security?

[abaseballfan]

Hi, was not sure where to post this, umm I have a Linksys router here at work and we have one computer set up as a server, it's just xp professional that it's running and using the remote desktop feature so certain supervisors here can access the system while away, and I have it working fine with port 3389 forwarded to the machine we all use as the server, but I am just curious if there is anything I should do for security to help with this? We just had this going for a few weeks now but want to hear from people that actually know about this stuff, none of us here are IT people really, and actually I got this far by posting on here and asking questions, lol, so I really appreciate any ideas on what I should and should not do with this, thank you for your time.

 

[vop]

Weakest links - prioritized layers:

CLIENTS: Unhardened client machines could be subject to password stealing trojans and keyloggers. Place emphasis on local client machine security as much as possible.

STATIC IPs: Once a static IP has been broken, you could be forever in the sights of a persistant hacker. Dynamic IPs, as inconvenient as they are for you and your users, are very desirable by that very fact. I would investigate use of a Dynamic Update Client (DUC) such as

http://www.no-ip.com

for all your machines. Some DUC clients may also define time access restrictions.

PORTS: A default port (3389) can be generally indicative of the nature of a specific application with any known associated vulnerabilities. Change the default port if possible.

PASSWORDS: Avoid weak passwords that a password dictionary could easily crack. Try out password hacking tools against your user passwords.

SECURITY LOGS: I would want security logs and email alert capabilities for all activity against that port forwarded application. Suggest you test 'linklogger' for a 14 day time trial (

http://www.linklogger.com).

A lot of the same points with variations and alternatives are made here:

http://www.experts-exchange.com/Security/Q_20824244.html

Vince
_____________________________________________________________
[*** If everyone is thinking alike, then somebody isn't thinking. ***]

 

[vop]

See also - more complex:

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmb_tol_drft.asp

... the preferred connection method is by VPN account. This is the preferred method because it avoids opening TCP Port 3389 to allow traffic through your firewall.

Vince
_____________________________________________________________
[*** If everyone is thinking alike, then somebody isn't thinking. ***]

 

[abaseballfan]

great, thank you very much, I will look into this.