How secure is Terminal Services Web on Win2003 server

[Dirtbike]

We need a method for people to get into our system. In the past they dialed up to our UNIX box. We've put in a new network with WiFi VOIP and the whole nine yards. We have Siemens routers. The IP guru says the heck with VPN, Siemens has a TS solution that works great. Our IP guru "wannabee" says TS Web is too unsecure and that all somebody needed to do was discover our port and then the exploits can begin. I trust our IP guru but my boss trusts the wannabee dude. The wannabee dude is a EE with LAN/WAN experience but the other dude is MCSE, CCNP, with years of real world experience. (read not just another "paper" certified engineer) Thanks for the help\\

Scott in Charlotte, NC

 

[nsanto17]

If you really wanted to make sure it is secure then have your users VPN in and then TS to the box you want them to hit.

 

[Davetoo]

If I had the option to VPN or TS, I'd VPN any day of the week. Fact I have a TS server...but you have to VPN in to use it.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[gurner]

not nessasarily, but there's riskier security implications to going via the other routes, so stick with a VPN

the VPN gives them LAN IP visablity, not remote desktop usage, they'd then connect to the Terminal server via the internal IP address of the TS

often seen a sales person promising that an app like a database would work fine over a VPN, or all you need is a VPN e.t.c. but we're like 'in what context?' when the project lands on the desk

there are all manner of variables? like TS or Citrix or thick client to first spring up

the 'Wannabee' sound more rounded, the IP Guru sounds like he's trying to sell you something, yeah, hacks would probably start if it was a published TS

the TS web would probably be TS's in an DMZ and port forwarded to from a Firewall on the edge of your DMZ facing the Internet, with open ports for AD authentication through a 2nd Firewall between you DMZ and LAN to your internal DCs

anything less is risky (if you go the published route instead of VPN)

Gurner

http://www.divineparadox.co.uk