RDP/RDC 1

[burtsbees]

How safe is RDP/RDC over the internet, with a strong password?

Burt

 

[SimonDavies]

If you're really concerned about it I would suggest having a look at

http://www.wissh.com/

SimonD.

The real world is not about exam scores, it's about ability.

 

[burtsbees]

What I mean is that I wanted to know, for example, if username/password info is sent in cleartext, etc. Thanks for responding.

Burt

 

[SimonDavies]

Yes you should be ok, the password is encrypted but you should change the level of encryption (I believe by default it's set to client compatible), you should also perhaps change the default port.

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/TerminalServer/WinStations/RDP-Tcp/PortNumber and ensure you click on the decimal radio button (unless your hex math is better than mine). Once you have changed the default port number all you need to do to connect to the new port number is append the ip address with ort# (ie 192.168.1.1:1234)

You may also want to disable the guest account and rename the administrator account.

Whilst the above will stop general scriptkiddie attacks it won't stop someone who is using more sophisticated methods of detecting your open ports.

SimonD.

The real world is not about exam scores, it's about ability.

 

[burtsbees]

Thanks.

Burt

 

[Narmi]

How Can I Install Server 2003 to Vista Home Edition

 

[burtsbees]

Start a new post!

Burt

 

[brianinms]

Changing the port is just security thru obscurity and actually has little use as the port is still listening.

 

[burtsbees]

I agree---any port scan can tell what protocol is running on any port...of course, one port I love having open is 139...lol

Burt