Remote Desktop within Citrix - security problem?

[TeunMeijer]

Our company forces us to use a centralized application. It is installed on a overseas server in England. They told us to use the Remote Desktop client provided with XP to establish a connection to that server with Terminal Server installed. I have installed several RDP clients already but I have also some Neoware thin clients that will only work with Citrix. I can publish the RDP on my Citrix Metaframe XP servers but I am not eager to do this.

Besides that there are better ways to connect to this server I have seriouis concernes about the security. I feel that because of using the RDP client software my users do not work secure.

Therefore my question; what are the dangers of using (publishing) the RDP on my Citrix servers? What can I do to protect my network?

 

[patrickrouse]

RDP is encrypted, just like ICA. What leads you to believe that your NeoWare clients only support ICA?





Patrick Rouse
Microsoft MVP - Terminal Server

http://www.sessioncomputing.com

 

[TeunMeijer]

@Patrick: I found out yesterday that the Neoware TC's have also a RDP client onboard. Did not get it working however but hey, it's there...

Still, my basic concern is that I think that there are severe security problems when my users use the RDP client under Citrix.
What if a hacker copies my IP adress and connects to the server overseas? Logins are hackable also and my experience with the administrators of the other company are not that good. They seem to have no knowledge of the dangers involved. I have reason to believe that their administrator password is still 'administrator' if you catch my drift...

 

[patrickrouse]

The RDP listener has a built-in DOS/Hacking detection, so it will drop connections after several failed logon attempts.

Have you considered using an SSL Gateway in front of the TS so users wouldn't be able to connect with the standard RDP Client? Two of these are 2X Load Balancer and Tunnel2.

I have still never seen or heard of the RDP protocol exploited to hack into a corporate network, or any network.

Sounds like your worries are about simple passwords, not RDP. Make a better password policy.




Patrick Rouse
Microsoft MVP - Terminal Server

http://www.sessioncomputing.com