[ale] rdesktop through a firewall?

[Lane Oden]

RDP is vulnerable to a Man In the Middle Attack...

Last I checked, MS had no real plans to correct the issue.

RDP is encrypted as far as the actual data stream goes. However, the
information used to generate session keys is sent in cleartext and is
trivial enough to reconstruct.

Basically, an attacker on the wire between the source and destination
could, if he/she were so inclined, pose as your Terminal Services
server and sniff your passwords.

Tunnelling is never a bad idea. Be it via ssh or vpn...

On 1/20/07, J. D. <jdonline at gmail.com> wrote:
>
> >
> >
> > >Hmm, I'll have a look at the nat issue.  As for the ssh, I understand
> > >rdesktop is already encrypted.  Am i wrong?
> >
> > --
> > Tina
>
> Hey Tina,
>
>      I think that it depends on how it is configured. It appears that it
> needs to be configured through
> group policy menu to require 128bit encryption. Even with that done to
> ensure reasonable security
> the only way to  protect against man-in-the-middle attacks is to tunnel over
> ssh. puTTY might be an
> option there.
>
> Here is a neato link that discusses the encryption info and has a link to
> ssh tunneling.
> http://www.mobydisk.com/techres/securing_remote_desktop.html
>
> Best regards,
>
> J. D.
>
>
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>
>