Terminal Services, Part 4

In Part 1, Part 2, and Part 3 of this series, I gave you a tour of the security settings for Windows 2000 Server Terminal Services. I pointed out how you should configure the Microsoft Management Console (MMC) Terminal Services Configuration snap-in to secure the settings for remote administration. Terminal Services is a great way to remotely administer your servers using the Internet. But even if you securely configure Terminal Services, your systems are still exposed to attack—especially to attackers who attempt to guess your administrative passwords. Here, in Part 4, I’ll show you how to use the IP Security (IPSec) protocol to wrap a final layer of security around your server.

Introducing IPSec
In general, IPSec is a great protocol because it provides packet-level integrity, authentication, and encryption. However, the real value of Win2K’s integrated implementation of IPSec is its incredible power and versatility as a tool for network security. To secure Terminal Services, you need to know how to configure IPSec so that your systems reject any unauthorized attempt to connect to Terminal Services at the network level before the attempt reaches Terminal Services. Once you've set up an authorized, secure IPSec connection between your client and your server, IPSec will encrypt all subsequent Terminal Services traffic and also inspect each packet before passing it on to Terminal Services, making sure that the packet really came from your authorized client computer and that no one modified the data in transit. In this scenario, we’ll configure a Web server to let you use your laptop to administer Terminal Services remotely over the Internet. We’ll assume that the Web server is already set up securely and that Terminal Services has been installed securely as described earlier in this series of articles. We’ll also assume that the Web server is exposed directly to the Internet, or that if a firewall is protecting the Web server, that TCP port 3389 is open. (Terminal Services uses port 3389 for communication between the client and server.) . . .