2

Wonder if anybody can give me a steer on this. We use RDS quite heavily but I would like to enhance the security of it, VPN is an option but I would prefer to avoid if possible.

Ideally what I'd like to do is continue using the native RDS client (so not RDWeb if I can avoid) but enforce client certificate authentication as well as username/password. We have a CA etc. so getting client certs out there would not be a problem.

This seems like something the RD Gateway should be able to achieve fairly easily over HTTPS, but I cannot find much info online about it at all. There are threads like this one - Connect to Windows Server 2012 with valid client certificate only? - stating that it is possible with RDCAPs however from what I can tell a CAP cannot do this, but maybe I'm mistaken.

So really looking to see if anybody has done it before?

The other option is the likes of DuoSecurity, but I'd sooner client certs which would drop the TLS session very early if a user cannot provide the cert, rather than let it progress further (larger attack vector further up the stack) before rejecting them.

Thanks for any thoughts!

0

You must log in to answer this question.

Browse other questions tagged .