29

Does anything exist for Windows RDP (Remote Desktop Protocol) that is similar to SSH (in Linux) Public/Private key authentication (Instead of leaving normal password authentication open)?

I'm finding conflicting answers to this topic around the internet. I'm hoping to be able to just distribute a private key to client devices instead of using a complex password on every login (assuming I do not want to eventually disable password authentication totally).

Improve this question
1
  • 2
    By refusing to incorporate a connection protocol that specifically prevents password-guessing, the halfwits at Redmond require that the remote machine be strictly no more secure than a machine infested with their insecure bloatware. Why am I not surprised when MSFT fails on the datasec front?
    – GT.
    Jul 30, 2016 at 5:08

2 Answers 2

Reset to default
7

Remote Desktop supports X.509 client certificates, under the "smart-card authentication" name. Despite the name, it should work with locally-installed certs/keys (i.e. without an actual smart-card). Though it does however require an Active Directory domain, as far as I know.

So, sort of but not really in a way that's useful to you.

Improve this answer
1
  • 2
    Would you like to expand it a little... Is it without RDP Gateway?
    – g2mk
    Jan 22, 2016 at 11:02
1

Without an AD domain, a possibility to prevent simple username & password access would be:

  1. Installing OpenSSH for Windows (from https://github.com/PowerShell/Win32-OpenSSH/releases or on Windows 10 & 2019 it's an available feature),
  2. Using an SSH client to log on with keys,
  3. Disabling password authentication over SSH (uncomment and set "password authentication" to "no" in %ProgramData%\ssh\sshd_config),
  4. If you need the graphical interface, configure your SSH client to tunnel RDP over SSH (https://www.saotn.org/tunnel-rdp-through-ssh/),
  5. Disabling "regular" RDP traffic (TCP port 3389) over the network (not on local Windows Firewall!) so that password logon can't be used.

There might be better options for a few $$$. I've heard of Yubico's solution for example (with hardware token): https://support.yubico.com/support/solutions/articles/15000028729-yubico-login-for-windows-configuration-guide

Improve this answer
3
  • 1
    That Yubico page 1. refers to a TWO factor solution that starts with a password. I believe the question is about NOT using a password. 2. Doesn't say anything about RDP. Did you have a different Yubico product in mind?
    – MarcH
    Nov 27, 2019 at 18:27
  • 4
    This tunnelling solution seems to adds an ssh key requirement on top of the regular, password-based RDP authentication, correct? Interesting and more secure but I believe the question is about replacing the inconvenience of a password with private key.
    – MarcH
    Nov 27, 2019 at 18:31
  • maybe auto login or no password on the rdp side
    – alex
    Sep 3, 2022 at 3:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .