Hacker News Reader

Comment by technion | Hacker News Reader

As someone who supports a lot of Windows environments - yes, it's incredible the rate at which this occurs. I'd strongly point people at the RD Gateway MFA plugin as a requisite for publishing RDS these days:

https://docs.microsoft.com/en-us/azure/active-directory/auth...

It's also supported to publish behind the Azure App Proxy, avoiding the need for any port forwards at all:

https://docs.microsoft.com/en-us/azure/active-directory/app-...

View on HN

> I'd strongly point people at the RD Gateway MFA plugin

Is this working well? I've tried setting this up a few weeks ago and found it to be somewhat brittle. The MFA requests would sometimes be delayed long enough that the GW would timeout. I've tested this on Windows 2022.

I've a whole range of clients running it without an issue.

I will say however, the only MFA it supports is push (ie, TOTP doesn't work), and if you're not familiar with that, be aware many Android installations snooze that app and the push doesn't work unless you specifically have the app open at the time you logon.

We’ve been using it for years and it’s always been irritating in the way you describe. It seems if you miss the first push notification, you’ll receive a flurry more, many of which don’t really seem to do anything even if you do approve them. It’s possible that I have the timeouts set incorrectly, but I’ve followed Microsoft’s guidelines. Unfortunately we don’t have a better solution, so we suffer with it.

We use Rublon for adding MFA to Remote Desktop and other VPNs too and it works very well. It’s not an over engineered monstrosity like Microsoft solutions.

You'd recommend a standard trick like changing the port? Just doing that dropped the number of attempts to almost zero here.

I think that's down to the problem you're trying to solve. Much like SSH brute force, if you know the only account is yours and it has an appropriately reasonable password and you can trust yourself not to get phished (say, you have a system managing the logon) then that's probably fine.

The second there are other people with dumb passwords, or many other risk factors at play, I'd really suggest you need something doing MFA which unfortunately, MS doesn't offer out of the box on RDP.

You never know which 0-day gets discovered tomorrow, so even strong password might not be enough. I always change default ports on both SSH and RDP. It helps falling out of scope of unsofisticatrd scanners, keeps logs a bit cleaner plus doesn't waste CPU on useless auth attempts. Keeping ports behind VPN or port knocking is even better, but not always feasible

Reply on news.ycombinator.com