Another alternative is to install an SSH client and setup an automatic connection with your server (using a password-less key). Just forward RDP and don't let the user open a shell. I think that's possible via ForceCommand in the sshd config [1]. So if the client machine is hacked, your server will not be compromised.

Disclaimer: I didn't test this, so no guarantee it's 100% secure. Specifying no-pty or Command in the authorized_keys files doesn't seem enough, though.

[1] https://askubuntu.com/questions/48129/how-to-create-a-restri... Check the accepted answer.

Not sure about Bitvise SSH server, thanks for the recommendation though, is that Zerotier works behind firewalls. Don't need to do any port forwarding etc. Very similar to Logmein's Hamachi.

Since their laptop is usually on WiFi behind an ISP-provided router/modem combo this is ideal. Also don't need to force a static IP on the network so the port forwarding rules align properly.

As I say, we're in different countries so this is very handy, it "just works".

Also is secure as nobody can jump onto the virtual network without explicit whitelisting on ZeroTier's Web UI. You have to login (with 2FA) and click a checkbox to allow access if anyone wants to join.

RDP nowadays uses TLS.