Hacker News Reader

Comment by qsort | Hacker News Reader

It's very good at being a remote _desktop_ protocol, but the fact that it lacks features like tunneling and that authentication is the usual MS mess makes me wish they just went with SSH as transport protocol.

View on HN

> that authentication is the usual MS mess

You mean seamless integration with AD and supports smart cards?

> makes me wish they just went with SSH as transport protocol.

RDP predates OpenSSH by a year.

OpenSSH is an implementation, SSH is a technology and/or protocol, it doesn't make a lot of sense to compare them that way. Although from later comments RDP seems to have a history in Citrix prior to it's life as RDP, so there are likely clear reasons why it didn't use the SSH protocol (namely that the underlying technology RDP was built on does predate the SSH protocol).

According to Wikipedia, RDP = June 16, 1998 SSH = 1995. OpenSSH = 1999

RDP is based on Citrix ICA which builds on Citrix Multiuser released in 1991 for OS/2, and 1992 for DOS, 1993 for Windows.

https://www.basvankaam.com/2017/03/29/a-lesson-in-history-th...

The Citrix/Microsoft relationship is a bonkers story. The world didn't yet know that licensing your tech to Microsoft meant you were going to grab your ankles.

In the several decades since, nothing has stopped them from coming out with a "RDP v2."

I trust SSH to be public-facing. Don't have the right private key? Pound sand. You're not getting in.

I trust RDP to allow someone to break into my machine, get admin privileges, and infect / bot it, likely in under an hour.

Smart cards rolls eyes

Smart cards is just certificate-based authentication really.

Microsoft did indeed fail hard - if they just made certificate authentication easy to configure on stand-alone machines like SSH key authentication is (and allow to keep the key as a file if desired, instead of in a smart card), a lot of pwnage would've been avoided.

You can set up RD Gateway to leverage MFA.

https://learn.microsoft.com/en-us/entra/identity/authenticat...

That’s why you have an vpn or the rdp gateway instead of exposing the machines directly to internet.

Iirc you can enable Remote Desktop and block public access and connect over an SSH tunnel. Newer versions of Windows include an SSH server.

> lacks features like tunneling

TCL over RDP is technically barely possible with a ridiculously custom client and a server-side stub:

https://rdp2tcp.sourceforge.net/

Yeah I messed with that. Sidechannel DLLs for RDP aren't fun. XFreeRDP actually also supports that on Linux.

I used it for signalling phone calls from the client to an RDP RemoteApp and initiating calls from the RemoteApp.

I would decline that project if I was asked today.

Sometimes i'm using remote desktop inside a remote desktop, and it amazes me every time that it works so well, like there's no visible performance penalty or quality degradation in that. So yes, maybe it doesn't tunnel TCP but does the main task pretty well. And TCP can be tunneled with ssh, which also does its thing very well. Bitvise SSH client (a great application BTW) has a nice feature that allows you to open tunneled RDP connection to the machine where you're connected via ssh, with a single button click and without the need for another authentication. Plus all the TCP tunneling you need. Highly recommended.

I remote desktop from my Mac into Windows for work. I used to then remote from that Windows into another Windows server, at which point figuring out what the keyboard mappings were became extremely difficult!

Do you not remember the Microsoft of the late 1990s?

We’re lucky it didn’t cost $250/seat. And we’re luckier that it’s effectively an open protocol, today, though there are still license considerations if you are reaching into Windows.

I was a remote system admin BEFORE Remote Desktop. It was not fun. I would have gladly paid $500/seat at the time for RDP, if that’s what it cost.

Weren't there any other solutions? (Searching ...) Norton? Citrix? VNC?

None worked well at all. They existed, and I tried them, but they were all either unreliable or unusable because of their bandwidth requirements coupled with 56k modems.

There was no good solution for this until RDP came along.

Windows does support SSH now, so maybe you could rig RDP-over-SSH yourself with port forwarding.

RDP-over-SSH will break Kerberos authentication for two reasons: 1) you'll point the RDP client to localhost and a random port and 2) you won't get a KDC line-of-sight. The irony is Microsoft has demoed this with SSH over Azure Arc, which can only result in an NTLM downgrade.

IronRDP is designed to work with Devolutions Gateway (https://github.com/Devolutions/devolutions-gateway) for just-in-time RDP connections made from the web or through the desktop client. Devolutions Gateway also supports just-in-time KDC proxying alongside the main RDP connection, making Kerberos possible.

You can install the free standalone web access package of Devolutions Gateway to try it out, it will give you a simple web interface where you can enter the hostname, username and password.

But if you really want the simplest solution, it's with the rest of the Devolutions stack with Remote Desktop Manager and Devolutions Server. In the end, you'll be able to make RDP connections from RDM or through the web with just a double-click, and it'll automatically generate short-lived tokens and make RDP + Kerberos work seamlessly: https://devolutions.net/gateway/

Kerberos has a protocol for when you don't have a line of sight to the KDC: IAKERB. IIRC MSFT is very interested in it in order to kill off NTLM finally.

IAKerb still hasn't shipped - it's a preview feature. Meanwhile, we've been doing KDC proxying successfully in Devolutions Gateway for several years. Sometimes you can wait forever for a supposedly better solution, or you can just make it work in the most obvious way. In the end, all you need is to forward KDC messages, right? It's annoying that it's out-of-band, but the KDC proxying protocol is just an HTTP POST that takes a request message, and sends the response message back.

Right, but while I know a lot about Kerberos I know very little about AVD. Does Microsoft expose an HTTPS proxy for the KDCs?

You need to deploy the KDC proxy yourself, and then add it to the .RDP file options in your AVD feed. It's not something that works out of the box: https://learn.microsoft.com/en-us/azure/virtual-desktop/key-...

Aha. Thanks!

Here's RDP over ssh, per one commenter:

https://news.ycombinator.com/item?id=43441584

RD Gateway leverages SSL for encrypted transport for RDP between client and host. Maybe it is possible :-)

RD Gateway has nothing to do with tunneling, it's just a reverse proxy for RDP connections. Funny note: as you've mentioned in other comment, my guess is that RDG was also licensed from Citrix but at the later point.

Reply on news.ycombinator.com