Use SSH for Secure RDP Connections

In my article “Securing RDP” (June 2006, InstantDoc ID 50040), I showed you how to use Secure Sockets Layer (SSL) to connect to a server via Remote Desktop Protocol (RDP), the Microsoft proprietary protocol for Windows Terminal Services. This configuration provides security, but I also explained that SSL can’t guarantee that only trusted clients can connect to a server via RDP. Now, I’ll show you a way to connect even more securely by confirming the identity of both client and server. You do so by using a private/public key pair through a Secure Shell (SSH) gateway.

In the sample SSH implementation I'll walk you through, the SSH gateway is hosted on the RDP server. The RDP server is a Windows Server 2003 domain controller (DC) administered remotely. (Hosting the SSH gateway and RDP server on the same machine can potentially allow users, after they’ve been authenticated by Windows, to gain access to other services. If you want to ensure that access is granted only to RDP port 3389, you must host the SSH gateway on a separate machine and use a firewall to control access between the gateway and RDP server.) . . .