Усиление безопасности подключения к терминальным службам WS2008

В этой записи рассказывается о нововведениях в терминальных службах Windows Server 2008, направленных на усиление безопасности. В стандартной поставке Windows XP с использованием этих нововведений возникнут проблемы, я расскажу, как их решить.

Начиная с Windows Server 2008 значительно повышена безопасность подключения к службам терминалов за счет использования двух технологий: SSL и NLA.

SSL

Шифрование SSL применяется не только для защиты трафика от перехвата, но и для удостоверения подлинности сервера терминалов, к которому подключается клиент. Для этого на сервере должен быть установлен сертификат компьютера. Такой сертификат устанавливается на все компьютеры автоматически, если они являются членами домена и в домене развернуты службы сертификации. Но можно выдать и установить такой сертификат вручную.

При подключении клиента к терминальному серверу с включенной защитой SSL проверяется сертификат сервера: он должен быть выдан доверенным центром и подключение должно осуществляться к тому же адресу, что и заявлен в сертификате. В этом случае клиент не получит никаких предупреждений. Если же сертификат не признается довернным, либо адрес сервера отличается, клиенту выдается предупреждение. Таки образом трафик не только шифруется, но и защищается от атаки типа «человек посердине».

NLA

Network Level Authentication направлена на защиту терминального сервера от атак на отказ в обслуживании. Эта технология запрашивает авторизацию пользователя средствами самого клиента RDP в самом начале подключения. Если авторизация не проходит, сервер не напрягается рисовать окно входа в систему и выполнять прочие связанные с этим действия. Это особенно актуально, если такой терминальный сервер доступен из интернета.

Совместимость с клиентами

Чтобы успешно подключаться к терминальному серверу, на котором активированы обе технологии, необходим терминальный клиент, поддерживающий протокол RDP 6.1. Этот протокол поддерживается клиентами, идущими в комлекте с ОС начиная с Windows Vista. Для Windows XP необходим установленный SP3 (либо обновление KB952155 для SP2) и кое-какая дополнительная настройка, описанная в статье KB951608.

Для включения поддержки CredSSP (через которую работает NLA) в RDP клиенте Windows XP необходимо внести следующие изменения в реестр:

  • в параметре:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
    добавить строку со значением:tspkg
  • в параметре:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders
    добавить строку со значением:credssp.dll

Для вступления изменений в силу нужно перезагрузить компьютер.

В недавно вышедшем Windows Server 2008 R2 протокол RDP обновлен до версии 7.0. Полная его поддержка встроена в Windows 7, для Windows Vista и Windows XP необходима установка обновления KB969084.

33 ответа к «Усиление безопасности подключения к терминальным службам WS2008»

  1. I wish to voice my admiration for your kindness supporting those who should have help with that issue. Your real dedication to passing the message along became unbelievably helpful and have surely empowered associates just like me to get to their ambitions. Your own useful facts entails much a person like me and a whole lot more to my colleagues. Many thanks; from all of us.

  2. I together with my buddies happened to be following the great tips on your site and so instantly I got a horrible feeling I had not expressed respect to the web blog owner for those secrets. Those guys had been certainly glad to study all of them and have now clearly been taking advantage of them. I appreciate you for genuinely very kind and for figuring out this form of superior subject areas millions of individuals are really desirous to discover. My honest apologies for not saying thanks to sooner.

  3. I want to voice my affection for your kindness in support of folks who actually need assistance with this subject. Your real dedication to getting the solution all over had become quite important and have always allowed women like me to achieve their aims. Your amazing important tutorial indicates much a person like me and extremely more to my office workers. Thank you; from each one of us.

  4. Needed to compose you one tiny word to thank you very much once again regarding the stunning things you have shown above. It’s simply open-handed with people like you to give freely what most people would’ve offered for sale as an electronic book to help make some bucks on their own, especially given that you might well have done it in case you wanted. The secrets additionally served to become easy way to comprehend the rest have similar zeal similar to my very own to grasp many more when considering this matter. I’m certain there are lots of more fun instances up front for individuals who look into your blog.

  5. Thanks so much for giving everyone a very superb chance to read from this site. It is always very good and also jam-packed with amusement for me personally and my office colleagues to search your blog particularly thrice in one week to read through the latest stuff you will have. And indeed, I am just at all times fascinated with your fabulous guidelines you give. Selected 3 areas in this article are clearly the most suitable I’ve had.

  6. Thanks for every one of your work on this web site. Gloria delights in carrying out investigation and it’s really easy to see why. A number of us hear all regarding the lively medium you give invaluable thoughts via your website and even increase contribution from people on the matter then our favorite daughter is in fact learning a great deal. Take advantage of the remaining portion of the new year. Your conducting a good job.

  7. Thanks for all your valuable hard work on this site. My mom really loves going through investigation and it’s easy to understand why. Most people hear all relating to the powerful ways you deliver important strategies by means of the website and in addition attract response from people on the content plus our own daughter has always been discovering a great deal. Have fun with the rest of the year. You are always conducting a terrific job.

  8. I simply desired to appreciate you once again. I am not sure what I could possibly have followed without those strategies revealed by you over my field. It absolutely was a very depressing circumstance in my view, nevertheless viewing a specialised form you handled the issue forced me to cry with joy. I’m thankful for your assistance and as well , hope that you comprehend what a great job your are accomplishing training many people using a site. More than likely you’ve never come across any of us.

  9. Thanks so much for giving everyone remarkably marvellous chance to check tips from this web site. It is always so amazing and jam-packed with fun for me personally and my office colleagues to search your website a minimum of thrice in 7 days to see the latest items you will have. Of course, we are certainly fulfilled with your breathtaking inspiring ideas you give. Selected 3 tips in this posting are undoubtedly the most suitable I’ve had.

  10. Thanks a lot for providing individuals with an extraordinarily breathtaking possiblity to discover important secrets from this website. It really is very superb plus full of a lot of fun for me personally and my office co-workers to search your blog at a minimum thrice a week to see the new guides you will have. Not to mention, I’m at all times contented for the good pointers served by you. Selected 1 points in this article are ultimately the most efficient we’ve ever had.

  11. I have to show my appreciation to you for bailing me out of this type of setting. Right after checking throughout the online world and coming across ways that were not beneficial, I figured my life was gone. Living without the approaches to the issues you’ve solved through this blog post is a serious case, as well as those which could have in a wrong way affected my entire career if I had not encountered the website. Your good training and kindness in playing with all the stuff was very helpful. I don’t know what I would have done if I hadn’t come across such a point like this. I’m able to now relish my future. Thank you so much for the reliable and effective help. I will not hesitate to endorse the blog to any individual who would need recommendations about this issue.

  12. That is the appropriate weblog for anybody who desires to find out about this topic. You understand so much its virtually hard to argue with you (not that I actually would want匟aHa). You positively put a new spin on a topic thats been written about for years. Great stuff, just nice!

  13. There are some attention-grabbing cut-off dates on this article however I don抰 know if I see all of them center to heart. There may be some validity however I will take maintain opinion until I look into it further. Good article , thanks and we wish more! Added to FeedBurner as effectively

  14. That is the best blog for anyone who desires to search out out about this topic. You realize so much its nearly arduous to argue with you (not that I truly would need匟aHa). You definitely put a brand new spin on a subject thats been written about for years. Nice stuff, just great!

  15. Aw, this was a really nice post. In idea I would like to put in writing like this additionally ?taking time and precise effort to make a very good article?however what can I say?I procrastinate alot and certainly not seem to get one thing done.

  16. The subsequent time I read a weblog, I hope that it doesnt disappoint me as much as this one. I mean, I know it was my choice to read, however I truly thought youd have something attention-grabbing to say. All I hear is a bunch of whining about something that you can repair for those who werent too busy searching for attention.

  17. Good post. I study one thing more difficult on totally different blogs everyday. It can at all times be stimulating to read content from other writers and practice a little one thing from their store. I抎 desire to make use of some with the content on my weblog whether you don抰 mind. Natually I抣l provide you with a hyperlink on your web blog. Thanks for sharing.

  18. Hiya! I just wish to give a huge thumbs up for the good info you have got here on this post. I will likely be coming back to your blog for more soon.

  19. Youre so cool! I dont suppose Ive read something like this before. So nice to seek out anyone with some unique thoughts on this subject. realy thank you for beginning this up. this website is something that’s wanted on the net, someone with somewhat originality. useful job for bringing something new to the web!

  20. Youre so cool! I dont suppose Ive read anything like this before. So nice to search out any individual with some original thoughts on this subject. realy thank you for beginning this up. this web site is one thing that’s needed on the net, somebody with just a little originality. useful job for bringing one thing new to the web!

  21. There are some fascinating deadlines on this article however I don抰 know if I see all of them heart to heart. There may be some validity but I’ll take maintain opinion until I look into it further. Good article , thanks and we would like extra! Added to FeedBurner as properly

  22. Needed to send you this very little note so as to thank you so much over again considering the pleasant strategies you have featured above. It is really wonderfully generous of you to give openly exactly what a few individuals could have sold as an e book to get some bucks for their own end, even more so now that you might have done it if you ever desired. These tricks also acted as a good way to realize that other individuals have a similar zeal just like mine to know somewhat more on the subject of this matter. I know there are some more pleasant occasions in the future for folks who start reading your blog post.

  23. I together with my friends were reading the great advice from the website and so immediately I got a horrible feeling I never thanked the web blog owner for those techniques. These people came certainly glad to learn all of them and now have undoubtedly been loving them. I appreciate you for indeed being simply considerate and also for selecting certain marvelous tips millions of individuals are really desirous to be informed on. Our sincere regret for not saying thanks to you sooner.

  24. I wanted to put you this very little remark so as to thank you so much yet again considering the fantastic ideas you’ve contributed here. It was pretty open-handed with you in giving without restraint exactly what a lot of folks could have marketed for an electronic book to earn some money on their own, specifically given that you could have done it in case you decided. The tactics also worked like a great way to be aware that some people have the same dreams like my very own to figure out a great deal more when considering this matter. I think there are a lot more enjoyable periods ahead for individuals who see your site.

  25. What’s up i am kavin, its my first time to commenting anywhere, when i
    read this paragraph i thought i could also make comment due
    to this sensible post.

Добавить комментарий

Ваш адрес email не будет опубликован. Обязательные поля помечены *