Ed,
A remote accessible system such as Windows Server 2003 with remote
desktop enabled is an easy way to get access like you describe.
Here we have VPN clients connect from the internet to a DMZ where our
remote access system is located. This system (Server 2003) is not on the
domain. After connecting to the system users then have to connect from
the DMZ to LAN on TCP/3389 since we are using Windows remote desktop.
For you to get access to your application server you also simply should
be able to allow access on the port(s) required.
Nick Vaernhoej
"Quidquid latine dictum sit, altum sonatur."
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Edmund
Sent: Tuesday, April 24, 2007 6:16 AM
To: security-basics@securityfocus.com
Subject: Remote Desktop, DMZ
Dear All,
A Remote-Desktop system should be placed within the DMZ,
am I correct?
If that is the case, what if the Remote Desktop
system requires access to an application server; but,
this application server cannot be placed in the DMZ
because LAN users also need access to it?
I've been mulling it over and haven't quite
figured out how or where to put this remote desktop system.
In the DMZ, it will have a hard time being
part of the domain(is this actually necessary?)
or even access an application server (which
is also part of the domain). If I put
the Remote desktop system in the internal LAN,
the risks are not particularly appealing should
the RD system get compromised.
Can someone out there give me some hints/pointers
as to how I might go about in putting a remote
desktop system in an existing network setting?
Thanks
Ed
This electronic transmission is intended for the addressee (s) named above. It
contains information that is privileged, confidential, or otherwise protected
from use and disclosure. If you are not the intended recipient you are hereby
notified that any review, disclosure, copy, or dissemination of this
transmission or the taking of any action in reliance on its contents, or other
use is strictly prohibited. If you have received this transmission in error,
please notify the sender that this message was received in error and then
delete this message.
Thank you.
