Re: TLS/FIPS for Terminal Services and RWW in SBS 2003

wigital — Mon, 18 Feb 2008 14:07:25 GMT

Thanks David

Yes.. I did assume the use of TSWEB. I figured Microsoft would re-use code and I knew of no other way to access Terminal Services through the browser.

Thanks for taking the time to call Microsoft. The phone call is way more than I expected. I also appreciate the clarity on the response.

If I understand the implications of your post, even though the logon to RWW is secured using SSL... both the authentication to TS and the TS session that result from using the Connect to Server Desktop link are potentially *quite literally* unsecured (as the wrapper indicates). The question is: does this Proxy session launch some sort of RPC over HTTP type connection outside the context of RWW SSL session? I note (in your reply) that it is invoked using the same worker process but I'm not at all clear if the resulting traffic is still being routed via Port 443 HTTPS and then hitting the Terminal. The client is (after all things) given another logon screen for the Terminal???

Personally, I will be utilizing a direct RDP connection TLS/FIPS instead of RWW to Connect to Server Desktop.

Thanks so much for your excellent response. Nice to meet you BTW

warm regards,
Mark

TLS/FIPS for Terminal Services and RWW in SBS 2003

wigital — Wed, 13 Feb 2008 16:46:32 GMT

Hi David,

I had a question about connect to Server desktop through the RWW

Two methods to connect in SBS using Terminal Services for Remote Administration
1 - Terminal Services RDP 3389
2 - connect to Server desktop (which uses tsweb through the Remote Web Workplace)

In experimenting with SBS Remote Administration I discovered an unusual circumstance in which you CANNOT set the Terminal Services Connection to TLS/FIPS compliant encryption and still access the SBS computer through RWW.

So to explain:
*I used Terminal Services Configuration
*loaded a certificate
*in the Terminal Services Connection Properties, General TAB:
**Set Security Layer to SSL
**Set Encryption Level to FIPS compliant

NOW... connecting to the SBS server using RWW connect to Server Desktop does not work

SOLUTION... in the above walkthrough, change Security Layer to NEGOTIATE. This allowed the RWW session to negotiate it's own encryption level without affecting connections using Terminal Services Client RDP/RDC on 3389 directly. Remote Desktop Connections can still be made over 3389 and they are secure (you see the little lock symbol). With RDP/RDC, the certificate can be viewed and believe RDC 6.0 negotiates highest possible encryption.

My question is this:

When connecting to Server desktop using RWW, the wrapper indicates there is no encryption what-so-ever. (i.e. No LOCK symbol, no certificate can be viewed, etc...) DOES TSWEB THROUGH THE RWW WEBSITE USE A CERTIFICATE AND NOT INDICATE THAT -OR- DOES IT LAUNCH A CONNECTION ON PORT 3389 FROM THE RWW INTERFACE USING TSWEB, AND!!! IS THIS CONNECTION UN-ENCRYPTED?

Thanks,
wigital

PS.. made a blog entry on the subject here
http://wintivity.wigital.net/?p=14

PPS.. thanks for the blog post about the live space

Search results by user ID 3046

Re: TLS/FIPS for Terminal Services and RWW in SBS 2003

TLS/FIPS for Terminal Services and RWW in SBS 2003