I am a dev with little admin expertise, administering a single dedicated web server remotely.
A recent independent security audit of our site recommended that "RDP is not exposed to the Internet and that a robust management solution such as a VPN is considered for remote access.
When used, RDP should be configured for Server Authentication to ensure that clients cannot be subjected to man-in-the-middle attacks."
Having read around a bit, it seems like Network Level Authentication is a Good Thing so I have enabled the "Allow connections only from Remote Desktop with NLA" option on the server today.
Is this acion enough to mitigate the risk of a Man-in-the-Middle attack? Or are there other essential steps I should be taking? If VPN is essential, how do I go about it?
Best Answer
You really should not have RDP open to the world, even with NLA on. NLA does cut down on MITM attacks, but if you are using the default self-signed certificate for RDP access, you're not all too secure.
One of the main reasons that you don't want to leave RDP open to the world is to prevent automated password cracking attempts. If you remove RDP from Internet-facing interfaces, you completely mitigate random, automated brute-force attacks. Putting something like a VPN in place for remote access is both highly recommended and useful.
There are many ways that you can implement a VPN. Windows has a built-in IPSEC VPN, for example. OpenVPN Access Server is also free for up to two concurrent users if you want to go the SSL VPN route.
If you need very specific instructions on how to set up a VPN, then you need to research the options, pick a technology, read the documentation, and then open a new question with any concerns or issues that you have implementing it. Just asking "How do I implement a VPN" is much too broad for Server Fault.