Windows Server 2008: What's New / What's Changed Part #9 of 12: Chapter 8 - Terminal Services
This snippet from Chapter 8 of my new book Windows Server 2008: What's New / What's Changed is brought to you by SAPIEN Press. Get your copy at http://www.sapienpress.com/Windows_Server_08.asp.
Network Level Authentication
Network Level Authentication (NLA) is another new component of RDC v6.0 that effectively rearranges the order in which clients connect to Terminal Servers. Why is this necessary? From a security perspective, the original architecture of how clients connect to Terminal Servers was actually backwards.
Backwards, you say? Think about the "old" mechanism you would go through to connect your client to a remote Terminal Server:
More after the fold...
- You'd enter in the name of the Terminal Server and hit enter. The client would resolve the remote Terminal Server and request a session.
- The remote Terminal Server would open a connection to the client and provide a remote logon screen to the client.
- From this remote logon screen, the user would enter their credentials. If they successfully authenticated, they'd be given a desktop on the server.
But what about the situation where a remote user didn't successfully authenticate? In those situations, after a series of failed attempts the remote Terminal Server would sever the connection. Think about how this is wrong from a security perspective. For nearly every other service in your organization, before you gain access to a resource you must first authenticate to that resource. But here, you're getting a more-or-less direct access to the (remote) console of your Terminal Server without ever authenticating to it. It's akin to saying, "Ah, heck. We'll leave the door to the data center unlocked. They don't have passwords anyway, right?"
Wrong. So, in Vista and Server 2008 Microsoft reversed the order in which clients can connect to Terminal Servers. Before they ever get a remote session, they must first send credentials to the Server and successfully authenticate. What's complicated about the end result is that even though this is a great idea, Microsoft didn't want to necessarily force you into this new model. So, they made it optional. Thus on the server if you navigate to the System Control Panel and select the Remote Settings option, you'll see three options for configuring Remote Desktop.
(Want to read all the posts in this series? Click here.)
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine