| 1 | <?xml version='1.0' encoding='UTF-8'?>
|
|---|
| 2 | <!DOCTYPE topic PUBLIC "-//OASIS//DTD DITA Topic//EN" "topic.dtd">
|
|---|
| 3 | <topic xml:lang="en-us" id="vrde-crypt">
|
|---|
| 4 | <title>RDP Encryption</title>
|
|---|
| 5 |
|
|---|
| 6 | <body>
|
|---|
| 7 | <p>RDP features data stream encryption, which is based on the RC4 symmetric cipher, with keys up to 128-bit. The RC4
|
|---|
| 8 | keys are replaced at regular intervals, every 4096 packets. </p>
|
|---|
| 9 | <p>RDP provides the following different server authentication methods: </p>
|
|---|
| 10 | <ul>
|
|---|
| 11 | <li>
|
|---|
| 12 | <p><b outputclass="bold">RDP 4</b> authentication was used historically. With RDP 4, the RDP client does not perform any checks in order to verify the identity of the server it connects to. Since user credentials can be obtained using a man in the middle (MITM) attack, RDP4 authentication is insecure and should not be used. </p>
|
|---|
| 13 | </li>
|
|---|
| 14 | <li>
|
|---|
| 15 | <p><b outputclass="bold">RDP 5.1</b> authentication
|
|---|
| 16 | employs a server certificate for which the client possesses
|
|---|
| 17 | the public key. This way it is guaranteed that the server
|
|---|
| 18 | possess the corresponding private key. However, as this
|
|---|
| 19 | hard-coded private key became public some years ago, RDP 5.1
|
|---|
| 20 | authentication is also insecure.
|
|---|
| 21 | </p>
|
|---|
| 22 | </li>
|
|---|
| 23 | <li>
|
|---|
| 24 | <p><b outputclass="bold">RDP 5.2 or later</b>
|
|---|
| 25 | authentication uses Enhanced RDP Security, which means that
|
|---|
| 26 | an external security protocol is used to secure the
|
|---|
| 27 | connection. RDP 4 and RDP 5.1 use Standard RDP Security. The
|
|---|
| 28 | VRDP server supports Enhanced RDP Security with TLS protocol
|
|---|
| 29 | and, as a part of the TLS handshake, sends the server
|
|---|
| 30 | certificate to the client.
|
|---|
| 31 | </p>
|
|---|
| 32 | <p>The <codeph>Security/Method</codeph> VRDE property sets the required security method that is used for a connection. You can also change this in the VM Settings, Remote Display tab. Valid values are as follows: </p>
|
|---|
| 33 | <ul>
|
|---|
| 34 | <li>
|
|---|
| 35 | <p><b outputclass="bold">Negotiate.</b> Both Enhanced (TLS) and Standard RDP Security connections are allowed. The security method is negotiated with the client. </p>
|
|---|
| 36 | </li>
|
|---|
| 37 | <li>
|
|---|
| 38 | <p><b outputclass="bold">RDP.</b> Only Standard RDP
|
|---|
| 39 | Security is accepted.
|
|---|
| 40 | </p>
|
|---|
| 41 | </li>
|
|---|
| 42 | <li>
|
|---|
| 43 | <p><b outputclass="bold">TLS.</b> Only Enhanced RDP Security is accepted. The client must support TLS. This is the default setting. </p>
|
|---|
| 44 | <p>
|
|---|
| 45 | The version of OpenSSL used by <ph conkeyref="vbox-conkeyref-phrases/product-name"/> supports
|
|---|
| 46 | TLS versions 1.0, 1.1, 1.2, and 1.3.
|
|---|
| 47 | </p>
|
|---|
| 48 | </li>
|
|---|
| 49 | </ul>
|
|---|
| 50 | <p>For example, the following command configures a client to use either Standard or Enhanced RDP Security connection: </p>
|
|---|
| 51 | <pre xml:space="preserve">VBoxManage modifyvm <varname>VM-name</varname> --vrde-property "Security/Method=negotiate"</pre>
|
|---|
| 52 | <p>If the <codeph>Security/Method</codeph> property is set to either Negotiate or TLS, the server uses TLS if the client supports it. However, to use TLS the server must have the Server Certificate and the Server Private Key. A Certificate Authority (CA) Certificate is optional. </p>
|
|---|
| 53 | <p>If you choose TLS as the security method, <ph conkeyref="vbox-conkeyref-phrases/product-name"/> generates a server key and certificate pair called VRDEAutoGeneratedPrivateKey.pem and VRDEAutoGeneratedCert.pem) for the VM. <ph conkeyref="vbox-conkeyref-phrases/product-name"/> also recreates the auto-generated certificate and key if they are about to expire, or if one or both are deleted or corrupted. </p>
|
|---|
| 54 | <p>To generate a custom server key and certificate pair, with a CA certificate, follow these steps. </p>
|
|---|
| 55 | <ol>
|
|---|
| 56 | <li>
|
|---|
| 57 | <p>Create a CA self signed certificate. </p>
|
|---|
| 58 | <pre xml:space="preserve">openssl req -new -x509 -days 365 -extensions v3_ca \
|
|---|
| 59 | -keyout ca_key_private.pem -out ca_cert.pem</pre>
|
|---|
| 60 | </li>
|
|---|
| 61 | <li>
|
|---|
| 62 | <p>Generate a server private key and a request for signing. </p>
|
|---|
| 63 | <pre xml:space="preserve">openssl genrsa -out server_key_private.pem
|
|---|
| 64 | openssl req -new -key server_key_private.pem -out server_req.pem</pre>
|
|---|
| 65 | </li>
|
|---|
| 66 | <li>
|
|---|
| 67 | <p>Generate the server certificate. </p>
|
|---|
| 68 | <pre xml:space="preserve">openssl x509 -req -days 365 -in server_req.pem \
|
|---|
| 69 | -CA ca_cert.pem -CAkey ca_key_private.pem -set_serial 01 -out server_cert.pem</pre>
|
|---|
| 70 | </li>
|
|---|
| 71 | </ol>
|
|---|
| 72 | <p>Configure the server to access the required files. For example: </p>
|
|---|
| 73 | <pre xml:space="preserve">VBoxManage modifyvm <varname>VM-name</varname> \
|
|---|
| 74 | --vrde-property "Security/CACertificate=path/ca_cert.pem"</pre>
|
|---|
| 75 | <pre xml:space="preserve">VBoxManage modifyvm <varname>VM-name</varname> \
|
|---|
| 76 | --vrde-property "Security/ServerCertificate=path/server_cert.pem"</pre>
|
|---|
| 77 | <pre xml:space="preserve">VBoxManage modifyvm <varname>VM-name</varname> \
|
|---|
| 78 | --vrde-property "Security/ServerPrivateKey=path/server_key_private.pem"</pre>
|
|---|
| 79 | <p>Note that <ph conkeyref="vbox-conkeyref-phrases/product-name"/> does not maintain custom certificates. You are responsible for keeping these updated.</p>
|
|---|
| 80 | </li>
|
|---|
| 81 | </ul>
|
|---|
| 82 | <p>As the client that connects to the server determines what type of encryption will be used, with
|
|---|
| 83 | <userinput>rdesktop</userinput>, the Linux RDP viewer, use the <codeph>-4</codeph> or <codeph>-5</codeph>
|
|---|
| 84 | options. </p>
|
|---|
| 85 | </body>
|
|---|
| 86 |
|
|---|
| 87 | </topic>
|
|---|
