I have the pleasure of teaching introductory Linux Administration at a local college. During class, students raised the question of relative security between SSH and RDP, as protocols for remote server management. I responded based on my general understanding of the protocols (I’ve always considered SSH to be generally more secure), but I felt this was worth further investigation. This is a quick summary of my findings.
RDP has come a long way since its early days, when it was trivial to compromise via network traffic sniffing / man in the middle attacks. As of RDP 6.0, Microsoft introduced additional security features around data encryption and mutual authentication that significantly improve the security of RDP. When an administrator enables the highest level of security (FIPS-compliant) on the remote desktop host, very secure encryption algorithms are used. These features are configurable on the server, so it is still possible to create a less-than-secure RDP scenario.
Configuration recommendations for increased security:
- Force NLA, which uses CredSSP to secure the authentication process
- Set the encryption level to 4 (FIPS compliant), which uses 3DES and SHA-1 for bidirectional traffic encryption
- Alternatively use encryption level 3, traffic is encrypted with 128-bit RC4 and MD5/SHA-1, which should be sufficient for most environments.
One big caveat – this was written specifically within the context of remote server administration. Further recommendations are appropriate for a complete remote desktop / remote application solution built on Microsoft RDP, for example deploying a Remote Desktop Gateway with certificates issued by a trusted third party.
- Microsoft RDP specification, security levels configurable on the server
- NLA / CredSSP
Secure Shell (SSH) was created as an encrypted network protocol, with security as a first priority. It is highly secure. Authentication is based on public key cryptography, and data is encrypted using one of many well-established secure algorithms. The DigitalOcean article below provides an excellent, clear and easy to read description.
- Use key based authentication and disable password-based authentication
- Many secure encryption ciphers are supported. Be aware of which algorithms are enabled on your servers.
- Excellent article that covers details of the SSH protocol and some basics of network traffic encryption
- Wikipedia entry on Secure Shell (SSH)
- Discussion on tunneling RDP traffic over a SSH connection
Windows and SSH
As an additional point of interest, Microsoft has announced plans to introduce SSH support via the PowerShell team.
We actually published an updated roadmap for the OpenSSH port here: blogs.msdn.com/…/10648817.aspx
Per that roadmap, we still hope to deliver a production-quality Windows port of OpenSSH within the first half of 2016.
My goal here was to compare the methods used to secure RDP vs. SSH.
Certainly the usage of Microsoft RDP and SSH have some important differences. There are several interesting discussions about why comparing RDP, SSH, and other remote management technologies is a matter of apples to oranges. These are my two favorite write-ups that discuss this topic in depth: