It’s pretty bad. You are going to be vulnerable to password spraying at the very least and a phishing email or credential leak, both incredibly common, will result in a bad day.
You need MFA and preferably FIDO based MFA with conditional access.
this post was submitted on 28 Jul 2023
11 points (76.2% liked)
Sysadmin
7717 readers
14 users here now
A community dedicated to the profession of IT Systems Administration
No generic Lemmy issue posts please! Posts about Lemmy belong in one of these communities:
[email protected]
[email protected]
[email protected]
[email protected]
founded 1 year ago
MODERATORS
Yeah, I hate it. I'd want some sort of SAML SSO auth in front of the actual RDS Gateway to allow you to use whatever identity provider and MFA you already have.
You really don't want to allow all manner of auth attempts able to be made against your actual workload servers, which is what it sounds like you are describing.
From what I understand, Remote Desktop Gateway acts as a proxy to route Remote Desktop connections inside a VPC. So authentication will be delegated to the Windows machines, which appears to be outside the scope of Remote Desktop Gateway. I haven't set up Windows on EC2, maybe there's a way to tie authentication to AWS Identity Center to get some form of 2FA or SSO?
The deployment guide mentions that you can use Network ACLs to limit access to the gateway to certain IP ranges, so here's that.
Is there no conditional access for the rds portal?
Time for a CYA email to your manager, project manager, and legal voicing your concerns about the lack of security for an rds Gateway and lack of best practices.
Wide open to the internet.
Secure enough for what?
Hosting critical proprietary data.
On its own, sure. Unlike straight RDP, RD Gateway is meant to be exposed to the Internet.