EMZETT.
Login

Emzett Wiki

Remote maintenance: using RDP, VNC and remote access securely

Properties1
tagsglossar, it-betrieb, sicherheit

2 min read

Remote maintenance: using RDP, VNC and remote access securely

In short: Remote maintenance programs control computers over the network; RDP, VNC, SSH and services such as AnyDesk are practical, but a frequent entry point when hanging openly on the internet.

In more detail: Support, home office, server administration: remote access saves trips. But it is among the most attacked services (open RDP ports are a classic ransomware entry).

In Depth

Methods

  • RDP (Remote Desktop Protocol, Windows, port 3389): graphical access; enable network level authentication (NLA).
  • VNC: cross-platform, often unencrypted without tunnel (port 5900).
  • SSH (port 22): command line, file transfer, port tunnels; with keys instead of passwords.
  • Services: AnyDesk, TeamViewer, RustDesk (open source), Chrome Remote Desktop, Quick Assist (Windows): connection via broker servers, no port forwarding.
  • Web consoles (iDRAC/iLO/IPMI, Proxmox, Cockpit), remote management (MDM, Intune).
  • Wake-on-LAN to power on.

Using securely

  • Never expose RDP/VNC/SSH directly to the internet; instead VPN (WireGuard) or zero-trust/bastion host.
  • Strong passwords + MFA, account lockout on failed attempts, rate limiting/Fail2ban.
  • Updates (RDP flaws such as BlueKeep were exploited en masse).
  • Access only for authorised people, minimal rights, session logs.
  • Consent in support: the customer confirms the session, watches along, can cancel; mind privacy (access only to necessary content).
  • Scam: fake “Microsoft support” calls making you install AnyDesk → never give strangers remote access, lock the account, police/bank.
  • Check the service provider (location, contract, DPA).

Practice and troubleshooting

  • Connection fails: network/DNS, firewall rules, is the service running?, right port/address, NAT/port forwarding, VPN active?
  • Performance: reduce picture quality/colour depth, bandwidth, encryption (CPU).
  • Multiple monitors, clipboard, file transfer depending on the tool; in companies often blocked (data leakage).
  • Linux desktop: X2Go, NoMachine, xrdp, Wayland restrictions.
  • SSH tunnel (ssh -L 8080:localhost:80 server) for internal web services.
  • Document who accessed when.
  • Data processing agreement if a provider has access to personal data.
  • Home office rules (company devices, VPN, screen lock).
  • IHK exam: pros/cons, security measures, ports (RDP 3389, SSH 22, VNC 5900), difference VPN vs. remote maintenance.
  • Small projects: make Raspberry Pi/home server reachable only via SSH key + VPN.

See also: WireGuard, SSH config, Firewall on Linux, Social engineering

Backlinks