Answers: <p>You can add, if it's not already the case, a frontal, rev proxy, to prevent direct access to the TS. This could also add an authentication layer...
  I am not a lot in Microsoft stuff so this is really a basic advice.
  If TS allow the use of pubkey instead of passwd this would be a good addition too. </p>
  
Answers: CC BY-SA 4.0
Answers: 2019-05-31T09:48:37.433Z
Answers: 2019-05-31T09:48:37.433Z
Answers: Pier
Body: <p>Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this). </p>
  
  <p>We currently restrict the IP range that can access this port. Is this enough for security? This article mentions never globally exposing this port: <a href="https://www.grc.com/port_3389.htm" rel="nofollow noreferrer">https://www.grc.com/port_3389.htm</a></p>
  
Tags: <amazon-web-services><security><ports>
Title: How can I expose port 3389 using a secure approach
UserDisplayName: Wunderbread
ThreadText: # How can I expose port 3389 using a secure approach
  
  (Asked by: username_0 on 2019-05-30)
  
  Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this).
  
  We currently restrict the IP range that can access this port. Is this enough for security? This article mentions never globally exposing this port: <https://www.grc.com/port_3389.htm>
  
  **Tags:** amazon-web-services, security, ports
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-05-31. Score: 2
  
  You can add, if it's not already the case, a frontal, rev proxy, to prevent direct access to the TS. This could also add an authentication layer...
  I am not a lot in Microsoft stuff so this is really a basic advice.
  If TS allow the use of pubkey instead of passwd this would be a good addition too.
  
  
  ---
  
  