Azure Windows 虚拟机 RDP 安全

Question

Hello & many thanks in advance.

I'm a complete beginner with Azure and have followed the tutorial in creating a VM. I access it via RDP.

I switched on the event logger and I can see that there are multiple attempts to try and login into the admin account every couple of seconds or so.

Just wondering if there is a way to secure against this?

Thanks

Will

Answer 1

There are multiple ways to secure, take a look at below;

https://docs.microsoft.com/en-us/azure/security/fundamentals/iaas#restrict-direct-internet-connectivity

Answer 2

There are several different things to consider here. First, we should identify what specifically makes RDP a favorite target of cyberattacks.

The biggest known weakness of RDP is that is requires open ports, the default values of which are widely known. This is why you are seeing all those login attempts. Cybercriminals are constantly scanning port 3389 on every know IP address to find a vulnerability. The best thing you can do here is to change the default port to something else.

Secondly, RDP passwords requirements are often not enforced. A McAfee report found that the most common passwords for vulnerable RDP services were “123456” and “password.”

Finally, and perhaps the most frustrating is that RDP is just a really old protocol not designed for the modern internet. There is a laundry list of known RDP vulnerabilities, for which many organizations simply neglect to address.

There are a few things you can do as a savvy admin:

1. Change your RDP port
2. Put your RDP server behind a firewall and/or a VPN
3. Enable strong password requirements
4. Enable multi-factor authentication
5. Apply all available security patches
6. Use a modern zero-trust access service like Twingate, Perimeter 81, or Zscaler to limit access and detection by unauthorized users.

I tried to cover these topics in a blog post I wrote for my company (Twingate), which provides a fairly good summary of the situation and some other ideas to secure your RDP server. Hope this is helpful!