Secure Windows Remote Desktop - Part 2, Clients

So, you need to tunnel Remote Desktop, and your servers are all set up, right? Good.

Now get Putty.exe for you client computer from HERE and run it.

Fill in your IPCop's host name or public IP and then change the port to 222.

Next, expand Connection, then SSH and select Tunnels.

Add a new forwarded port source 3399 (since this one isn't commonly used) and forward it to the target server's internal IP (NOT the IPCop's IP!) and add a :3389 to the end of the string as in the second figure.

Go back to Session, click Save, and give this connection a name. Click Open, and you will be prompted for a username and password - give these (preferably the remote user we created earlier instead of the dangerous root user) and you will get a prompt. You're done with Putty for now!

Now go to Start, Run, and type mstsc.

Fill in the Server line with localhost:3399 and hit connect. If all been done correctly, you will get a remote desktop on your target machine.

Secure Windows Remote Desktop - Part 1, Servers

The example I give is for a Windows client to connect to a Windows 2003 server behind an IPCop Firewall without granting root access to said firewall. So if a tech needs in, this is a sound way to grant him or her access.

Some background: Microsoft RDP (Remote Desktop Protocol) has vulnerabilities with regards to security and encryption (details are beyond the scope of this post). If we use a protocol that is more secure (namely SSH), then tunnel RDP through the more secure protocol, we wind up with a much more secure implementation.

Requirements:

• IPCop Firewall - or your favorite Linux distro server serving up SSH on a public IP address - I'll only address IPCop, but this can be generally applied.
• Remote Desktop Server (Like Windows XP Pro or Windows Server 2003 - other protocols like VNC will work with this, you just ned to know the required ports to fill in on your Putty Tunnel settings.
• A Windows client with Putty installed (it's easy, just go here -- and download putty.exe)

So, once your IPCop has been set up for SSH (See IPCop docs Here) and remote access to SSH has been granted, you can only log into your IPCop's console as root. Great for you if you are the only one that needs access, but bad if you need to share access as the root user can seriously mudge things up. So we create a new user without root privileges.

SSH to your IPCop as root and sign in.

Create a new user called remote as a member of a new group (also named remote) and use this user for shared remote access. As root, issue the following commands to add the new user:

groupadd remote
useradd -s /bin/bash -g remote -m -k /dev/null remote

The meaning of the command line options (from ifs.vlsm.org):

-s /bin/bash

This makes bash the default shell for user lfs.

-g remote

This option adds user remote to group remote.

-m

This creates a home directory for remote.

-k /dev/null

This parameter prevents possible copying of files from a skeleton directory (default is /etc/skel) by changing the input location to the special null device.

remote

This is the actual name for the created group and user.

To log in as remote (as opposed to switching to user remote when logged in as root, which does not require the remote user to have a password), give remote a password:

passwd remote

Windows XP On an Intel-Based Apple (You're off to Boot Camp, Soldier!

So my best friend bought me Command and Conquer 3 for PC. My newest working PC is a laptop that I bought three years ago, you can't disrespect a decent game like that! So I did what any good (Mac) geek would do - I went to Boot Camp - Apple's Beta tool for installing Windows XP or Windows Vista on any Intel-based Apple computer (yes, even the Mini!) and dual-booting between OS X and XP (or Vista). However, this is a Mephistophilean bargain - you'll need to generously donate some hard drive space for a Windows partition, you'll also need Vista (R) or Windows XP (R) Service Pack 2 full install version. I also feel somewhat guilty for sullying my beautiful Macbook Pro with something so banal as XP Home.

You CAN use an earlier XP full installation CD (I've read that the upgrade can work too, but I haven't played with it) - If (that's a big if) you have an XP CD, a CD Burner, a running Windows XP Machine that can use the burner, - and some time on your hands, check out http://www.applematters.com/index.php/section/comments/how-to-the-curmudgeons-guide-to-boot-camp/, which has links to sites that tell you how to "slipstream" your SP2 and create an XP install CD with SP2.

So how well does it work? Well, ALMOST as well as Windows XP on any PC I've used - I don't know if its a portender of things to come, or just my rotten luck, but I already had a scare where the system wouldn't boot to XP this morning, and I just installed it yesterday! Luckily, after turning it off (it wouldn't respond to key presses), then letting a Scandisk run (it happened automatically because of the "bad shutdown") and fix a single problem (don't remember what it was), it booted fine, and Stan and I had a fight to the death on CnC3, he on his PC, and me on my newly Windows Mac.

Broken Windows Services?

Dial-A-Fix is a tool that can reset many Windows settings back to default, potentially fixing problems caused by spyware, "accidents," and those mysterious failures that seem to happen spontaneously to most Windows machines.

I've successfully used it to fix some nagging problems with Windows Update like the lack of a crawling green progress bar and even update errors. This can also reset your Winsock (Hello LSP Fix!)

Windows Vista: Not Welcome in Nursing Homes

A customer showed me a letter from IVANS today, dated 1-Jan-07. Here's the body of the message:

To: IVANS Customers Using AT&T Global Network Client
From: Paul Tuten, Director, Product Management
Re: T&T GNC Support of Vista

The current versions (5.x.x, 6.x.x) of the AT&T Global Networki Clients are not supported by IVANS/AT&T on Microsoft's new Windows Vista operating system. As such, IVANS does not recommend that you upgrade to the new operating system if you use the GNC until AT&T has released a version that supports the operating system.

AT&T plans to release a new version, 7.0 of the AT&T Global Network Client at the end of the 2nd quarter of 2007, which will provide limited support of the Windows Vista operating system. The specific limitations with 7.0 are that the following features will not be avaialble/will not work in Windows Vista:

• Managed Personal Firewall
• Network Logon Extensions (GINA or PLAP)
• 64-bit operating systems

IVANS will post the General Available (GA) release of AT&T Global Network Client 7.0 to our website www.ivans.com/downloads when available.

If you are required to migrate to the new operating system before the General Available (GA) release of 7.0 version of the client, we may have a workaround for you. Please contact our helpdesk at 1-800-548-2675 to discuss your options.

Vista Listens Real Good (Hack, Hack)

I was browsing DShield.org (a personal favorite, but typically only interesting to network security geeks) and found this nifty article. Apparantly, Vista includes the ability to act on voice commands - a function my Mac has done for ages, but I've never bothered to use.

Someone apparantly asked the question, can "Vista listen to itself?" and the answer is apparantly, "yes." An intrepid hacker, er, erhem, I'm sorry, "Security Researcher," recorded himself issuing voice commands to his Vista computer, then played them back on his Vista PC - lo and behold, it took only minor tweaking to get it to work, including Vista opening a command prompt, and visiting a web site - uh oh, better turn off the voice command if you're using a sensitive machine.

Windows Vista Editions

This new Vista thing has my interest - right now, however, it is purely academic, and I can't truthfully say that I've played with it. This will change soon, I'm sure. In the meantime, I'll tell you why I've not run out and bought Vista:

• It requires too much horsepower. If your computer is less than 2 years old, then you should be fine. The BIOS dates on my three desktop PC's are: 2003 (2.4G Intel laptop currently running SUSE Enterprise Desktop 10.1 and XP Pro), 2002 (1.8G desktop currently running OpenSUSE 10.0), and 1999 (750 MHz PIII desktop running XP Pro) - I'm pretty happy with all three's performance and can't see a reason to upgrade . However, a Macbook Pro 2.16G is about to join my herd, and I will be buying a copy of Vista Ultimate to go on it.
• Currently no software that runs exclusively on Vista, and many current softwares (like iTunes) may have problems on Vista.
• It's too new. Like any OS, the best time to get it is after the 1st service pack comes out.
• No free stuff and no MS Mega-Promotions, just saw a totally disappointing interview of Bill Gates by John Stewart on the Daily Show, after which, Bill hustled out, not sitting and chatting like typical guests. When XP came out, I got as a premium for running out and buying XP on its release day: a 256MB DIMM, an MP3 player, and a cool mouse pad. What gives this time around?
  

So you have Windows 9x or 2000? Your computer is likely too lame to run Vista. On top of that, there is no in-place upgrade, you must start fresh if you have 9x or 2000, and if you have Pro Edition and want to move to the home edition, you also have to wipe out your current OS and start over. Still thinking about upgrading? Then use the Windows Vista Upgrade Advisor that Microsoft has so thoughtfully provided.

Sharing a single XP Pro computer among several users

Multiple remote desktops have been a standard in Unix almost since its inception (think terminals), but Windows always seemed to be a desktop operating system usable by one person at a time. Not so, I say! Our friends at SalaSource have created a free, easy patch to enable multiple concurrent remote desktops on a single XP Pro (NOT Home Edition!) computer that is not part of a domain.

So what if you're part of a domain? Most of my business customers fit into this category, and as much as I hate to say it, it'll cost you some money to do it right ($550.00). Doing it wrong is indeed free - XP Unlimited offers the Enterprise version of the software, which has a free demo that is not crippled and never expires.

Using either of these tools allows two or more people to simultaneously use the same computer under different usernames, with one local user, and an unknown number of remote users - I've had as many as two remote and one local working at once with no serious degradation to performance on a fairly new Dell with a Celeron 2.8G CPU and 512MB of RAM.

This is extremely useful for organizations that can only afford one XP machine and would like to keep on using their clunkers like Windows 95 and 98 (which is unsafe at best due to viruses). Even more useful is using old computers with an open source desktop OS like OpenSUSE or another flavor of Linux and the rdesktop command - then a user on a crummy old computer that used to run Windows 9x can now use a reasonably secure, modern OS on their desktop and still have access to an XP computer to work in their preferred environment or to use applications that only work on Windows.

Geek Speak: Networking

Network Port - Also known as a socket. When visualizing TCP/IP network connectivity, it is helpful to think of the computers as having banks of plugs like the old-timey telephone operators used. Just as different residences may be hooked together with the plugs on the operators board, the various programs you have running on your computer are addressed through their numbered sockets - for example, E-Mail is often sent to your e-mail server's port 25, which is always listening for connections. Programs seldom, if ever, share ports, and some programs can use multiple ports. Click here, click "Proceed," then click "All Ports" to find out which ports you have listening.

The first 1024 ports have been reserved for "well-known services." The rest are generally up for grabs, although most popular programs use well-known upper port numbers - for instance, Windows Remote Desktop typically uses port 3389, but can be told to use any port through a simple registry hack.

"Listening" ports (open ports) indicate that a computer is providing a service on the network - thus "listening" for a connection. While not all network services are bad, and many are required for the proper operation of home and business networks, having a port listening on the Internet is really bad if it is unintentional - the services listening on the open ports may be exploited by worms or malicious hackers.

Server - Any computer offering services on a network is called a server by us geeks. However, a server to you office pros is the central computer that holds all your goodies while you're not working on them. For my typical customer, an office server not only stores and backs up files, but also serves the "Intranet" e-mail, calendar, and other, more essential services like authorization, authentication, and event logging.

TCP/IP - Transmission Control Protocol/Internet Protocol is a suite of networking protocols (languages) upon which the Internet, and more recently our office networks, heavily rely. It doesn't matter if you're running Windows, Linux, or Mac OS X, if you use the Internet, you use TCP/IP. When you "ping" someone, you are using the most basic parts of the TCP/IP protocol.

Medicare Part A Submission (EDI)

Illinois and Indiana Nursing Homes that are reimbursed for Medicare Part A used to submit their claims to the government on paper. Those days ended a over a decade ago, and electronic submissions became the norm. These submissions went through clearing-houses (Intermediaries) like the Florida Shared System and The Mutual of Medicare (a popular choice that is still in use today) via direct data entry (DDE) using a terminal through a dial-up connection.

Today, most of the work is done by entities like Adminastar Federal, who are contracted with the CMS to provide service to a specific region - Administar, for instance, is in charge of the Midwest, particularly Illinois, Indiana, Kentucky and Ohio.

There are two ways that nursing homes typically submit their claims - either via batch, or via DDE (direct data entry). Most typically the people that handle the claims dial into a regional point-of-presence (POP) using theAT&T Global Dialer and use a terminal program like Microsoft's Hyperterminal, orMedacomm. Batch submittals and real-time benefits verification are typically obtained from the CMS using PC Ace Pro32 (the IVANS software for Medicare Part A verification and submission) or Passport IP - AT&T Global Dialer and Passport IP can be found at http://www.ivans.com/downloads/.

Signing up for these services is simple, and the necessary forms can be found on the CMS's web site .