RDP in bastion mode

This chapter contains an example of a basic Fudo Enterprise configuration, to monitor RDP access to a remote server. In this scenario, the user connects to the remote server in bastion mode by specifying the user name along with account login on the target server and target server address in the login string. Bastion mode enables facilitating privileged accounts monitoring while preserving default protocols port numbers.

Prerequisites

Description below assumes that the system has been already initiated. The initiation procedure is described in the System initiation topic.

Configuration

Adding a server

Server is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.

1. Select Management > Servers.
2. Click + Add server.

3. Provide essential configuration parameters:

Parameter	Value
Name	rdp_server
Description
Blocked
Protocol	RDP
TLS enabled
NLA enabled
Legacy ciphers
Inform about existing connection
Bind address	10.0.150.151
Permissions
Granted users
Destination
Address	10.0.35.54
Mask	32
Port	3389
Server verification	None

4. Click Save or Save and close

Adding a user

User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.

1. Select Management > Users.
2. Click Add.
3. Provide essential user information:

Parameter	Value
General
Login	john_smith
Fudo domain
Blocked
Account validity	Indefinite
Role	user
Preferred language	English
Safes
Full name	John Smith
Email	john@smith.com
Organization
Phone
AD Domain
LDAP Base
Permissions
Granted users
Authentication
Authentication failures
Enforce static password complexity
Type	Password
Password	john
Repeat password	john

4. Click Save.

Adding a listener

Listener determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.

1. Select Management > Listeners.
2. Click Add.

3. Provide essential configuration parameters:

Parameter	Value
General
Name	rdp_listener_bastion
Blocked
Protocol	RDP
Security	Standard RDP Security
Announcement
Permissions
Granted users
Connection
Mode	bastion
Local address	10.0.150.151
Port	3389
External address
External port

4. Click i to generate the proxy server’s private key or i to upload the .PEM file private key definition.

Note

For security reasons the form displays server’s public key derived from the generated or uploaded private key.

5. Click Save.

Adding an account

Account defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.

1. Select Management > Accounts.
2. Click Add.

3. Provide essential configuration parameters:

Parameter	Value
General
Name	admin_rdp_server
Blocked
Type	regular
Session recording	all
OCR sessions
OCR Language	English
Notes
Data retention
Override global retention settings
Delete session data after	61 days
Permissions
Granted users
Server
Server	rdp_server
Credentials
Domain
Login	admin
Replace secret with	with password
Password	password
Repeat password	password
Password change policy	Static, without restrictions

4. Click Save.

Defining a safe

Safe directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.

1. Select Management > Safes.
2. Click Add.

3. Provide essential configuration parameters:

Parameter	Value
General
Name	rdp_safe
Blocked
Notifications
Login reason
Require approval
Policies
Note access	No access
Protocol functionality
RDP
SSH
VNC

4. Select Users tab.
5. Click Add user.
6. Find John and click ..
7. Click OK.
8. Select Accounts tab.
9. Click Add account.
10. Find the admin_rdp_server object and click ..
11. Click OK.
12. Click in the Listeners column.
13. Find the rdp_listener_bastion object and click ..
14. Click OK.
15. Click Save.

Establishing an RDP connection with a remote host

1. Launch RDP client of your choice.
2. Enter destination host IP address and RDP service port number.
3. Enter user name along with account login on the target server (server login) and target server address (john_smith#admin#10.0.35.54) and provide password.

Note

When connecting using the forward account, where the user name and server login are identical, the server login field may be omitted (e.g., john_smith##10.0.35.54).

Note

• In case you do not specify login credentials, Fudo will display the internal login screen to enter the account name along with the username and password.
• When connecting using the forward account, where the Username and Server login are identical, the Server login field may be omitted on the login screen.
• In case the specified account is not found, Fudo Enterprise will try to match the name with a server object. If a matching server is not found, system tries to match the string to a host’s DNS name.
• Fudo Enterprise enables using a custom logo on the login screen for RDP and VNC connections. For more information refer to the Resources topic.

Viewing user session

1. Open a web browser and enter the Fudo Enterprise administrator panel IP address.

Note

Make sure that the entered IP address has the control panel sharing option enabled in the Network configuration settings.

2. Enter the login and password to login to the Fudo Enterprise administration panel.

3. Select Management > Sessions.
4. Find John Smith’s session and click i.

Related topics:

• Microsoft Remote Desktop
• Requirements
• Data model
• Quick start - RDP connection configuration
• Quick start - HTTP connection configuration
• Quick start - MySQL connection configuration
• Quick start - Telnet connection configuration