-: Remote access, in this lesson, 2 2
we're going to discuss a lot of the different types 3 3
of remote access options 4 4
that you may be supporting as a network technician 5 5
or network administrator. 6 6
These different methods will allow a client 7 7
to access a server or a network device 8 8
remotely over your network. 9 9
Now, as an administrator, 10 10
you're going to be using some of these methods 11 11
to reach into the command line interface of your routers, 12 12
your switches, and your firewalls as well. 13 13
In order for you to be able to modify their settings 14 14
and configurations as part of your job functions. 15 15
Now, there are many ways to access this data remotely, 16 16
and you can also control these devices remotely as well. 17 17
Many of these, we may have already covered before 18 18
in different videos in the course, 19 19
but in this lesson, I want to provide you 20 20
with a quick recap or summary. 21 21
So you have them all covered in one place. 22 22
And that way, you can use it as a great review 23 23
before you take the exam. 24 24
So in this lesson, we're going to discuss Telnet, 25 25
SSH, RDP, RDG, VPN, VNC, 26 26
VDI, in band versus out-of-band management 27 27
and some authentication and authorization considerations. 28 28
Now, the first thing we need to talk about 29 29
with remote access technology is Telnet. 30 30
Now Telnet operates on port 23 and Telnet 31 31
is used to send text-based commands to remote devices. 32 32
And it's considered a very old networking protocol. 33 33
Everything you do in Telnet is going to be text-based 34 34
and here, you can see that I'm connecting over Telnet 35 35
to rainmaker.weather.underground.com. 36 36
By doing this, I can then look up 37 37
the daily weather for my area. 38 38
Now, one of the biggest drawbacks to using Telnet 39 39
is that it sends everything over the network 40 40
in plain text or un-encrypted formats. 41 41
Now, in this case, I really don't care 42 42
that I'm sending things in plain text 43 43
because the only information I have to send 44 44
to the server is the three digit airport code 45 45
for the city that I want to check the weather within. 46 46
But if I'm going to send something private, 47 47
like my social security number or my password 48 48
or my credit card number, then I would never, 49 49
ever want to use Telnet for that. 50 50
Remember, Telnet should never, 51 51
never not ever be used for anything 52 52
when you're connecting to one of your secure devices, 53 53
anything like a router or a switch or a firewall, 54 54
because when you're configuring them, 55 55
everything will be sent in plain text, 56 56
including your commands, your username, your passwords, 57 57
your access control lists, and all of that stuff. 58 58
Instead, we always want to use an encrypted 59 59
text-based remote access technology, 60 60
something like Secure Shell. 61 61
This brings us to our second remote access technology, 62 62
which is Secure Shell. 63 63
Now Secure Shell or SSH is going to operate over port 22. 64 64
Secure Shell is also known as SSH, 65 65
and it works just like Telnet, 66 66
but it's going to encrypt everything that's being sent 67 67
received between the client and the server, the router, 68 68
or the switch that you're communicating with. 69 69
Therefore, you're going to have much better security 70 70
when you're using SSH 71 71
than when you're using Telnet. 72 72
Remember, anytime you need to connect 73 73
to a networking device to configure it 74 74
in the command line interface, 75 75
you should always be doing this over SSH, 76 76
using Secure Shell. 77 77
This will ensure you have an encrypted connection 78 78
to that device. 79 79
The third remote access technology we need to discuss 80 80
is known as RDP or the desktop protocol. 81 81
Now the remote desktop protocol 82 82
operates over port 3389 83 83
and it's a proprietary protocol developed by Microsoft, 84 84
which provides users with a graphical interface 85 85
to connect to another computer over a network connection. 86 86
While RDP is not really useful 87 87
if you're trying to talk to a router, 88 88
a switch or a firewall, it is really useful 89 89
when you're trying to remotely access 90 90
and control a windows server or client machine. 91 91
For example, if your SIEM or network management system 92 92
operates on a windows machine, 93 93
you can RDP into it as a way to connect to it 94 94
over your local area network. 95 95
RDP is going to provide you with a graphical user interface 96 96
known as a gui or GUI. 97 97
This allows you to access a server and desktop 98 98
and control it using your mouse and keyboard. 99 99
Now, when you're remotely connected this machine, 100 100
it's going to act just as if you were sitting in front of it, 101 101
but you can do it from across the network 102 102
or across the world. 103 103
For example here, 104 104
you can see there are three devices 105 105
and they're all connecting to a windows seven machine. 106 106
You have a Macintosh laptop, 107 107
you have an iPad or an Android tablet, 108 108
and you have a cell phone. 109 109
And all of these are able to reach in 110 110
and do the communication using RDP, 111 111
just as if I had a mouse and keyboard 112 112
sitting right in front of that workstation. 113 113
RDP is going to allow you to connect to these devices 114 114
from across your network or across the world, 115 115
depending on how you have it configured. 116 116
Now the remote desktop protocol itself 117 117
is not considered to be a secure protocol. 118 118
Instead, you need to secure that connection 119 119
by using something else to tunnel it over. 120 120
For example, you can use a remote desktop gateway or RDG 121 121
to create a secure connection 122 122
between you and that gateway 123 123
and then tunnel into the RDP session. 124 124
Or you can use a VPN, like a virtual private network. 125 125
Now our fourth remote access technology we need to discuss 126 126
is the RDG or the remote desktop gateway. 127 127
Now a remote desktop gateway is a window server 128 128
that's going to have the role of creating a secure connection 129 129
using either SSL or TLS protocols to a server via RDP. 130 130
So if you're using an RDG to secure RDP client, 131 131
this will allow you to create 132 132
those secure server connections. 133 133
This way, you wouldn't have to run a VPN 134 134
to create an encrypted tunnel, 135 135
because RDG is already going to create 136 136
that encrypted tunnel using SSL or TLS protocols. 137 137
A remote desktop gateway provides several security features 138 138
for you in terms of securing RDP connections. 139 139
This includes things like creating encrypted tunnels, 140 140
like a VPN would, controlling access to network resources 141 141
based on permissions and group roles, 142 142
maintaining and enforcing authorization policies 143 143
and monitoring the status of the gateway 144 144
and any RDP connections passing through that gateway. 145 145
If you're running a windows server 2008 or newer, 146 146
you definitely should be using this RDG 147 147
or remote desktop gateway 148 148
to better protect your RDP connections. 149 149
Now the fifth remote access technology we need to talk about 150 150
is VPNs or virtual private networks. 151 151
A VPN is used to establish a secure connection 152 152
between a client and a server 153 153
over an untrusted public network like the internet. 154 154
If you're going to use RDP over the internet, 155 155
you first need to make sure you create 156 156
a VPN connection to create a secure tunnel, 157 157
and then run that RDP session over that VPN connection. 158 158
We're going talk more about VPNs and their own lesson, 159 159
including the three different types of VPNs 160 160
and how to establish and maintain 161 161
these secure connections over an untrusted network 162 162
like the internet. 163 163
The sixth remote access technology we need to discuss 164 164
is VNC or virtual network computing. 165 165
VNC operates over port 5900. 166 166
It was originally designed for thin client architectures 167 167
and things like virtual desktop infrastructure or VDI. 168 168
VNC operates a lot like RDP, but unlike RDP, 169 169
which only operates on Windows clients and servers, 170 170
VNC is truly cross-platform and it can be used 171 171
on Linux OSX or windows, clients and servers. 172 172
Our seventh remote access technology 173 173
to discuss is virtual desktop infrastructure or VDI, 174 174
which I just mentioned that we use 175 175
that with VNC a lot of times. 176 176
Now virtual desktop infrastructure 177 177
is used to host a desktop environment 178 178
on a centralized server. 179 179
VDI is a form of desktop virtualization 180 180
and allows a specific desktop image 181 181
to be run within a virtual machine 182 182
and delivered to an end user over a network. 183 183
In Cloud computing, we call this 184 184
desktop as a service or DAS. 185 185
Now when you're using VDI, you can access it 186 186
through a virtual desktop either by using a web browser 187 187
on a regular desktop or laptop, 188 188
or you can use a specialized thin client device 189 189
that uses a PXE network boot image 190 190
to load up a specialized client 191 191
that can connect to that centralized server 192 192
and provide access to the virtual desktop. 193 193
Our eighth remote access technology or concept 194 194
that we need to talk about is known as in-band 195 195
versus out-of-band management. 196 196
Now, inbound management refers to managing devices 197 197
through the use of Telnet or SSH protocols over the network. 198 198
For example, if you're going to be using 199 199
a workstation on your local area network 200 200
to configure your land routers, 201 201
you can connect to those using SSH 202 202
by simply connecting to the gateway over port 22, 203 203
this would be considered an in-band management 204 204
because you're using the same network 205 205
that you're configuring. 206 206
Now out of band management on the other hand, 207 207
is used when you have an alternate path 208 208
or alternate management network 209 209
to connect to the different network devices 210 210
for configuring them. 211 211
This is considered a best practice in security. 212 212
For example, in the last large scale enterprise network 213 213
I worked on, we had a production network 214 214
with the users we're connected to, 215 215
and everyone's workstations were there 216 216
to be able to do their work on a daily basis 217 217
and they can access our servers and the internet. 218 218
From this network, you couldn't connect to the routers 219 219
and switches in order to configure them though. 220 220
Instead, we had a separate network 221 221
called a management network, 222 222
which was an out-of-band network. 223 223
This was a more secure network 224 224
and it was limited in its functions. 225 225
If I need to configure the routers or switches, 226 226
I would connect to the out-of-band network. 227 227
And then I could talk to those routers 228 228
and switches and configure them. 229 229
Another out-of-band management connection 230 230
would be if you had a laptop and you directly connected 231 231
to the switch or router 232 232
using a serial connection or a console port. 233 233
Now this direct connection is going to be establishment 234 234
you need to configure the router or switch. 235 235
And when you're done doing that configuration, 236 236
you'd unplug it and disconnect it. 237 237
This is a truly out-of-band solution. 238 238
Now the goal with using an out-of-band solution 239 239
is to prevent a regular users machine 240 240
from being able to connect to the management interfaces 241 241
of your devices. 242 242
This way, if a user's computer is taken over by an attacker, 243 243
they would then be unable to cause large-scale havoc 244 244
across your network. 245 245
Now, by using an out-of-band network, 246 246
you can provide separation of data 247 247
between your production networks 248 248
and your management networks, 249 249
which gives you additional layers of security. 250 250
Now out of networks do require additional configuration 251 251
and equipment to implement though. 252 252
if you want to be able to have a management network 253 253
and a user network, you're going to need two sets of routers 254 254
and two sets of switches. 255 255
And all of that starts to get very expensive over time. 256 256
Now it is considered a best practice, 257 257
especially in large scale networks, 258 258
where you can't physically walk to every single switch 259 259
or router that you want to reconfigure. 260 260
So in those cases, you definitely need 261 261
to have a management network. 262 262
Finally, we need to discuss some authentication 263 263
and authorization considerations 264 264
when dealing with these remote access technologies. 265 265
When we're talking about authentication, 266 266
we're referring to how a system will confirm 267 267
that a user is who they say they are. 268 268
Essentially, how are we going to validate their identity? 269 269
Now, when we're talking about authorization, 270 270
we're referring to how a system will give the user 271 271
the proper permissions 272 272
to access a particular resource on the network. 273 273
Now there are lots of different ways 274 274
to do remote access authentication, 275 275
including PAP, CHAP, MS-CHAP and EAP, 276 276
pap or PAP is the password authentication protocol. 277 277
And it's a really old protocol that was never built 278 278
with security in mind. 279 279
In fact, when PAP is used, 280 280
it's going to send the username and passwords 281 281
for authentication in the clear, just like Telnet does. 282 282
This makes PAP an insecure choice for any modern network 283 283
and you simply should never use it 284 284
in today's modern networks. 285 285
You see, pap worked by having the clients 286 286
send the username and password 287 287
in the clear over the network, 288 288
then the server would send an authentication acknowledgement 289 289
if the credentials matched what they expected to receive, 290 290
or they would get an authentication NEC 291 291
or a non acknowledgement if the credentials were incorrect. 292 292
So why am I even mentioning PAP 293 293
if we never use it these days? 294 294
Well, because after PAP came CHAP, 295 295
which was an evolution to PAP, 296 296
and it helps to understand PAP 297 297
before you start talking about CHAP. 298 298
Now, CHAP is considered the challenge, 299 299
handshake authentication protocol, CHAP. 300 300
And it's an improvement over PAP that attempted to solve 301 301
this problem with sending our credentials 302 302
over the network in plain text. 303 303
With CHAP, the server sends the client 304 304
a string of random texts called a challenge. 305 305
This random text is then encrypted by the client 306 306
using their password. 307 307
And then they send that encrypted message 308 308
back to the server. 309 309
The server will then unencrypt 310 310
the text received from the client 311 311
using the stored password on that server. 312 312
And if those things match, 313 313
that means that that client really did have the password. 314 314
And so it's a match and they would be authenticated. 315 315
Now by using this method, 316 316
the passwords never actually send across the network. 317 317
Only this encrypted text. 318 318
This allows us to positively identify the user 319 319
using authentication while maintaining security. 320 320
Now CHAP and MS CHAP were used for many, many years. 321 321
And both of these though have been overtaken 322 322
by a newer protocol known as EAP, 323 323
the extensible authentication protocol. 324 324
Now the extensible authentication protocol 325 325
or EAP allows for more secure authentication methods 326 326
to be used instead of just using a username and password. 327 327
With EAP, we can use a username and password, 328 328
or we can use things like smart cards, 329 329
Kerberos and digital certificates. 330 330
In modern remote access implementations, 331 331
you should be using EAP TLS for your authentication 332 332
in conjunction with a RADIUS or TACACS+ server.