By default HTML5 server is able to forward RDP requests from default web ports 80/443 to target RDP server. Some hacker tools reuse this fact to run RDP brute force attacks against these ports. As countermeasure you got in such case two choices, either completely disable RDP forwarding as described in this FAQ or alternatively you may disable RDP forwarding but enable at same time RDP cookie approved connections. That means, initial RDP connection packet must contain special cookie string known to the server in order to be successfully passed through. To enable this cookie approvement do following.
(0. firstly upgade to latest TSplus version since in older versions this feature may be not available)
1. follow this FAQ to disable RDP forwarding if not yet done
2. open with Notepad *\Clients\webserver\balance.bin
3. add as next line (and save changes)
(this would mean RDP client must send cookie /~~mySpecificRDPcookie to be passed to 127.0.0.1:3389, the /~~mySpecificRDPcookie is just an example, it could be any string except preceding /~~ which is mandatory)
4. if you use mstsc.exe to connect, then create and edit file *.rdp and add as next line
(by other clients than mstsc.exe the cookie support may be lacking, we do not maintain the list of third part clients supporting cookies)
(5). if you use load balancing in half balancing mode (when gateway takes the role of RDP client and not subserver) then without knowing that cookie RDP client part of HTML5 client would fail to connect. To get over it open with Notepad *\Clients\webserver\setting.bin directly on gateway server and insert as next line following content with final changes saving
6. restart HTML5 server in AdminTool GUI.
Since Windows2012/2016 and Windows10 there exists new option for additional RDP security by enforcing only updated clients to avoid vulnerability exploitation of RDP by potential hackers by brute forcing the connection. This will require the RDP clients to support at least CredSSP v6.
1. start gpedit.msc
2. change: Computer Configuration > Administrative Templates > System > Credential Delegation > Encryption Oracle Remediation > Only Updated Clients >> Force Updated Clients
Remember, this requires at least HTML5 v6.12 client, check you web_log.txt if you are unsure.
Randomized local remote binding
New HTML5 v6.23 client supports randomized remote addresses for 127.*.*.* address space.
1. open with Notepad *\Clients\webserver\settings.bin
2. add as next line (and save changes)
3. restart HTML5 server in AdminTool GUI.