Balabit - RDP settings and global options (site 1)
Balabit SCB Solution · Config document · referenced from Connection and channel policies
The RDP protocol settings of the site 1 cluster (PARTNER1_RDP, ORG_RDP, PARTNER2_RDP, identical but for the name), the domain membership page and the RDP global options.
| Item | Value |
|---|---|
| Where | SCB web interface, RDP Control > Settings, RDP Control > Domain Membership, RDP Control > Global Options |
| Cluster | dc1-s-xblb001 |
| Firmware at the time | 5 LTS (5.0.3) |
| Source | My design document, version 0.5 of 2017-12-01 (draft), chapters 7.5.3 to 7.5.5 |
| Not in it | The built-in settings default and rdp5_only |
The answers
# Page / Field = value, as configured on dc1-s-xblb001, from the design document v0.5, chapters 7.5.3 to 7.5.5 RDP Control > Settings > PARTNER1_RDP / NAME = PARTNER1_RDP RDP Control > Settings > PARTNER1_RDP / IDLE TIMEOUT = 600 (s) RDP Control > Settings > PARTNER1_RDP / MAXIMUM DISPLAY WIDTH = 2000 (px) RDP Control > Settings > PARTNER1_RDP / MAXIMUM DISPLAY HEIGHT = 2000 (px) RDP Control > Settings > PARTNER1_RDP / MAXIMUM DISPLAY DEPTH = 32 (bpp) RDP Control > Settings > PARTNER1_RDP / ENABLE RDP 4 = No RDP Control > Settings > PARTNER1_RDP / ENABLE RDP 5 = Yes RDP Control > Settings > PARTNER1_RDP / ENABLE NETWORK LEVEL AUTHENTICATION = Yes RDP Control > Settings > PARTNER1_RDP / REQUIRE DOMAIN MEMBERSHIP = No RDP Control > Settings > PARTNER1_RDP / ENABLE RDP 4-STYLE AUTHENTICATION = No RDP Control > Settings > PARTNER1_RDP / ENABLE PRE CHANNEL CHECK = Yes RDP Control > Settings > PARTNER1_RDP / PERMIT UNRELIABLE USERNAMES = No RDP Control > Settings > PARTNER1_RDP / AUTOLOGON DOMAIN SUFFIX = ad.example.net RDP Control > Settings > ORG_RDP / NAME = ORG_RDP RDP Control > Settings > ORG_RDP / IDLE TIMEOUT = 600 (s) RDP Control > Settings > ORG_RDP / MAXIMUM DISPLAY WIDTH = 2000 (px) RDP Control > Settings > ORG_RDP / MAXIMUM DISPLAY HEIGHT = 2000 (px) RDP Control > Settings > ORG_RDP / MAXIMUM DISPLAY DEPTH = 32 (bpp) RDP Control > Settings > ORG_RDP / ENABLE RDP 4 = No RDP Control > Settings > ORG_RDP / ENABLE RDP 5 = Yes RDP Control > Settings > ORG_RDP / ENABLE NETWORK LEVEL AUTHENTICATION = Yes RDP Control > Settings > ORG_RDP / REQUIRE DOMAIN MEMBERSHIP = No RDP Control > Settings > ORG_RDP / ENABLE RDP 4-STYLE AUTHENTICATION = No RDP Control > Settings > ORG_RDP / ENABLE PRE CHANNEL CHECK = Yes RDP Control > Settings > ORG_RDP / PERMIT UNRELIABLE USERNAMES = No RDP Control > Settings > ORG_RDP / AUTOLOGON DOMAIN SUFFIX = ad.example.net RDP Control > Settings > PARTNER2_RDP / NAME = PARTNER2_RDP RDP Control > Settings > PARTNER2_RDP / IDLE TIMEOUT = 600 (s) RDP Control > Settings > PARTNER2_RDP / MAXIMUM DISPLAY WIDTH = 2000 (px) RDP Control > Settings > PARTNER2_RDP / MAXIMUM DISPLAY HEIGHT = 2000 (px) RDP Control > Settings > PARTNER2_RDP / MAXIMUM DISPLAY DEPTH = 32 (bpp) RDP Control > Settings > PARTNER2_RDP / ENABLE RDP 4 = No RDP Control > Settings > PARTNER2_RDP / ENABLE RDP 5 = Yes RDP Control > Settings > PARTNER2_RDP / ENABLE NETWORK LEVEL AUTHENTICATION = Yes RDP Control > Settings > PARTNER2_RDP / REQUIRE DOMAIN MEMBERSHIP = No RDP Control > Settings > PARTNER2_RDP / ENABLE RDP 4-STYLE AUTHENTICATION = No RDP Control > Settings > PARTNER2_RDP / ENABLE PRE CHANNEL CHECK = Yes RDP Control > Settings > PARTNER2_RDP / PERMIT UNRELIABLE USERNAMES = No RDP Control > Settings > PARTNER2_RDP / AUTOLOGON DOMAIN SUFFIX = ad.example.net RDP Control > Domain Membership / JOIN DOMAIN = Disabled RDP Control > Global Options > TRAFFIC / SERVICE = Enabled RDP Control > Global Options > TRAFFIC / VERBOSITY LEVEL = 4 RDP Control > Global Options > AUDIT / TIMESTAMPING = Local RDP Control > Global Options > AUDIT / TIMESTAMPING POLICY = RDP Control > Global Options > AUDIT / SIGNING INTERVAL = 30 (s) RDP Control > Global Options > AUDIT / CHANNEL DATABASE CLEANUP = 180 (days)
| Field | What it means |
|---|---|
| IDLE TIMEOUT = 600 (s) | An RDP connection without traffic is closed after ten minutes |
| MAXIMUM DISPLAY WIDTH, HEIGHT, DEPTH | The largest screen a client may ask for |
| ENABLE RDP 4 = No, ENABLE RDP 5 = Yes, ENABLE RDP 4-STYLE AUTHENTICATION = No | Only RDP 5 and later clients |
| ENABLE NETWORK LEVEL AUTHENTICATION = Yes | The client authenticates (NLA) before the remote desktop session starts |
| REQUIRE DOMAIN MEMBERSHIP = No | As I understand it, the SCB can do NLA without being joined to the domain; with this set it would have to be a domain member. JOIN DOMAIN is disabled accordingly |
| ENABLE PRE CHANNEL CHECK = Yes | As I understand it, the channel policy is checked before the server-side connection is opened |
| PERMIT UNRELIABLE USERNAMES = No | As I understand it, a connection is refused if the SCB cannot establish the username reliably, which the remote groups check of the channel policy depends on |
| AUTOLOGON DOMAIN SUFFIX = ad.example.net | The design does not explain it; the built-in settings carry -AUTO here, these three the AD domain |
| TRAFFIC / SERVICE = Enabled | RDP is accepted at all |
| TIMESTAMPING, SIGNING INTERVAL, CHANNEL DATABASE CLEANUP | As for SSH: local TSA, 30 seconds, 180 days |
The site 2 config.xml has the same values in its four RDP settings, the fourth being PARTNER4_RDP, and <rdp_domain choice="no"/>: no domain membership there either.
Checked against One Identity Safeguard for Privileged Sessions 9.0
| As built | Today |
|---|---|
| ENABLE RDP 4 / RDP 5 / NETWORK LEVEL AUTHENTICATION | These options are gone. Since 6.8.0 NLA is on by default (policy default_nla, the old default renamed legacy_default); 9.0 offers an authentication mode (server logon screen, NTLM, Kerberos) |
| REQUIRE DOMAIN MEMBERSHIP = No, JOIN DOMAIN disabled | Now "Require domain authentication", off by default; SPS can monitor NLA-only servers even if client, SPS and server are not in the same domain. Joining a domain is still possible |
| IDLE TIMEOUT = 600 (s) | Split into a network idle timeout and a separate user idle timeout |
| MAXIMUM DISPLAY DEPTH = 32 (bpp) | 32-bit colour is not supported and falls back to 24-bit, in SCB 5 as today, so the 32 was never in effect. Valid depths are 8, 15, 16 and 24 |
| TIMESTAMPING = Local, SIGNING INTERVAL = 30 (s) | Unchanged; the interval may be 10 to 100 000 seconds and applies to timestamping and signing alike |
| NLA during 2018 | Microsoft's CredSSP update for CVE-2018-0886 changed the default to "Mitigated" on 2018-05-08, so patched clients could no longer talk to unpatched servers; that happened between the site 1 design and the site 2 export |
The page would look different in SPS 9.0; the decisions behind it (NLA without a domain join) are still supported.