How to deny rdesktop access to others?

Question

Someone keeps trying to connect to my Ubuntu machine through remote desktop. Is there any way I can determine who it is, and permanently block access to my machine?

Answer 1

Unless you are running an RDP server, such as xrdp, users cannot use RDP to access your machine. If you are, you can configure it to authenticate the user (this would be worthy of a separate question), or run it on a local port only, which requires some kind of tunnel to your system first.

To find out who is doing it, you can use tcpdump port 3389 to see packets coming into the rdesktop port. There are a number of other tools, such as Wireshark, which has a graphical interface, that can do the same thing. These tools allow you to see the source ip address of the packets.

If the packets are coming from a generic source on the internet, you can use whois to find out who owns that IP address (which is not necessarily directly related to the person that is actually using it). If it is in your LAN, you can talk with your network administrator about the issue.

Answer 2

The easiest way to deny access is to use a firewall. I use Shorewall to build an iptables firewall on my server. For the user to be able to connect you must have a process listening on the RDP port. RDP is not a standard facility on Unix/Linux servers.

If you have the address of the server which is trying to connect you can use host or nslookup to try to get the hostname of the server. If that doesn't work, then you can use the whois command to find out which organization controls that IP address.

If you do have a listening process and the process has been built with libwrap functionality, you can add rules to /etc/hosts.allow and/or /etc/hosts.deny to limit access.

---