{"id":347,"date":"2019-05-14T14:23:13","date_gmt":"2019-05-14T14:23:13","guid":{"rendered":"https:\/\/blog.iabsolute.com\/?p=347"},"modified":"2019-05-14T14:23:13","modified_gmt":"2019-05-14T21:23:13","slug":"windows-remote-desktop-over-ssh","status":"publish","type":"post","link":"https:\/\/blog.iabsolute.com\/?p=347","title":{"rendered":"Windows Remote Desktop Over SSH"},"content":{"rendered":"\n<p>Here\u2019s how you can secure your Remote Desktop (RDP) connections with SSH. This can be useful for connecting to your home computer from the office or some other remote location. &nbsp;We use here an advanced SSH feature for TCP\/UDP IP traffic tunneling to make it work.<\/p>\n\n\n\n<p><strong>Prerequisites for basic RDP<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/www.softwaresecretweapons.com\/jspwiki\/images\/out.png\" alt=\"\"\/><\/figure>\n\n\n\n<p>You\u2019ll need an SSH server installed at home. I\u2019ve used OpenSSH, but any SSH implementation will work. Windows users can use <a href=\"http:\/\/sshwindows.sourceforge.net\/\">OpenSSH for Windows<\/a>; Unix (including Mac OSX and Linux) users can use the standard OpenSSH distribution. You can secure SSH by using SSL and various kinds of encryption.<\/p>\n\n\n\n<p>If you\u2019re using a router or firewall at home, make sure to allow incoming connections on the SSH port (port 22 by default).<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/www.softwaresecretweapons.com\/jspwiki\/images\/out.png\" alt=\"\"\/><\/figure>\n\n\n\n<p>You\u2019ll also of course need an RDP (Remote Desktop Protocol) client in your office. Windows users can use Microsoft\u2019s Remote Desktop Client that is part of Windows XP. Unix users can use <a href=\"http:\/\/www.rdesktop.org\/\">RDesktop<\/a>.<\/p>\n\n\n\n<p>Ensure that your home computer is setup to accept remote connections for a specific user account. Go to <strong>Start &gt; Settings &gt; Control Panel<\/strong> and then double-click the <strong>System<\/strong> icon. On the Remote tab, select the <strong>Allow users to connect remotely to this computer<\/strong> check box.<\/p>\n\n\n\n<p>And finally, obviously you\u2019ll have to leave your workstation running (though you should log off).<\/p>\n\n\n\n<p><strong>Securing RDP with SSH tunnel<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/www.softwaresecretweapons.com\/jspwiki\/images\/out.png\" alt=\"\"\/><\/figure>\n\n\n\n<p>The SSH client software like <a href=\"http:\/\/www.chiark.greenend.org.uk\/~sgtatham\/putty\/\">PuTTY<\/a> can be used connect to home SSH server from the office. From your computer at the office, SSH into the home \u201cSSH Server\u201d with PuTTY or by executing the following command from the prompt:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>ssh \u2013p&lt;ssh.port.number&gt; home.username@home.ip.address<\/strong><\/li><\/ul>\n\n\n\n<p>You should now have a command prompt on the home \u201cSSH Server\u201d. From there, execute the following command to enable traffic tunneling:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>ssh -R 3390:home.ip.address:3389 -C -N office.username@office.ip.address<\/strong><\/li><\/ul>\n\n\n\n<p>This will tunnel all traffic arriving from source office.username@office.ip.address port 3390 to destination home.ip.address port 3389. Now from your computer at the office, use your Remote Desktop client to connect to <strong>localhost:3390<\/strong>, this will connect you to the home computer. The Remote Desktop traffic will be tunneled over SSH. If <strong>localhost<\/strong> does not work, try to use <strong>127.0.0.1:3390<\/strong> on Windows XP SP1, or <strong>127.0.0.2:3390<\/strong> on Windows XP SP2. This is due to changes in TCP loopback interface that occurred in SP2.<\/p>\n\n\n\n<p><strong>Securing CVS access with SSH tunnel<\/strong><\/p>\n\n\n\n<p>You can tunnel other kinds of ports (CVS for example) the same way. For CVS traffic tunneling use following command:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>ssh -R 2402:home.ip.address:2401 -C -N office.username@office.ip.address<\/strong><\/li><\/ul>\n\n\n\n<p>This will tunnel all traffic arriving from office.username@office.ip.address port 2402 to destination home.ip.address port 2401. In order to access home CVS from the office connect to <strong>localhost:2402<\/strong>.<\/p>\n\n\n\n<p><strong>Windows XP SP2 Patch<\/strong><\/p>\n\n\n\n<p>Please note that something got broken in Microsoft Windows XP Sp2. You must apply <a href=\"http:\/\/support.microsoft.com\/default.aspx?scid=kb;en-us;884020\">patch<\/a> or none of the loopback interfaces will not work, including one required for RDP over SHH.<\/p>\n\n\n\n<p><strong>Comments (25)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Comment by Laura \u2014 September 22, 2007 @ 5:49 pmHelp! I\u2019m tried the above steps and upon reaching the last step under \u201cSecuring RDP with SSH tunnel\u201d I am receiving this message when attempting to connect to 127.0.0.1:3390 with the Remote Desktop client:\u201cThe client could not connect. You are already connected to the console of this computer. A new console session cannot be established.\u201d\nI\u2019m using Windows XP SP2. Thanks =)<\/li><li>Comment by <a href=\"http:\/\/www.softwaresecretweapons.com\/\">Pavel Simakov<\/a> \u2014 September 22, 2007 @ 9:58 pmPlease use 127.0.0.2:3390 (notice .2, not .1) as article mentions. This is due to changes in TCP loopback interface that occurred in SP2.<\/li><li>Comment by Jen \u2014 September 25, 2007 @ 8:58 amI\u2019m running OpenSSH on a port other than the default of 22. What is the syntax to enable the RDP access and specify the alternate port? Thanks.<\/li><li>Comment by <a href=\"http:\/\/www.softwaresecretweapons.com\/jspwiki\/about\">Pavel Simakov<\/a> \u2014 September 25, 2007 @ 12:37 pmTo use the port number other than 22 use this (as article mentions already):<br>\nssh \u2013p&lt;ssh.port.number&gt; <a href=\"mailto:home.username@home.ip.address\">home.username@home.ip.address<\/a><\/li><li>Comment by Laura \u2014 September 26, 2007 @ 9:43 amI tried using 127.0.0.2:3390, it still gives me the same error message. I tried leaving the remote computer logged off, and first establishing the OpenSSH session successfully, then running the MS RDP and I get that same message about already being logged into the console.  <\/li><li>Comment by Josh \u2014 September 28, 2007 @ 11:56 amLaura: QFE from MS resolves this issue:<a href=\"http:\/\/support.microsoft.com\/default.aspx?scid=kb;en-us;884020\">http:\/\/support.microsoft.com\/default.aspx?scid=kb;en-us;884020<\/a><\/li><li>Comment by <a href=\"http:\/\/www.softwaresecretweapons.com\/jspwiki\/about\">Pavel Simakov<\/a> \u2014 October 4, 2007 @ 11:24 pmOne of the readers suggested great SSH\/SFTP tool that avoids the use of command line and has very nice gui. Using this tool the reader was able to setup RDP over SSH. The tool is here: <a href=\"http:\/\/www.bitvise.com\/tunnelier\">http:\/\/www.bitvise.com\/tunnelier<\/a><\/li><li>Comment by Will R \u2014 May 5, 2008 @ 4:31 pmI\u2019m running a setup where I have a lab with three windows computers behind a router and a unix server that\u2019s functioning as my ssh-server. I log in using PuTTY, type the RDP-listening command (telling it to forward to the lab-internal address of a windows machine), and then attempt to RDP into the computer I\u2019ve specified in the command using 127.0.0.2:3390 as the address.I keep getting the error \u201cThe client could not connect to the remote computer \/ Remote connections might not be enabled or the computer might be too busy to accept new connections. It is also possible that network problems are preventing your connection. \/ Please try connecting again later.\u201d\nI can connect to the computer outside of the ssh tunnel I\u2019m trying to set up. Have I missed something in the server-side setup (i.e. I need to have the SSH server available immediately on the computer I want to RDP into)?\nHelp appreciated greatly.<br>\n-Will<\/li><li>Comment by Burhanuddin T. \u2014 June 6, 2008 @ 9:41 amOn My Computer icon, right-click and select Properties. Then, on the Remote tab, ensure that the checkbox \u201cAllow users to connect remotely to this computer\u201d is checked.<br>\n&#8211; burhanuddin<\/li><li>Comment by Burhanuddin T. \u2014 June 6, 2008 @ 9:44 amOh, I just saw that you can connect outside of the ssh tunnel. That means your firewall needs to unblock. On the network icon, right-click and select \u201cChange Firewall Settings\u201d, then Exceptions tab, highlight Remote Desktop,<\/li><li>Comment by Burhanuddin T. \u2014 June 6, 2008 @ 9:45 am\u2026 click the Edit button, and \u201cChange Scope\u201d to Any. If all this is already setup correctly then look at the firewall settings of your anti-virus program.<\/li><li>Comment by Arched Eyebrow \u2014 August 12, 2008 @ 9:52 amwhat you\u2019ve got here is remote port forwarding\u2026. in case you\u2019re looking for local port forwarding\u2026 check this out<br>\n<a href=\"http:\/\/tripoverit.blogspot.com\/2008\/08\/ssh-port-forwarding-x11-fowarding-rdp.html\">http:\/\/tripoverit.blogspot.com\/2008\/08\/ssh-port-forwarding-x11-fowarding-rdp.html<\/a><\/li><\/ul>\n\n\n\n<p>&lt;a href=\u201dhttp:\/\/tripoverit.blogspot.com\/2008\/08\/ssh-port-forwarding-x11-fowarding-rdp.html\u201d&gt; local port forwarding &lt;\/a&gt;\nComment by eduif \u2014 November 6, 2008 @ 5:42 amMy client PC is a Windows XP SP2 without any patches installed. It did not work with:<br>\nplink.exe -ssh -2 -batch -v -L 127.0.0.2:3390:&lt;Remote Desktop Host&gt;:3389 -pw &lt;password&gt; sshuser@sshserver<br>\nThen use localhost:3390 in the Remote Desktop Application.<br>\nBut it did work with:<br>\nplink.exe -ssh -2 -batch -v -L localhost:3390:&lt;Remote Desktop Host&gt;:3389 -pw &lt;password&gt; sshuser@sshserver<br>\nthen use localhost:3390 in the Remote Desktop Application.<br>\nThis seems other way arround then explained. Can anyone understand what is going on?\nComment by Rob \u2014 March 12, 2009 @ 4:23 pmWindows 7 apparently won\u2019t let you connect to any local IP. I tried several of these work arounds with no love. Only thing that willrks so far is WiSSH\nComment by Tamas Feher \u2014 April 4, 2009 @ 5:16 amThe recommended SP2 hotfix is obsolete, because Windows XP3 SP3 is now available and needs a new hotfix package!\nComment by John \u2014 October 1, 2009 @ 2:14 amAwesome post! I established an SSH connection and was trying and trying with RemoteDesktop 3389 and couldn\u2019t figure out what was wrong. I saw the article by microsoft and applied the patch to the client (not sure if the client needed it, but did anyway) and still couldn\u2019t get it to work. Once I used the putty UI to set the source port to 3390 and the destination to &lt;computerName&gt;:3389, it worked!!! thanks so much! Great site!\nComment by <a href=\"http:\/\/www.pcs4cheap.ca\/\">cheap computers canada<\/a> \u2014 November 2, 2009 @ 12:40 pmWhat is the syntax to enable the RDP access and specify the alternate port? Thanks.\nComment by Jeremy \u2014 December 15, 2009 @ 11:39 amI have tried everything to connect to a Windows 7 (x64 Pro) box and have absolutely no luck. I have tried connecting from Win XP (SP3) and Windows 7 (RC). I have tried the 127.0.0.2 trick, the 3390 trick, and no go. I know my firewall and SSH setup is working properly because I can tunnel a Bonjour for Windows port so that I can stream stuff over iTunes just fine. I even installed a VNC server and got that to work ok too. Everytime I try to connect with Remote Desktop it says \u201cconnecting to localhost:3390\u2033 and then says \u201ccannot connect\u201d.\nComment by Jeremy \u2014 December 15, 2009 @ 11:50 amShould also add that I used to have Vista x64 and everything worked fine. Only a problem in Windows 7. I have verified my Windows Firewall setup and made sure Remote Desktop is allowed.\nComment by Jeffy \u2014 December 16, 2009 @ 8:35 pmYep, I got it working great.Windows 7 Client \/ Windows 7 Remote End \/ Debian SSH server, Added Local 3391 port to the tunnels section of the PuTTY config and set the destination as int.ip.address:3389 and saved the config. Then used remote desktop as 127.0.0.2:3391 and voila.\nComment by Steven Roberts \u2014 March 3, 2010 @ 10:43 pmon windows 7 release localhost:3390 wouldn\u2019t work for the port forward but localhost:3391 or :3392 worked just fine. weird.\nComment by Kathryn \u2014 March 4, 2010 @ 7:51 amHi,<br>\nOK, I got a bit lost reading these posts\u2026(am new to all this..).<br>\nWhat I want to do is connect FROM Win7 (home\/remote location) TO Win XP Professional (office). I will have no desktop PC in my office to create a RDP because my new laptop IS my work PC. So, what I need is to connect externally to the company\u2019s network drives and work from them as if they were local.<br>\nIs this SSH thread\/idea the solution?<br>\nIf not..does anyone how this can be done?\n<\/p>\n\n\n\n<p>Many thanks for any advice,<br>\nKathryn\nComment by Mohit Gidwani \u2014 April 12, 2010 @ 11:01 am@Steven<br>\nI\u2019m trying to connect from Win 7 to a machine running Vista. I tried the 3391 thing you recommended but i\u2019m still not getting through. Is there any other work around for this? (*grumbles*)\nComment by Ephram \u2014 April 15, 2010 @ 5:36 pmI don\u2019t think OpenSSH works with Windows 7 x64 properly. I tried installing it and could not get the service to launch. The log files weren\u2019t exactly helpful, either.I might try setting up a linux box to SSH into and then tunnel to my Windows 7 through that.\nComment by max \u2014 May 19, 2010 @ 12:04 pmwindows 7 : local connection to 127.0.0.2:3391 to my.server:3389 was the only thing that finally worked. cheers!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here\u2019s how you can secure your Remote Desktop (RDP) connections with SSH. This can be useful for connecting to your home computer from the office or some other remote location. &nbsp;We use here an advanced SSH feature for TCP\/UDP IP &hellip; <a href=\"https:\/\/blog.iabsolute.com\/?p=347\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-347","post","type-post","status-publish","format-standard","hentry","category-ssh"],"_links":{"self":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=347"}],"version-history":[{"count":1,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/347\/revisions"}],"predecessor-version":[{"id":348,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/347\/revisions\/348"}],"wp:attachment":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}