Click here to Skip to main content
15,885,214 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I want to develop a application(web or desktop) where end user can connect to a windows server(rdp or any other) but we don't want to reveal the password to the end user. Also password should be kept secure from hackers. Password is in our database which can be accessed(encrypted) via wcf or web service. I prefer a .net solution
Posted
Comments
Dave Kreskowiak 17-Sep-14 13:06pm    
You're going to have to be a lot more specific than that. WHAT PASSWORD? TO GAIN ACCESS TO WHAT?
Sergey Alexandrovich Kryukov 17-Sep-14 16:25pm    
It looks like the problem is about this: when one connects to a remote computer running RDP service, authentication is required. This is about Windows authentication (domain/username/password) through a RDP client (or possibly some equivalent kind of service and client). I tried to answer in Solution 1.
—SA
Bernhard Hiller 18-Sep-14 2:39am    
Do mean similar to an ICA (Citrix) session where you can add username, domain and password (either ceartext or encrypted) in a .ica file?
Well, it's not "secure from hackers", as any hacker could use that ica file to connect to the server....

1 solution

I don't believe such thing can be possible, by the following reason: it if was possible, it would greatly compromise OS security. The idea is: there is a single point in code where the user is authenticated; there are no a work-around, when Windows is already bootstrapped/loaded. If you store the password somewhere on a different system (nothing can prevent you from doing such an unsafe thing), it will be your responsibility, not the responsibility of the authors of the OS.

But if you agree to give someone the opportunity to use the password for authentication just once and then store it somewhere, you can do it in more or less secure way. (Unless you want to create a fixed account with never-changing password and deploy the remote system with such settings, which is possible but does not look flexible enough; what if the customers needs to replace that system?) But you should never store the password itself, because if your application can access it, some user will be able to do it, too, with some considerable effort. This is not really needed. The right way is to use cryptographic hash function, store only the hash and use the hash. Probably, this is possible if you create your own RDP client implementation. Frankly, I'm not sure, because, at this moment, I don't know the detail of authentication via RDP. You can lean if from the very good CodeProject articles:
Remote Desktop using C#.NET[^],
Palantir - Remote Desktop Manager[^].

In the very worse case, you would need to design and implement your own analog of RDP, and that would require you to create the service part as well (please see one of the links below commented with "as to the custom protocol similar to RDP").

To explore the authentication mechanism using the cryptographic hash function, please see: http://en.wikipedia.org/wiki/Cryptographic_hash_function[^].

See also my past answers:
i already encrypt my password but when i log in it gives me an error. how can decrypte it[^],
TCP Connection with username and password[^] (as to the custom protocol similar to RDP),
Decryption of Encrypted Password[^],
storing password value int sql server with secure way[^].

—SA
 
Share this answer
 
v3

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900