Forum Discussion

marcocheng_5768's avatar
marcocheng_5768
Icon for Nimbostratus rankNimbostratus
Jun 29, 2011

Firepass Application Tunnel in a shared Terminal Server Environment

Hi All,

 

 

Recently I've tested using Firepass application tunnel with users logged in to a Windows Terminal Server. I found that when the application tunnel established, the TunnelServer.exe create listens on a local loopback address (127.x.x.x) for individual application tunnel. The address is in random.

 

 

At the same time, I found that an "Unauthenticated" user who are logged in to the same Terminal Server can gain access to the application tunnel without ANY authentication process, just by connecting to the loopback address created.

 

 

It seems the design of application tunnel have this security loophole when using in a shared terminal server environment. I try to figure out how to deal with this situation. Any suggestions?

 

 

Thanks a lot.
BIG-IP Access Policy Manager (APM)
remote access
security
  • Mike_61719's avatar
    Mike_61719
    Icon for Cirrus rankCirrus
    Jun 30, 2011
    Let me ask a few questions.

     

     

    Multiple users are on a Terminal Server. If a single user, on the terminal server, connects up to a firepass and establishes an application tunnel all other users on the TTS can hitch onto the local loopback IP and gain access?
  • marcocheng_5768's avatar
    marcocheng_5768
    Icon for Nimbostratus rankNimbostratus
    Jul 05, 2011
    Hi Mike,

     

     

    Yes. All other users on the TTS can use the local loopback IP and connect to the backend server withouth any authentication.
  • Mike_61719's avatar
    Mike_61719
    Icon for Cirrus rankCirrus
    Jul 07, 2011
    Create a ticket with support. I doubt they thought of this type of access on a Terminal Server. I can't figure out a way to limit access :(
  • marcocheng_5768's avatar
    marcocheng_5768
    Icon for Nimbostratus rankNimbostratus
    Jul 08, 2011
    Thanks Mike, one workaround that I can figure out now is to restrict the access rights of users on the Terminal Server to prevent them from discovering the local ports opened.