Build a Secure Remote Admin Toolkit with Tailscale, RDP Hardening, and Access Controls

Expected Outcome

A secure remote administration toolkit that allows secure access to remote machines while minimizing security risks.

Assumptions

• Basic knowledge of networking concepts
• Administrative access to the machines you wish to manage
• Tailscale account
• Remote Desktop Protocol (RDP) enabled on target machines

Bill of Materials

• Tailscale software
• Windows machines with RDP enabled
• Firewall software (optional)
• Password manager (optional for secure password handling)

Build Steps

1. Install Tailscale

   Begin by installing Tailscale on all machines that you want to access remotely. Manual action: Run the installer and follow the prompts to complete the installation.

   Example pattern only. Adjust for your environment before running.

   Download Tailscale from https://tailscale.com/download
   Log in to Tailscale using your preferred authentication method

2. Configure Tailscale

   Set up Tailscale to create a secure mesh network between your devices. Manual action: Open the Tailscale application.

   Example pattern only. Adjust for your environment before running.

   Ensure all devices are connected to the same Tailscale network
   Note the Tailscale IP addresses assigned to each device

3. Enable RDP on Windows Machines

   Ensure that Remote Desktop is enabled on the Windows machines you wish to access. Manual action: Go to Control Panel > System and Security > System; Click on 'Remote settings' on the left; Select 'Allow remote connections to this computer' and apply the changes.

4. Harden RDP Settings

   Implement security measures to harden RDP access.

   Example pattern only. Adjust for your environment before running.

   Set strong passwords for all user accounts with RDP access
   Limit RDP access to specific user accounts
   Enable Network Level Authentication (NLA) for RDP connections
   Consider changing the default RDP port from 3389 to another port

5. Configure Firewall Rules

   Set up firewall rules to restrict access to RDP only through Tailscale.

   Example pattern only. Adjust for your environment before running.

   Open Windows Defender Firewall with Advanced Security
   Create a new inbound rule for RDP that allows connections only from Tailscale IP addresses
   Disable inbound RDP connections from all other sources

6. Implement Access Controls

   Use access control measures to further secure remote access.

   Example pattern only. Adjust for your environment before running.

   Utilize a password manager to store and manage RDP credentials securely
   Regularly review and update user access permissions
   Consider implementing two-factor authentication (2FA) for Tailscale access

Validation

• Test remote access to each machine using Tailscale and RDP
• Verify that RDP access is only available through Tailscale IP addresses
• Ensure that security measures are in place and functioning as intended

Troubleshooting

• If a step fails, capture the exact command, exit code, and log line before retrying or changing the design.
• Check route tables, DNS resolution, firewall rules, and peer status from both sides of the connection.

Cleanup or Rollback

• Keep a copy of working configuration, compose files, scripts, and service credentials before removing containers, packages, or data directories.
• Export current network, DNS, VPN, and firewall settings before changing routes, peers, or resolver configuration.
• Rollback by restoring the prior route, peer, DNS, or firewall configuration and restarting only the affected service.

Next Improvements

• Monitor access logs for any unauthorized access attempts
• Regularly update Tailscale and Windows systems to the latest versions
• Review and adjust access controls as necessary based on usage