[prev in list] [next in list] [prev in thread] [next in thread] 

List:       focus-ms
Subject:    RE: Shadowing Terminal sessions
From:       "Dubber, Drew B" <drew.dubber () eds ! com>
Date:       2006-10-04 14:35:51
Message-ID: CFDB22620CFB894B9B465A5A730ACE5E024944E8 () ukwtm200 ! emea ! corp ! eds ! com
[Download RAW message or body]

Have you looked at the native SHADOW command (command prompt utility to
shadow sessions.) Is that good enough with a bit of custom scripting to
detect sessions and start a shadow. Possibly not! 

Alternatively, Citrix had a technology preview of project IRIS available
earlier in the year (see
http://www.brianmadden.com/content/content.asp?ID=469) Not sure where
that is in terms of release (not available on mycitrix now) but that had
full surveillance/auditing and sounded a perfect fit for your
requirements.

Hope that helps (but probably not!)

Cheers
Drew


-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of dubaisans dubai
Sent: 04 October 2006 07:10
To: focus-ms@securityfocus.com
Subject: Shadowing Terminal sessions

Hi,

We have a single hop model for administering Windows servers in
datacenter. First admins login using RDP from their desktops to
Microsoft  Terminal server which serves as a gateway. From the gateway
they open a second terminal connection[RDP] to their own application
servers.

This gateway terminal server is maintained by Information security
team. On this server it is required to shadow all sessions that are
happening. It should be happening in the background and fully
automated. Since there is little control for Infosec team on the
application  servers this is being done for maintining audit trail and
forensics. The server hardware sizing and storage requirements for
gateway can be taken care of.

Is this possible with just Microsoft Terminal server ?

We are open to using a different product other than Microsoft Terminal
server [ like Citrix or Sun Global desktop]if it has this feature.We
are also open to using a add-on product which will provide only this
shadowing function.

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
---------------------------------------------------------------------------


[prev in list] [next in list] [prev in thread] [next in thread]