Remove MS Remote Desktop support #1535

craddm · 2023-08-03T10:05:11Z

✅ Checklist

You have given your pull request a meaningful title (e.g. Enable foobar integration rather than 515 foobar).
You are targeting the appropriate branch. If you're not certain which one this is, it should be develop.
Your branch is up-to-date with the target branch (it probably was when you started, but it may have changed since then).
You have marked this pull request as a draft and added '[WIP]' to the title if needed (if you're not yet ready to merge).
You have formatted your code using appropriate automated tools (for example ./tests/AutoFormat_Powershell.ps1 -TargetPath <path to file or directory> for Powershell).

⤴️ Summary

Removes support for MS Remote Desktop.

NPS removed from SHM deployment
Code relating to MSRDS removed from SRE deployment scripts
MSRDS related documentation removed

NOTE: do not merge before Release 4.0.4 is complete

🌂 Related issues

Closes #1159

🔬 Tests

Deployed an SHM and Guacamole Tier 2 SRE successfully. Rebuilt docs locally.

JimMadge

LGTM this has cleared out a lot of code to support 🎉.

JimMadge · 2023-08-08T15:20:17Z

A few references to MSRDS remaining in the smoke tests README but that isn't a big deal, it is just an example SRE name.

craddm · 2023-08-08T15:21:33Z

A few references to MSRDS remaining in the smoke tests README but that isn't a big deal, it is just an example SRE name.

I found a few more in the security checklist, which I'm just fixing along with the linting issues, so I'll fix this one too.

JimMadge · 2023-08-08T15:29:32Z

❯ rg -i 'microsoft remote desktop'
docs/source/deployment/deploy_shm.md
40:- `Microsoft Remote Desktop`

docs/source/deployment/snippets/01_prerequisites.partial.md
19:- `Microsoft Remote Desktop`

docs/source/deployment/snippets/00_symbols.partial.md
23:- This indicates a command which you will need to run remotely on an Azure virtual machine (VM) using `Microsoft Remote Desktop`
24:- Open `Microsoft Remote Desktop` and click `Add Desktop` / `Add PC`

Oh, these are fine. This is the desktop app for connecting to remote windows machines.

craddm · 2023-08-08T15:30:47Z

❯ rg -i 'microsoft remote desktop'
docs/source/deployment/deploy_shm.md
40:- `Microsoft Remote Desktop`

docs/source/deployment/snippets/01_prerequisites.partial.md
19:- `Microsoft Remote Desktop`

docs/source/deployment/snippets/00_symbols.partial.md
23:- This indicates a command which you will need to run remotely on an Azure virtual machine (VM) using `Microsoft Remote Desktop`
24:- Open `Microsoft Remote Desktop` and click `Add Desktop` / `Add PC`

It's still necessary to use MS Remote Desktop to interact with the domain controllers

JimMadge · 2023-08-08T15:32:30Z

❯ rg -i 'microsoft rds'
deployment/common/Configuration.psm1
857:    # Remote desktop either through Apache Guacamole or Microsoft RDS

JimMadge · 2023-08-08T15:38:11Z

❯ rg 'RDS'
deployment/secure_research_environment/network_rules/sre-nsg-rules-guacamole.json
17:        "description": "Allow inbound http(s) connections from clients to RDS server. Note that http requests will be upgraded.",

deployment/secure_research_environment/setup/Apply_SRE_Network_Configuration.ps1
41:    # RDS gateway

deployment/administration/SRE_Manage_VMs.ps1
30:        # May be able to simplify this further now that MSRDS is removed
33:        # Start all other VMs before RDS VMs so all services will be available when users can login via RDS

deployment/common/Configuration.psm1
508:        rg               = $shmConfigBase.dnsRecords.resourceGroupName ? $shmConfigBase.dnsRecords.resourceGroupName : "$($shm.rgPrefix)_DNS_RECORDS".ToUpper()
754:                sreArtifactsRDS = "sre-artifacts-rds"
755:                sreScriptsRDS   = "sre-scripts-rds"
857:    # Remote desktop either through Apache Guacamole or Microsoft RDS

deployment/safe_haven_management_environment/desired_state_configuration/dc1Artifacts/source/{742211F9-1482-4D06-A8DE-BA66101933EB}/gpreport.xml
173:    <SOMName>DSGroup2 RDS Session Servers</SOMName>
174:    <SOMPath>DSGroup2.co.uk/DSGroup2 RDS Session Servers</SOMPath>

deployment/safe_haven_management_environment/desired_state_configuration/dc1Artifacts/source/{0AF343A0-248D-4CA5-B19E-5FA46DAE9F9C}/gpreport.xml
165:    <SOMName>DSGroup2 RDS Session Servers</SOMName>
166:    <SOMPath>DSGroup2.co.uk/DSGroup2 RDS Session Servers</SOMPath>

docs/source/deployment/snippets/02_configuration.partial.md
25:  "inboundAccessFrom": "A comma-separated string of IP ranges (addresses or CIDR ranges) from which access to the RDS webclient is permitted. See tip default below for suggestion on how to set this.",
31:  "remoteDesktopProvider": "Which remote desktop provider to use. Either 'ApacheGuacamole' (recommended, tiers 0-3) or 'MicrosoftRDS' (tiers 2-3 only)",

tests/benchmark_shm.json
323:                "Name": "RADIUS_Authenitcation_RDS_to_NPS",
837:                "Name": "RADIUS_Authenitcation_RDS_to_NPS",
1351:                "Name": "RADIUS_Authenitcation_RDS_to_NPS",

tests/benchmark_sre.json
771:                "Name": "RADIUS_Authentication_RDS_to_NPS",

tests/resources/sre_bluet1guac_full_config.json
1309:          "sreArtifactsRDS": "sre-artifacts-rds",
1310:          "sreScriptsRDS": "sre-scripts-rds"

tests/resources/sre_greent2guac_full_config.json
1362:          "sreArtifactsRDS": "sre-artifacts-rds",
1363:          "sreScriptsRDS": "sre-scripts-rds"

tests/resources/sre_bluet3guac_full_config.json
1309:          "sreArtifactsRDS": "sre-artifacts-rds",
1310:          "sreScriptsRDS": "sre-scripts-rds"

This one is worth changing

https://github.com/craddm/data-safe-haven/blob/562f9a3bc343af4533e855625b033148892c0b70/docs/source/deployment/snippets/02_configuration.partial.md?plain=1#L31

Another reference to "RDS" in the same file.

I'm not sure what the JSON files in the test directory or the DC desire state files mean. @jemrobinson?

craddm · 2023-08-08T15:49:07Z

❯ rg 'RDS'
deployment/secure_research_environment/network_rules/sre-nsg-rules-guacamole.json
17:        "description": "Allow inbound http(s) connections from clients to RDS server. Note that http requests will be upgraded.",

deployment/secure_research_environment/setup/Apply_SRE_Network_Configuration.ps1
41:    # RDS gateway

deployment/administration/SRE_Manage_VMs.ps1
30:        # May be able to simplify this further now that MSRDS is removed
33:        # Start all other VMs before RDS VMs so all services will be available when users can login via RDS

deployment/common/Configuration.psm1
508:        rg               = $shmConfigBase.dnsRecords.resourceGroupName ? $shmConfigBase.dnsRecords.resourceGroupName : "$($shm.rgPrefix)_DNS_RECORDS".ToUpper()
754:                sreArtifactsRDS = "sre-artifacts-rds"
755:                sreScriptsRDS   = "sre-scripts-rds"
857:    # Remote desktop either through Apache Guacamole or Microsoft RDS

deployment/safe_haven_management_environment/desired_state_configuration/dc1Artifacts/source/{742211F9-1482-4D06-A8DE-BA66101933EB}/gpreport.xml
173:    <SOMName>DSGroup2 RDS Session Servers</SOMName>
174:    <SOMPath>DSGroup2.co.uk/DSGroup2 RDS Session Servers</SOMPath>

deployment/safe_haven_management_environment/desired_state_configuration/dc1Artifacts/source/{0AF343A0-248D-4CA5-B19E-5FA46DAE9F9C}/gpreport.xml
165:    <SOMName>DSGroup2 RDS Session Servers</SOMName>
166:    <SOMPath>DSGroup2.co.uk/DSGroup2 RDS Session Servers</SOMPath>

docs/source/deployment/snippets/02_configuration.partial.md
25:  "inboundAccessFrom": "A comma-separated string of IP ranges (addresses or CIDR ranges) from which access to the RDS webclient is permitted. See tip default below for suggestion on how to set this.",
31:  "remoteDesktopProvider": "Which remote desktop provider to use. Either 'ApacheGuacamole' (recommended, tiers 0-3) or 'MicrosoftRDS' (tiers 2-3 only)",

tests/benchmark_shm.json
323:                "Name": "RADIUS_Authenitcation_RDS_to_NPS",
837:                "Name": "RADIUS_Authenitcation_RDS_to_NPS",
1351:                "Name": "RADIUS_Authenitcation_RDS_to_NPS",

tests/benchmark_sre.json
771:                "Name": "RADIUS_Authentication_RDS_to_NPS",

tests/resources/sre_bluet1guac_full_config.json
1309:          "sreArtifactsRDS": "sre-artifacts-rds",
1310:          "sreScriptsRDS": "sre-scripts-rds"

tests/resources/sre_greent2guac_full_config.json
1362:          "sreArtifactsRDS": "sre-artifacts-rds",
1363:          "sreScriptsRDS": "sre-scripts-rds"

tests/resources/sre_bluet3guac_full_config.json
1309:          "sreArtifactsRDS": "sre-artifacts-rds",
1310:          "sreScriptsRDS": "sre-scripts-rds"

This one is worth changing

https://github.com/craddm/data-safe-haven/blob/562f9a3bc343af4533e855625b033148892c0b70/docs/source/deployment/snippets/02_configuration.partial.md?plain=1#L31

Another reference to "RDS" in the same file.

I'm not sure what the JSON files in the test directory or the DC desire state files mean. @jemrobinson?

Hm, with that one - the remoteDesktopProvider field in the config file - is it better to remove that completely from the example and provided configs? I'd still maintain a check of its value in the actual deployment scripts, so that anyone trying to run an old MSRDS config script on this version would be given a useful error message, but could otherwise set it up to set remoteDesktopProvider to ApacheGuacamole if it is not provided in the config.

JimMadge · 2023-08-09T08:43:39Z

Hm, with that one - the remoteDesktopProvider field in the config file - is it better to remove that completely from the example and provided configs? I'd still maintain a check of its value in the actual deployment scripts, so that anyone trying to run an old MSRDS config script on this version would be given a useful error message, but could otherwise set it up to set remoteDesktopProvider to ApacheGuacamole if it is not provided in the config.

If I understand, yes I think we can keep the variable and if we have a variable we should check that it is valid.

Removing all of this is probably unnecessary work. Also, like you said, it could be useful to prompt people to 'upgrade' and give a useful error message. We can make Guacamole the default though, so that you don't need to specify this in configuration files.

jemrobinson · 2023-08-09T09:48:20Z

I suggest making it a non-configurable option (ie. don't check for in in Configuration.psm1 but just set it to "ApacheGuacamole" there). This would remove it from the example configs but leave it in the full configs.

deployment/common/Configuration.psm1

Co-authored-by: Jim Madge <[email protected]>

craddm

@JimMadge I think all your comments have been addressed now

craddm added 30 commits July 10, 2023 14:43

Remove updating NSG for MSRDS

fc99407

Remove script for removing RDS gateway

209faa1

Remove msrds gateway NSG rules

3f60f3c

remove MSRDS elements from updating SRE SSL cert

a1d02a2

Remove script for setting up MSRDS SRE

91639de

Remove set up of NSG rules for MSRDS

a061d9a

Remove scripts for creating MSRDS

8fcf6b9

Remove MSRDS network config code

a509e76

remove RADIUS auth rule from NSG rules

d0a1240

Remove script for setting up RDS gateway

8093093

Remove configure SRE RDS script

bf21be9

Remove disable legacy TLS script (msrds)

595c4fc

No longer need to remove Radius client

0dcd652

Remove MSRDS-only VM secrets from key vault

2825ec3

Remove RDS ARM template

53cee3f

remove session hosts NSG rules

2f53c72

Remove MSRDS code for restarting VMs

a9fad79

Remove NPS admin key from vault

1cdc3ba

Remove NPS from deployment script

ecb4b46

Remove NPS ARM template

60a5864

REmove NPS setup script

e4d26fe

remove NPS files from desired state config

1a2a90f

Remove references to NPS from VM management

bdab3ad

Remove RDS code from Config powershell script

207262f

Remove MSRDS related elements from DC1 DSC

9bf4c69

remove MSRDS domain config

6789d5a

Remove MSRDS domain configuration SRE removal

8b5c6b9

remove MS RDS from documentation on SRE details

1052ab4

Delete deploy MSRDS SRE instructions

356d48e

Replace deploy_sre page with Guacamole version

8684bf6

remove MSRDS only sections from docs

89e3a1a

JimMadge approved these changes Aug 8, 2023

View reviewed changes

craddm and others added 3 commits August 8, 2023 15:26

fix linting and code fences

9eabdd4

Correct fenced blocks spacing and closes

d6614d9

complete merge

3224042

change MSRDS in smoke test readme to GUAC

16fbf55

Remove reference to MS RDS

562f9a3

craddm added 3 commits August 9, 2023 16:01

Enforce ApacheGuacamole as remoteDesktopProvider

e4f40aa

Edit config documentation

2fd9093

fix linting errors

a8bc1c7

JimMadge requested changes Aug 10, 2023

View reviewed changes

deployment/common/Configuration.psm1 Outdated Show resolved Hide resolved

deployment/common/Configuration.psm1 Outdated Show resolved Hide resolved

deployment/common/Configuration.psm1 Outdated Show resolved Hide resolved

craddm and others added 3 commits August 10, 2023 11:04

Update deployment/common/Configuration.psm1

8e0df0c

Co-authored-by: Jim Madge <[email protected]>

Update deployment/common/Configuration.psm1

16e8f36

Co-authored-by: Jim Madge <[email protected]>

Change warning to fatal error if not RD other than Guac supplied

e848460

Co-authored-by: Jim Madge <[email protected]>

craddm commented Aug 11, 2023

View reviewed changes

JimMadge approved these changes Aug 11, 2023

View reviewed changes

JimMadge merged commit 381c2dd into alan-turing-institute:develop Aug 11, 2023
10 checks passed

Davsarper mentioned this pull request Aug 11, 2023

Codebase maintenance alan-turing-institute/data-safe-haven-team#47

Closed

10 tasks

jemrobinson added this to the Release 4.2.0 milestone Aug 24, 2023

craddm deleted the remove-msrds branch September 11, 2023 09:58

craddm mentioned this pull request Sep 12, 2023

Redirect HTTP to HTTPS when connecting to RDS webclient #361

Closed

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove MS Remote Desktop support #1535

Remove MS Remote Desktop support #1535

craddm commented Aug 3, 2023 •

edited

Loading

JimMadge left a comment

JimMadge commented Aug 8, 2023

craddm commented Aug 8, 2023

JimMadge commented Aug 8, 2023 •

edited

Loading

craddm commented Aug 8, 2023 •

edited

Loading

JimMadge commented Aug 8, 2023

JimMadge commented Aug 8, 2023 •

edited

Loading

craddm commented Aug 8, 2023

JimMadge commented Aug 9, 2023

jemrobinson commented Aug 9, 2023

craddm left a comment

Remove MS Remote Desktop support #1535

Remove MS Remote Desktop support #1535

Conversation

craddm commented Aug 3, 2023 • edited Loading

✅ Checklist

⤴️ Summary

🌂 Related issues

🔬 Tests

JimMadge left a comment

Choose a reason for hiding this comment

JimMadge commented Aug 8, 2023

craddm commented Aug 8, 2023

JimMadge commented Aug 8, 2023 • edited Loading

craddm commented Aug 8, 2023 • edited Loading

JimMadge commented Aug 8, 2023

JimMadge commented Aug 8, 2023 • edited Loading

craddm commented Aug 8, 2023

JimMadge commented Aug 9, 2023

jemrobinson commented Aug 9, 2023

craddm left a comment

Choose a reason for hiding this comment

craddm commented Aug 3, 2023 •

edited

Loading

JimMadge commented Aug 8, 2023 •

edited

Loading

craddm commented Aug 8, 2023 •

edited

Loading

JimMadge commented Aug 8, 2023 •

edited

Loading