Securing a Parallels RAS environment

Introduction

Parallels RAS is a fantastic product for SMEs. For an overview of what Parallels RAS is and the services we provide to help organizations design, deploy, and manage their RAS environments, visit our Parallels RAS page.

A remote access platform sits on the edge of your network and hands users a way in to your applications and data. That makes it a high-value target. Out of the box, Parallels RAS gives you a solid, modern architecture, but a default installation is not a hardened installation. Self-signed certificates, an "allow everyone" filtering rule and an unpatched Windows host underneath are all things that show up in real environments.

In this blog, we walk through the layers that matter when securing a Parallels RAS environment: the network and gateway, certificates and encryption, authentication, access control, session and data controls, the Windows hosts underneath, and monitoring. For each layer we explain what to configure and why.
This post is written for IT professionals who already run, or are about to deploy, a RAS Farm. The steps are based on Parallels RAS 22.0; menu names can differ slightly in other versions.

Start with the architecture

Security starts before you open the RAS Console. Decide where each RAS component lives, and which traffic is allowed between them.

Keep the Secure Gateway in a DMZ
The RAS Secure Gateway is the only component that should be reachable from the internet. Place it in a DMZ and publish only the gateway (or the HALB in front of it) through your firewall. The Connection Broker, RD Session Hosts, VDI hosts and Active Directory stay on internal networks and are never exposed directly.

Segment and restrict
If an attacker compromises one part of a flat network, everything else is at risk. So:

1. Separate the DMZ, the RAS infrastructure servers, the session hosts and your domain controllers into their own network segments or VLANs.
2. Allow only the ports RAS needs between those segments. The port reference in the Parallels RAS reference architecture guide lists them per component.
3. Limit inbound sources on the rules to known subnets or specific server IPs wherever possible, and use dedicated security groups for RAS and AD services if you run in a cloud environment.
4. Do not expose the RAS Console or management ports to the internet. Administrators should reach them through a management network or VPN.

The example below shows the flows for a basic deployment with one Secure Gateway, one Connection Broker and RD Session Hosts. Use it as a starting point and adapt it to your own environment:

Source	Destination	Port	Purpose
Internet clients	Secure Gateway (or HALB)	TCP 443	Parallels Client and User Portal sessions
Secure Gateway	Connection Broker	TCP 20002	Gateway communication with the Connection Broker
Secure Gateway	RD Session Hosts	TCP/UDP 3389	RDP connections
Connection Broker	RD Session Host Agent	TCP/UDP 30004	Agent communication
RD Session Host Agent	Connection Broker	TCP 20003	Agent communication back to the Connection Broker
Connection Broker	Secondary Connection Broker	TCP 20001, 20030	Redundancy
Connection Broker	Domain controllers	TCP 389, 636; TCP/UDP 88, 53	LDAP, LDAPS, Kerberos, DNS
Connection Broker	RADIUS / MFA server	UDP 1812, 1813	MFA authentication and accounting
Connection Broker	Parallels Licensing Server	TCP 443	Licensing

Ports depend on your RAS version and the features you use (HALB, Reporting, VDI, Enrollment Server). Check them against the RAS port reference before you build firewall rules.

_Note: RAS 22.0 adds limits on active connections for the Secure Gateway and Connection Broker API, with automatic blocking of abusive IP addresses through Windows Firewall rules._

Certificates and encryption

Traffic between users and the RAS Secure Gateway is always encrypted, but how well depends on your configuration.

Replace the self-signed certificate
By default, a self-signed certificate is installed on every RAS Secure Gateway. That works for a lab, but it trains users to click through certificate warnings, which is exactly the behavior you don't want. Use a certificate from a trusted public CA or from your enterprise CA instead. With an enterprise CA, Windows clients get the root or intermediate certificate from Active Directory automatically; other platforms need manual configuration.

Parallels RAS can generate a certificate signing request, import and export certificates, request Let's Encrypt certificates, and assign a certificate to Secure Gateways and HALBs from one place.

1. In the Parallels RAS Console, go to Farm and open the SSL Certificates (certificate management) section.2. Generate a certificate signing request, or choose Let's Encrypt if you want automated certificates.3. Import the issued certificate.
4. Assign it to your Secure Gateways and HALBs.5. Click Ok
6. Press Apply to commit the changes.

_Tip: use the certificate auditing function in the console to see which certificates are in use and when they expire. An expired certificate on the gateway is an outage, not just a warning._

_Note: RAS 22.0 can export RAS-managed certificates to a password-protected PFX file._

Restrict protocols and ciphers
The accepted TLS versions and cipher strength are configured per Secure Gateway.
1. In the Parallels RAS Console, go to Farm, select Secure Gateways and open the properties of the gateway.
2. Open the SSL/TLS tab.3. In the Accepted SSL versions drop-down box, choose the strictest option your clients support. The strictest choice is TLS v1.3 Only (Strong). Older options that still allow SSL v3, TLS 1.0 or TLS 1.1 should be avoided.
4. Set the Cipher strength to High, or enter a custom cipher string if your security policy requires it.
5. Click OK and Apply.

To verify the result, run the gateway through the Qualys SSL Labs server test. The RAS documentation recommends this as well. Your gateway needs to be reachable from the internet for this test, so run it against the published address.

Two more details are easy to forget:

• Set the connection mode on the Parallels Clients to Gateway SSL mode, so the connection between the client and the gateway is encrypted as well.
• If you use RDP over UDP for better WAN performance, protect it with DTLS. Leave Enable SSL on port selected on the gateway and use Gateway SSL mode on the clients.

Authentication

Anything exposed to the internet will be attacked, and a password alone will not stop it.

Enable multi-factor authentication
Parallels RAS supports MFA through its own integration options as well as RADIUS and SAML. Whichever you choose, apply it to all external access. In version 21.0, the client's public IP address can be passed to the RADIUS server as an attribute, and conditional RADIUS rules let you return a different authentication response per user under specific conditions. That allows policies such as stricter checks for connections from unexpected networks.

Use SAML SSO where you have an identity provider
If your organization already uses an identity provider (Microsoft Entra ID, for example), SAML SSO lets RAS rely on it for authentication, including its conditional access and MFA policies. Configure your IdP, import the RAS service provider metadata, and test with a pilot group before you roll it out. In RAS 22.0 SAML can be used as an MFA provider, enforced after the initial Active Directory validation.

Protect credentials on the client
Parallels Client for Windows integrates with the Windows Credential Manager as of version 21.0, so credentials are stored in the operating system's credential store instead of in RAS-specific storage. Make sure your clients are updated to a version that supports this.
Tip: always keep one break-glass administrator account that does not depend on the MFA provider, and store its credentials offline. If your MFA service has an outage you do not want to lock yourself out of the console.

Access control

Authentication decides who someone is. Filtering decides what that person is allowed to see.

One AD group per published resource
By default, a published resource is available to everyone who can connect to the Farm. Replace this with an Active Directory group per application or desktop. We described the full procedure, with screenshots, in our blog on published resource settings. In short:

1. In the Parallels RAS Console, go to Publishing and select the published resource.
2. Open the Filtering settings.
3. Set the default wildcard rule to Deny.
4. Create a new rule with the criteria Allow if and select the AD group.
5. Press Apply to commit the changes.
Use Deny rules only for explicit exceptions, and keep the number of rules low so the setup stays readable.

Separate tenants and environments
If you host multiple customers or strictly separated departments, use separate Sites within the same Farm. Applications, desktops and data are not shared between Sites, and you can still manage them from one console. Delegate console access with roles so that administrators only see what they need.

Session and data controls

A secure connection does not help if users can freely copy sensitive data out of the session.

Control redirection
The RAS client policies let you decide which local resources are redirected into a session: drives, printers, clipboard, USB devices, camera and so on. Disable everything you don't need, and enable the rest per user group instead of globally. Since version 21.0 you can also define which types of content may be copied through the clipboard and in which direction, for example allowing paste into the session but not copy out.

Use client policies
Client policies also let you restrict what is allowed on the endpoint side, for example which devices or client versions may connect. Combine this with the filtering rules described above to build access rules per user group.

Limit session lifetime
Set sensible idle and disconnected-session timeouts so that unattended sessions don't stay open. This applies in particular to published desktops with access to sensitive data.

Harden the hosts underneath

Parallels RAS runs on Windows, so the Windows hardening basics still apply. The RAS best practices guide has dedicated sections on this topic.

1. Patch regularly. Keep Windows Server(s), the RAS components and the Parallels Clients up to date. RAS 21.0 also refreshed third-party packages in the HALB appliance, which is another reason to stay current.
2. Lock down the RD Session Hosts. Remove local administrator rights for users, restrict what users can run (AppLocker or equivalent), and block access to the command prompt, PowerShell and the registry editor where users don't need them.
3. Secure RDP itself. Require Network Level Authentication and set the encryption level in line with your policy.
4. Run with least privilege. Use dedicated service accounts for RAS with only the permissions they need, and keep domain admin accounts off the session hosts.
5. Use endpoint protection on all RAS servers and session hosts, and add the exclusions recommended by the vendors.

_Tip: build your hardening into the template or golden image. Then every new host, whether RDSH or VDI, starts out secure and you avoid configuration drift._

_Note:In RAS 22.0 the support for Windows Server 2012 has been dropped on the RD Session Host agent._

Monitor and audit

Hardening is not a one-time job. Configurations drift, administrators make changes, and an attacker who gets in leaves traces, but only if you collect the right logs and know what to look for. Monitoring a RAS environment means combining three sources: RAS itself, the Windows hosts underneath it, and the systems around it, such as the firewall, the RADIUS server and your identity provider.

Settings audit; who changed what
Parallels RAS audits the modifications made to a Farm, including changes to components, objects, resources and users.
1. In the RAS Console, go to Administration and open the Audit tab.
2. Wait until the synchronization is finished. Each entry shows the Username, the Action (for example Create, Update, Connect, Disconnect or Switch site), the ID of the affected object and the Site.
3. On any pane, for example Farm > Site > RD Session Hosts, you can also use Tasks > Settings audit to see only the changes for that object and revert them if needed.

Pay particular attention to changes in published resource filtering rules, Secure Gateway SSL/TLS settings and client policies. Entries made by RAS services show up as System or Connection Broker; entries made by people should match a change ticket. A change outside your maintenance window needs an explanation. Not every change is tracked, so check the Administrator's Guide for the exceptions.

RAS logging and application auditing
• Auditing tab: under Farm > Site > Settings you find the Auditing tab, where you configure application auditing. The list of processes can be tuned, and Default resets it.
• Global logging tab: the same settings page lets you set the log level per RAS component: Standard, Extended or Verbose. Keep Standard unless Parallels support asks you to change it. Extended and verbose logging slow down the system, verbose significantly so, and the level returns to standard after the period you set.
• Retrieving logs: select a component and use Tasks > Troubleshooting > Logging > Retrieve to download a ZIP archive with the log files.

These logs are meant for troubleshooting. Do not treat them as your security audit trail. For detection, rely on the Settings audit, the Windows event logs and your network and RADIUS logs, and pull the RAS logs when you need to correlate events during an investigation.

_Note: Session recording is available as an experimental feature in RAS 22.0._

Windows event logs
Most of what happens to a user session ends up in the Windows event logs on the RAS servers, the session hosts and the domain controllers. These are the events to collect first:

Log	Event ID	Where	What it tells you
Security	4625	RAS servers, session hosts, domain controllers	Failed logon. Many failures for one account point to brute force; one source against many accounts points to password spraying. Check the status and sub status codes.
Security	4624	Session hosts, domain controllers	Successful logon. Look at logon type 3 (network, for example with NLA) and type 10 (RemoteInteractive) and compare with expected users and times.
Security	4740	Domain controllers	Account lockout. A wave of lockouts after failed logons often means someone is attacking the gateway.
Security	4672	Session hosts, RAS servers	Special privileges assigned at logon. An administrator logon on a session host is rarely expected.
TerminalServices-RemoteConnectionManager/Operational	1149	Session hosts	RDP user authentication succeeded, logged before the session is created.
TerminalServices-LocalSessionManager/Operational	21, 23, 24, 25	Session hosts	Session logon, logoff, disconnect and reconnect.
NPS (when used as RADIUS server)	6272, 6273	NPS server	Access granted or denied for each MFA request.

Keep in mind that with a gateway in the path, session hosts typically see the gateway's address and not the address of the user. To trace a logon back to its origin, correlate the Windows events with the firewall, HALB and gateway logs, and with the client public IP address that RAS 22.0 can pass to your RADIUS server.

Alerting
Collecting logs is not enough if nobody looks at them. Build alerts for events that indicate a problem. The thresholds below are starting points that you should tune to your environment:
• 10 or more failed logons (4625) for one account or from one source within 5 minutes.
• Any account lockout (4740) for an account that has access to RAS.
• Logons outside business hours, or from countries where you have no users.
• An administrator logon (4672) on a session host.
• A RAS component that goes offline, such as a Connection Broker, Secure Gateway or agent.
• A certificate that expires in less than 30 days.
• A Settings audit entry outside your maintenance window.

For RAS itself, configure the system event notifications under Farm > Site > Settings > Notifications. The RAS Performance Monitor adds dashboards for the RAS performance counters, which helps you to spot unusual spikes in sessions or gateway load. It is a web interface with its own security settings, so harden it like the rest of your environment.

Log collection and retention
• Forward the Windows Security and Terminal Services logs and your RAS server logs to your SIEM, with Windows Event Forwarding or an agent, so that the evidence is not only stored on the server an attacker has compromised.
• Size the Windows Security log, or set the retention, so that events are not overwritten within a few hours on a busy session host.
• Synchronize the time on all components, including the firewall and RADIUS server. Without a common time source you cannot build a reliable timeline.
• Make sure RAS administrators cannot delete data in the SIEM, and set the retention period according to your policy.

Review cadence

Frequency	What to review
Daily	Alerts, and the trend of failed logons and lockouts
Weekly	Settings audit, administrator logons on session hosts
Monthly	RAS Reporting for users, devices and applications (remove published resources nobody uses), and patch status
Quarterly	Certificates, filtering rules, client policies, firewall rules against your allowed-flows table, and a test of the break-glass account

Security checklist

Use this checklist to validate a new RAS deployment and as a recurring audit. Where possible, each item comes with a way to verify it, because a setting that looks right in the console is no proof that it works in practice.

Network and architecture
• Only the Secure Gateway (or HALB) is reachable from the internet. Verify with an external port scan of your public IP range: only the ports you intentionally published should respond.
• The Connection Broker, RD Session Hosts, VDI hosts and domain controllers have no inbound access from the internet. Verify with the same scan and a review of your NAT rules.
• The DMZ, RAS infrastructure, session hosts and domain controllers are in separate segments, and the allowed flows are documented in a table. Verify that the firewall rules match the table and that there are no any-any rules.
• The RAS Console and other management ports are only reachable from a management network or VPN.

Certificates and encryption
• All Secure Gateways and HALBs use a certificate from a trusted CA, and no self-signed certificates remain. Verify by connecting from a clean client: there should be no certificate warning.
• TLS is restricted to the strictest version your clients support, and the cipher strength is set to High or to your own cipher string. Verify with the Qualys SSL Labs server test: no SSL 3, TLS 1.0 or TLS 1.1.
• Parallels Clients use Gateway SSL mode, and RDP over UDP is protected with DTLS.
• Certificate expiry is monitored, with an alert at least 30 days in advance.

Authentication
• MFA is enforced for all external access. Verify with a test account from an external network: a logon without the second factor must fail.
• Conditional RADIUS rules or SAML SSO policies are tested, including the behavior when the MFA service is unavailable.
• RAS administrators use named accounts with delegated roles. There are no shared administrator accounts.
• A break-glass administrator account exists that does not depend on MFA. Its credentials are stored offline and the account is tested every quarter.
• Parallels Clients are updated to a version that supports Windows Credential Manager integration.

Access control
• Every published resource has the default wildcard rule set to Deny and an Allow rule for a dedicated AD group. Verify by testing with a user who is not a member of the group.
• AD groups used in filtering rules are reviewed, and accounts of people who left are removed.
• Separate customers or strictly separated departments are in separate Sites, and console access is delegated per role.

Session and data controls
• Drive, printer, clipboard, USB and camera redirection are disabled by default and enabled per user group through client policies. Clipboard direction is limited where possible.
• Idle and disconnected session timeouts are configured, especially for desktops with access to sensitive data.
• Published resources that nobody uses are removed. Verify with RAS Reporting.

Windows hosts
• Windows Server, the RAS components, the HALB appliance and the Parallels Clients are patched according to a documented schedule.
• Users have no local administrator rights on the RD Session Hosts, and application control (AppLocker or equivalent) is in place. The command prompt, PowerShell and the registry editor are blocked where users do not need them.
• Network Level Authentication is required, and the RDP encryption level follows your policy.
• RAS uses dedicated service accounts with only the permissions they need. Verify in the event logs that domain administrators do not log on to session hosts (event 4672).
• Endpoint protection is active on all RAS servers and session hosts, with the exclusions recommended by the vendors.
• New hosts are built from a hardened template, so there is no configuration drift.

Monitoring and audit
• The Settings audit is reviewed weekly, and every change to filtering rules, gateway settings and client policies matches a change ticket.
• Windows Security events (4624, 4625, 4740, 4672) and the Terminal Services logs are forwarded to your SIEM, and the time on all components is synchronized.
• Alerts exist for repeated failed logons, lockouts, logons outside business hours, offline RAS components and expiring certificates.
• The RAS log level is Standard, unless Parallels support asked you to change it temporarily.
• The RAS Farm configuration and your Windows servers are backed up, and you have tested a restore.
• The review cadence (daily, weekly, monthly and quarterly) is documented, and someone is responsible for each task.

Conclusion

Securing Parallels RAS is not about one switch. It is a set of layers: a clean network design, trusted certificates and strict TLS, strong authentication, least-privilege access, controlled data flows, hardened hosts and good monitoring. Each layer is simple to configure on its own, and together they make a RAS environment that is hard to attack and easy to audit.

Need help designing, deploying, or managing your Parallels RAS environment? Visit our Parallels RAS page or click here to contact us.