Close port 3389.Keep the desktop.
Exposed RDP is one of the most common ransomware entry points. SSHepherd closes port 3389 and keeps remote desktop working.
Port 3389 is hunted.Day and night.
An internet-reachable RDP endpoint is actively hunted. Access to exposed RDP hosts is bought and sold, and credential-stuffing against 3389 runs continuously against every routable address.
Guessing gets harder. A flaw in RDP itself can still be reached before anyone logs in.
Scanners check every port and recognise RDP by how it answers, not by its number.
It narrows the way in. The gateway is now the internet-facing service, with its own scans and CVEs.
SSHepherd doesn’t guard port 3389.It closes it.
The port is closed.Not hidden.
SSHepherd closes the listening port on the Windows host. There is no RDP socket accepting inbound connections, and no gateway standing in for one.
The host connects outbound to the SSHepherd broker. Authorised administrators authenticate at the broker and their desktop session is carried back over that outbound connection.
Only authorised identities are admitted. Every session can be monitored, recorded and ended on demand.
Developed by Full Armor Corporation. Distributed, deployed and supported across Southeast Asia by Auris.
- Nothing listens inbound
- Access via broker only
- Every session monitored
Your team keeps working.Scanners get nothing.
Administrators connect with the Remote Desktop client they already use.
There is no internet-facing RDP service, so nothing on that path to keep patched against the next RDP CVE.
RDP sessions can be watched in real time and terminated immediately if something looks wrong.
Sessions are recorded and exportable, which is usually what an auditor is asking for.
Watch it work.
SSHepherd® with Windows RDP. A recorded demo from Full Armor, the developer of SSHepherd®.
Common questions.
Do administrators need a new remote desktop client?
No. The standard Remote Desktop client is used exactly as before. What changes is that the server no longer has an inbound listening port.
How is this different from an RDP gateway or a VPN?
Both terminate inbound connections on a service that is itself exposed and must be patched. SSHepherd has no inbound listener at all — the protected host dials out, so there is nothing on the perimeter to attack.
Can a session be cut off mid-connection?
Yes. Any active session can be terminated on demand from the SSHepherd console.
Does it work for cloud and on-premise Windows servers?
Yes — on-premise, cloud, physical and virtual hosts use the same model.
See it onyour own servers.
Tell us roughly what you run: how many servers, and whether they are on-premise or in the cloud. We will set up a demo with an engineer and reply within one business day.