0

I know MSSQL can have various login modes, windows only, windows + sql, etc. named pipes, tcp/ip.

Really I'm not sure what we should use. We have two servers each with IIS + MSSQL, network load balancing for IIS and DB mirroring for MSSQL.

Want to secure it so only the two servers can access MSSQL on each server (and obviously so the mirroring works).

Currently just the one server is in production and I think TCP/IP/named pipes is on, windows + sql authentication but using the firewall, blocked access to the TCP port.

What's the best way of setting this up?

2 Answers 2

0

Named pipes and TCP/IP aren't login modes, they're connection methods. That being said you could use the Windows Firewall on the host servers (simple) or use IPSEC (complicated).

4
  • So really doesn't matter how I set up connection methods/login modes as long as the firewal is set to only accept from itself and the other server?
    – user59135
    Nov 4, 2010 at 0:04
  • That would do the trick, although you could reduce the "attack surface" by only allowing a specific login mode and connection method. It depends on how granular you want to get.
    – joeqwerty
    Nov 4, 2010 at 0:12
  • If we restrict to Windows only authentication, how would the other web server connect as it would need a local account username/pass to work. May be easier just to use SQL authentication.
    – user59135
    Nov 4, 2010 at 0:15
  • I hadn't thought of that. I assumed these server were memebers of an AD domain.
    – joeqwerty
    Nov 4, 2010 at 0:24
0

The most secure way would be to not hook the SQL servers up directly to a production network at all and use a (physically or logically) separate database network instead. That said, a firewall should be perfectly sufficient, as joeqwerty pointed out.

The one caveat to the firewall approach is that since named pipes use standard Windows RPC mechanisms and therefore connect over ports 139 and 445, you may have difficulty blocking these ports without affecting other traffic. (You almost certainly don't want these ports open to just anyone anyway, but keep an eye out for exclusions on your management networks if you need them.)

1
  • Thanks, will read up a bit more and probably disable named pipes if possible then.
    – user59135
    Nov 4, 2010 at 9:47

You must log in to answer this question.