Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i am preparing for Microsoft exam 70-432 SQL Server 2008 . In the book i read, its highly recommended that you use separate log-in for each SQL Service. But i am unable to understand what is a benefit in using separate USER?

Please let me know if anyone has an idea about this.

Regards, fayalif

share|improve this question
add comment

3 Answers

Security. If you have two different databases you can assign different users; that way if one service was to get hacked it's limited to it's own data. When you assign different users it's assumed you're also configuring file security as appropriate.

share|improve this answer
    
He was talking about the user accounts used by SQL Server's services, not the actual database logins. –  Massimo Aug 5 '10 at 16:42
    
@Massimo: Yes, and so am I. If you have multiple SQL Instances on the same computer (or even the various components SQL Engine, Agent, SSRS, etc) many times they don't need full access to each other's data. It's a good idea to lock them out of messing with each other. You can't assign file security to a SQL User account either. –  Chris S Aug 5 '10 at 18:36
    
Oh, that'ok then, I didn't get that your "two different databases" actually meant different instances; sorry. –  Massimo Aug 5 '10 at 18:42
add comment

It provides a security boundary. The SQL Engine needs access to stuff that the SQL agent does not need access to. You should only give rights to any account for the items that it needs.

share|improve this answer
add comment

This is stellar advice for all services, not just those associated with SQL Server. It's very good advice to create a custom user account for any service that you run (beyond those that come with the operating system itself). Grant only the permissions that the service needs to its user account, and don't run any other services using that same user account, (unless it's absolutely necessary; well designed services shouldn't require use of the same user account across services).

Let's say for example that an attacker discovers a buffer overrun vulnerability in service X. If he's able to exploit that to run arbitrary code in service X, he's now got control of the user account under which X is running. And if he knows anything about Windows system programming, he'll be able to quickly gain access to any other services that are running under that same account. He'll be able to access any network resources that those services can access as well, and perhaps start attacking other machines from there.

Another problem with using the same account for multiple services is that it has a tendency to gather privilege. It's like a snowball: each additional service that runs under the user account requires a different set of privileges, so you find yourself having to add more and more privilege to that one user account. Not to mention that at the same time you're adding more and more attack surface area (more services) that an attacker can go after. You're simultaneously providing a juicier target and weakening your defenses at the same time.

HTH

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.