Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just discovered a computer serving sensitive data from MS SQL Server that appears to have virtually no security protection. I would like to protect this box as quickly as possible.

My problem is that I'm a Linux admin with no experience of Microsoft databases helping out in an remote office with no IT staff. (Also the installation is in Spanish so please forgive me if I'm mangling any names).

So I found a program called SQL Server Enterprise Manager (There's no version number in the 'about' dialog, but the copyright in the help files says '1988-2000') which lets me read all the data, create accounts and change passwords of any existing accounts. It doesn't ask me for a password.

How can I close this gaping hole in security?

Does this situation suggest the existence of other vulnerabilities that I should check for?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

You may be passing windows authentication to the server - and if you are a domain admin/computer admin you'll be able to get into any 2000 install and most 2005 installs.

After you figure out how you are connecting, you should do a security audit, first checking the server security roles, to see who is listed as sysadmin. This should be under the security node under the database instance, not under individual databases - I'm referring to the tree structure hierarchy in EM.

Then you can delve into databases if needed to lock permissions down and make things secure and stable. You may also want to change the sa password, which is a 'backdoor' SQL login for you to get in when you are locked out.

http://technet.microsoft.com/en-us/library/cc966456.aspx

I'd also try running the best practices analyzer.

http://www.microsoft.com/downloads/details.aspx?familyid=b352eb1f-d3ca-44ee-893e-9e07339c1f22&displaylang=en

share|improve this answer
    
Thanks. Yes, it looks like many users are horrendously overprivileged and under... passworded. I'm going to enforce passwords and prune permissions, though since the only db account I can see is sa I worry they'll lose access throught the db interface app when their Windows accounts don't have db permissions, unless it auths using sa which sounds like it would be a very bad situation too. –  Ian Mackinnon Sep 8 '10 at 16:34
    
Apps using sa is definitely a no-no. It is unfortunately common when developers get their hands on a machine and don't bother with security to make things easier. You should determine exactly how this system is being used before changing permissions and disrupting it. You could watch some activity using sql server profiler to create a trace. You could also fire up activity monitor inside EM to see the current connections. –  Sam Sep 8 '10 at 16:39
    
And if the only security account on the entire machine is sa, you should create new SQL accounts with the proper security or start making the apps authenticate with windows auth (preferred). Windows global security groups are your friend. –  Sam Sep 8 '10 at 16:41
    
Suggesting those tools was really helpful, thank you! –  Ian Mackinnon Sep 8 '10 at 16:46
    
Great - I've added one more link to the answer - that should scan for misconfiguration. –  Sam Sep 8 '10 at 17:52
add comment

Is the problem that this computer is actually actively accessing and exploiting data on your SQL server or is it that you're able to access the SQL server, seemingly with no restriction... because those are two different things entirely. Also some details would be helpful, like which version and edition of SQL server are you running?

SQL Server Enterprise Manager is used to manage SQL 2000 and earlier versions. SQL Server Management Studio is used to manage SQL 2005 and later versions.

share|improve this answer
    
The problem is that access is currently unrestricted. I don't have any evidence of exploitation. I can't find a version number anywhere, but since "Enterprise Manager" is the closest translation ("Administrador Corporativo" here), given what you say it must be SQL 2000. Thanks. –  Ian Mackinnon Sep 8 '10 at 15:52
add comment

If you cannot remove the SQL Server Enterprise Manager, you could remove the SQL Server Registration or almost check the flag "ask always username and password" in the Server Registration.

Check also the sa (root) password for sql server, because until SQL Server 2000 there was the option to leaave it blank!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.