Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know MSSQL can have various login modes, windows only, windows + sql, etc. named pipes, tcp/ip.

Really I'm not sure what we should use. We have two servers each with IIS + MSSQL, network load balancing for IIS and DB mirroring for MSSQL.

Want to secure it so only the two servers can access MSSQL on each server (and obviously so the mirroring works).

Currently just the one server is in production and I think TCP/IP/named pipes is on, windows + sql authentication but using the firewall, blocked access to the TCP port.

What's the best way of setting this up?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Named pipes and TCP/IP aren't login modes, they're connection methods. That being said you could use the Windows Firewall on the host servers (simple) or use IPSEC (complicated).

share|improve this answer
    
So really doesn't matter how I set up connection methods/login modes as long as the firewal is set to only accept from itself and the other server? –  user59135 Nov 4 '10 at 0:04
    
That would do the trick, although you could reduce the "attack surface" by only allowing a specific login mode and connection method. It depends on how granular you want to get. –  joeqwerty Nov 4 '10 at 0:12
    
If we restrict to Windows only authentication, how would the other web server connect as it would need a local account username/pass to work. May be easier just to use SQL authentication. –  user59135 Nov 4 '10 at 0:15
    
I hadn't thought of that. I assumed these server were memebers of an AD domain. –  joeqwerty Nov 4 '10 at 0:24
add comment

The most secure way would be to not hook the SQL servers up directly to a production network at all and use a (physically or logically) separate database network instead. That said, a firewall should be perfectly sufficient, as joeqwerty pointed out.

The one caveat to the firewall approach is that since named pipes use standard Windows RPC mechanisms and therefore connect over ports 139 and 445, you may have difficulty blocking these ports without affecting other traffic. (You almost certainly don't want these ports open to just anyone anyway, but keep an eye out for exclusions on your management networks if you need them.)

share|improve this answer
    
Thanks, will read up a bit more and probably disable named pipes if possible then. –  user59135 Nov 4 '10 at 9:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.