Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a desktop application connecting to SQL Server directly, I see a lot of posts saying you shouldn't expose SQL Server directly to the internet but none say why. Some background:

  • Scalability, load balancing and other performance criteria are not an issue for my scenario
  • My app needs to work locally (with local SQL Server) or on with a remote repository so that multiple users can share data (hosted SQL Server, which is my question)

I noticed connecting to SQL Azure looks like it's very much like a standard remote SQL Server (

I understand that opening any ports is an inherit vulnerability but that can't be the only reason. I must be missing something but I'm not sure what?

What's a real alternative other than deploying the lower half of my application as a web service?

share|improve this question

There are several reasons why, but the most relevant one is that somebody who is not experienced in both SQL server and network security will likely make one or more common mistakes.

For example, you could be using the "sa" SQL login to connect, which is the default sysadmin account and has total control over SQL server.

Or you could be using another SQL Server login, that has a weak password, so an attacker can try a brute-force attack to elevate his privileges.

Or you could have left some default read-only user acocunt enabled (for this or any other application), which will be actively scanned for by attackers and exploit scripts, so they can retrieve data from your database.

Some good measures to protect yourself from the most basic remote attacks:

  • limit connectivity to those IPs and clients you trust
  • use Windows integrated authentication whenever possible, and disable any logins with weak passwords
  • if you must use SQL Server authentication, rename/disable the sa login and set strong passwords (>10 chars) on all logins
share|improve this answer
Thanks for the post. I've disabled sa, my only other sysadmin is the windows user, all my other logins have only access to one db (as per standard) and have zero access to any higher level assets. Good passwords are in far so last thing, some of my users have dynamic IP but I'm considering limiting access to my country's IP range – Alex Oct 18 '12 at 9:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.