3

I've just discovered a computer serving sensitive data from MS SQL Server that appears to have virtually no security protection. I would like to protect this box as quickly as possible.

My problem is that I'm a Linux admin with no experience of Microsoft databases helping out in an remote office with no IT staff. (Also the installation is in Spanish so please forgive me if I'm mangling any names).

So I found a program called SQL Server Enterprise Manager (There's no version number in the 'about' dialog, but the copyright in the help files says '1988-2000') which lets me read all the data, create accounts and change passwords of any existing accounts. It doesn't ask me for a password.

How can I close this gaping hole in security?

Does this situation suggest the existence of other vulnerabilities that I should check for?

3 Answers 3

4

You may be passing windows authentication to the server - and if you are a domain admin/computer admin you'll be able to get into any 2000 install and most 2005 installs.

After you figure out how you are connecting, you should do a security audit, first checking the server security roles, to see who is listed as sysadmin. This should be under the security node under the database instance, not under individual databases - I'm referring to the tree structure hierarchy in EM.

Then you can delve into databases if needed to lock permissions down and make things secure and stable. You may also want to change the sa password, which is a 'backdoor' SQL login for you to get in when you are locked out.

http://technet.microsoft.com/en-us/library/cc966456.aspx

I'd also try running the best practices analyzer.

http://www.microsoft.com/downloads/details.aspx?familyid=b352eb1f-d3ca-44ee-893e-9e07339c1f22&displaylang=en

5
  • Thanks. Yes, it looks like many users are horrendously overprivileged and under... passworded. I'm going to enforce passwords and prune permissions, though since the only db account I can see is sa I worry they'll lose access throught the db interface app when their Windows accounts don't have db permissions, unless it auths using sa which sounds like it would be a very bad situation too. Sep 8, 2010 at 16:34
  • Apps using sa is definitely a no-no. It is unfortunately common when developers get their hands on a machine and don't bother with security to make things easier. You should determine exactly how this system is being used before changing permissions and disrupting it. You could watch some activity using sql server profiler to create a trace. You could also fire up activity monitor inside EM to see the current connections.
    – Sam
    Sep 8, 2010 at 16:39
  • And if the only security account on the entire machine is sa, you should create new SQL accounts with the proper security or start making the apps authenticate with windows auth (preferred). Windows global security groups are your friend.
    – Sam
    Sep 8, 2010 at 16:41
  • Suggesting those tools was really helpful, thank you! Sep 8, 2010 at 16:46
  • Great - I've added one more link to the answer - that should scan for misconfiguration.
    – Sam
    Sep 8, 2010 at 17:52
0

Is the problem that this computer is actually actively accessing and exploiting data on your SQL server or is it that you're able to access the SQL server, seemingly with no restriction... because those are two different things entirely. Also some details would be helpful, like which version and edition of SQL server are you running?

SQL Server Enterprise Manager is used to manage SQL 2000 and earlier versions. SQL Server Management Studio is used to manage SQL 2005 and later versions.

1
  • The problem is that access is currently unrestricted. I don't have any evidence of exploitation. I can't find a version number anywhere, but since "Enterprise Manager" is the closest translation ("Administrador Corporativo" here), given what you say it must be SQL 2000. Thanks. Sep 8, 2010 at 15:52
0

If you cannot remove the SQL Server Enterprise Manager, you could remove the SQL Server Registration or almost check the flag "ask always username and password" in the Server Registration.

Check also the sa (root) password for sql server, because until SQL Server 2000 there was the option to leaave it blank!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .