I know MSSQL can have various login modes, windows only, windows + sql, etc. named pipes, tcp/ip.

Really I'm not sure what we should use. We have two servers each with IIS + MSSQL, network load balancing for IIS and DB mirroring for MSSQL.

Want to secure it so only the two servers can access MSSQL on each server (and obviously so the mirroring works).

Currently just the one server is in production and I think TCP/IP/named pipes is on, windows + sql authentication but using the firewall, blocked access to the TCP port.

What's the best way of setting this up?


Named pipes and TCP/IP aren't login modes, they're connection methods. That being said you could use the Windows Firewall on the host servers (simple) or use IPSEC (complicated).

  • So really doesn't matter how I set up connection methods/login modes as long as the firewal is set to only accept from itself and the other server? – user59135 Nov 4 '10 at 0:04
  • That would do the trick, although you could reduce the "attack surface" by only allowing a specific login mode and connection method. It depends on how granular you want to get. – joeqwerty Nov 4 '10 at 0:12
  • If we restrict to Windows only authentication, how would the other web server connect as it would need a local account username/pass to work. May be easier just to use SQL authentication. – user59135 Nov 4 '10 at 0:15
  • I hadn't thought of that. I assumed these server were memebers of an AD domain. – joeqwerty Nov 4 '10 at 0:24

The most secure way would be to not hook the SQL servers up directly to a production network at all and use a (physically or logically) separate database network instead. That said, a firewall should be perfectly sufficient, as joeqwerty pointed out.

The one caveat to the firewall approach is that since named pipes use standard Windows RPC mechanisms and therefore connect over ports 139 and 445, you may have difficulty blocking these ports without affecting other traffic. (You almost certainly don't want these ports open to just anyone anyway, but keep an eye out for exclusions on your management networks if you need them.)

  • Thanks, will read up a bit more and probably disable named pipes if possible then. – user59135 Nov 4 '10 at 9:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy