What is the best practices are supposed to be for MS SQL authentication?
From: Jay (Jay4050_at_hotmail.com)
Date: 02/23/04
- Next message: Craig McLachlan: ""Yukon" version control"
- Previous message: anonymous_at_discussions.microsoft.com: "jdbc permissions"
- In reply to: Hubco: "What is the best practices are supposed to be for MS SQL authentication?"
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 23 Feb 2004 11:31:23 -0800
1) First, make sure to patch and upgrade your sql clients
and sql servers with latest service packs and security
fixes. This will make sure that passwords are not stored
in clear text form.
2) sa user should not be used for any application or even
for administration
3) assign strong password to sa
4) create separate sql users for applications and for
administration and assign them required permissions
5) use a local NT user with minimum permissions on local
box as service startup account
6) if you have a publicly accessible sites, then you
should put your webservers behind firewall, then database
servers, then another firewall and only one way
communication should be allowed from Webservers to sql
server so that if sql server is compromised then it can't
affect your webservers. No communication should be allowed
from DMZ to LAN, and only open necessary ports for one
way communication from specific PCs in LAN to sql server.
7) you can install a certificate on sql server and encrypt
any communication to and from sql server. Passwords are
always encrypted whether you are using encryption or not.
>-----Original Message-----
>Hi There;
>I have few SQl 2000 server in my site and I was wondering
about SQL security and I like to know:
>What is the best practices are supposed to be for MS SQL
authentication? Is it NT/2000 Authentication or SQL, and
is there a way to encrypt the authnication and make sure
that is not save on Server or Worksation as clear text.
Please let me know.
>
>Thank you.
>.
>
- Next message: Craig McLachlan: ""Yukon" version control"
- Previous message: anonymous_at_discussions.microsoft.com: "jdbc permissions"
- In reply to: Hubco: "What is the best practices are supposed to be for MS SQL authentication?"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
