Re: SQL Server Issues ::: ( how to avoid this issues )

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Tibor Karaszi (tibor_please.no.email_karaszi_at_hotmail.nomail.com)
Date: 09/23/04 

Date: Thu, 23 Sep 2004 09:10:18 +0200

> DISK INIT cannot do anything with that issue... i tried that

Typo from my side. Should have been DISK REINIT. Anyhow, my point is that it is possible to get to
the data through the database files both in the new MS SQL Server architecture as well as the old MS
SQL Server architecture (and I assume that Sybase haven't changed this). The old/Sybase architecture
is just slightly more difficult to understand., I grant you that.

> if u r trying exec sp_revokelogin [BUILTIN\Administrators] it wont give any
> effect in WIN XP Pro. especially with MSDE...

Sorry, but that is not enough evidence to convince me. I tried it on XP Pro as well, and I couldn't
logon after removing both BUILTIN\Administrators and CompyterName\Tibor. I had to login using sa and
add those windows accounts back before I could perform Windows logins again. I suspect that you have
other windows accounts on your system.

> if we cannot put any
> security in the DATA file level,

As already mentioned, do the encryption at the file system level. 

-- 
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Danny John" <DannyJohn@discussions.microsoft.com> wrote in message
news:D94F669E-859C-432C-A111-FDDB901759EA@microsoft.com...
> DISK INIT cannot do anything with that issue... i tried that
> if u r trying exec sp_revokelogin [BUILTIN\Administrators] it wont give any
> effect in WIN XP Pro. especially with MSDE...
> You guys are thinking just in the higher level of IT security policies...
> in small to mid ranged trading companies, that sort of things will not help.
> in some countries, the Tax department will copy the database or files from
> the computer and check for the SECRETE details... if we cannot put any
> security in the DATA file level, how the trading companies can trust the
> database and the software vendors ????
>
>
> "Tibor Karaszi" wrote:
>
> > > Even if you are using exec sp_revokelogin [BUILTIN\Administrators] the domain
> > > admin can log to the SQL Server.
> >
> > I fail to see how. I just tested that, and I can sure *not* login to my SQL Server!
> >
> >
> > > in Sybase ASE and all, if u r replacing the DAT files with other database's
> > > DAT files, it wont work unless u supply the exact parameters... so we can say
> > > the DAT files are secured in all aspects.
> >
> > Security by obscufation is generally not consider a very good security method. Assuming Sybase
uses
> > DISK INIT and DISK REFIT, then anyone who work at the dba level with Sybase or MS pre-7.0 will
> > understand how to use these commands.
> > -- 
> > Tibor Karaszi, SQL Server MVP
> > http://www.karaszi.com/sqlserver/default.asp
> > http://www.solidqualitylearning.com/
> >
> >
> > "Danny John" <DannyJohn@discussions.microsoft.com> wrote in message
> > news:A7174704-13D6-4CBF-9A5F-A368501CAB16@microsoft.com...
> > > Even if you are using exec sp_revokelogin [BUILTIN\Administrators] the domain
> > > admin can log to the SQL Server.
> > >
> > > 2. For a big company setup we can put IT policies... even in small..
> > > most of the SQL Server mid-ranged clients are Trading companies... and most
> > > of them have some SECRETE data... and some times the Govt. agencies will take
> > > the system and check the database and all.. in this case if there is no stong
> > > database security, the traderes will be really into deep truble...
> > > in Sybase ASE and all, if u r replacing the DAT files with other database's
> > > DAT files, it wont work unless u supply the exact parameters... so we can say
> > > the DAT files are secured in all aspects.
> > >
> > > Danny
> > > "Tibor Karaszi" wrote:
> > >
> > >> > You *cannot* keep your domain admins out of SQL Server.
> > >>
> > >> Hmm, what about removing the BUILTIN\Administrators group and not add another windows group
(as
> > >> sysadmin)? However, the administrators can stop SQL Server, copy the files and attach the
files
> > >> to
> > >> another SQL Server...
> > >>
> > >>
> > >> > If you really want to protect the data from everyone including domain
> > >> > admins, then consider encrypting it before it's put into the database,
> > >> > then no-one can read it except the people with the key. There should be
> > >> > third party products available that can do this.
> > >>
> > >> The built-in encryption in NTFS ("EFS") is supported by SQL Server. I'm not a security
person, so
> > >> I
> > >> can't say how easy this is to crack, though...
> > >> -- 
> > >> Tibor Karaszi, SQL Server MVP
> > >> http://www.karaszi.com/sqlserver/default.asp
> > >> http://www.solidqualitylearning.com/
> > >>
> > >>
> > >> "Mark Allison" <marka@no.tinned.meat.mvps.org> wrote in message
> > >> news:%23t$oEYHoEHA.3556@TK2MSFTNGP10.phx.gbl...
> > >> > Danny,
> > >> >
> > >> > 1.
> > >> > SQL Server 2000 has two modes Windows Only and, SQL Server and Windows
> > >> > (Mixed Mode). SQL only mode was last seen in SQL 6.5.
> > >> >
> > >> > You *cannot* keep your domain admins out of SQL Server. There's nothing
> > >> > you can do to stop it. They are a local admin on every machine in the
> > >> > domain. If you create a SQL Server DBA Group and only assign that as
> > >> > sysadmin in SQL Server, then they can just add themselves to that group
> > >> > if they like.
> > >> >
> > >> > This sort of thing should be governed by trust, and perhaps corporate IT
> > >> > policy, that only the DBAs are allowed access to SQL Server.
> > >> >
> > >> >
> > >> > 2.
> > >> > If you do not allow people access to the physical machine that SQL
> > >> > Server is running on, then they won't be able to get to the physical
> > >> > data files, so this shouldn't be a worry. Only allow domain admins and
> > >> > DBAs access to the database server.
> > >> >
> > >> > If you really want to protect the data from everyone including domain
> > >> > admins, then consider encrypting it before it's put into the database,
> > >> > then no-one can read it except the people with the key. There should be
> > >> > third party products available that can do this.
> > >> >
> > >> > --
> > >> > Mark Allison, SQL Server MVP
> > >> > http://www.markallison.co.uk
> > >> >
> > >> > Looking for a SQL Server replication book?
> > >> > http://www.nwsu.com/0974973602m.html
> > >> >
> > >> >
> > >> > Danny John wrote:
> > >> > > Hi,
> > >> > >   I'm a Sybase ASE DBA. now we are planning to migrate our
> > >> > > applications to MS SQL Server. and we purchased the
> > >> > > Standard edition of MS SQL Server 2000.
> > >> > >
> > >> > > 1. Is it possible to restrict the Windows users (
> > >> > > Administrators, and users ) from accessing SQL Server ?
> > >> > > ie. Only SQL Server Authentication is enabled.
> > >> > > Normally in most of the companies, except bigger
> > >> > > companies, the hardware/network guys will be knowing the
> > >> > > Administrator password and all. and they wont be DBAs if
> > >> > > the windows authentication is enabled any of that guys can
> > >> > > play with it.
> > >> > > sp_denylogin is not a solution for it. coz every time they
> > >> > > can create new users.
> > >> > >
> > >> > > 2. When we are creating a database we have to provide
> > >> > > the Data and Log files. We don't want to share the
> > >> > > information of the database to others, but in MS SQL
> > >> > > Server .
> > >> > > Suppose we created a database DB1, with Data File
> > >> > > d:\Data\MyData.Dat and Log file D:\Data\MyLog.Dat and
> > >> > > making some secrete transactions in it.
> > >> > >
> > >> > > Now we are creating a new database called DB2 with Data
> > >> > > File Z:\Data\DataZ.Dat and Log file Z:\Data\LogZ.Dat. Now
> > >> > > we are stopping the SQL Server and
> > >> > > copying the DB1 files (d:\Data\MyData.Dat and
> > >> > > D:\Data\MyLog.Dat ) to Z:\Data and renaming them as
> > >> > > Z:\Data\LogZ.Dat and Z:\Data\DataZ.Dat.
> > >> > >
> > >> > > Start the SQL Server, now you can see all the DB1 data in
> > >> > > DB2..
> > >> > >
> > >> > > That means anyone can see my secrete data in this way.
> > >> > >
> > >> > >
> > >> > >
> > >> > > Any suggestions,
> > >> > > Thanks in advance.
> > >> > > Danny
> > >>
> > >>
> > >>
> >
> >
> >

Relevant Pages

  • Re: SQL or Access DB
    ... As far as encryption goes though... ... with Sql Server you can use SQL DMO and encrypt your stored procedures ... installation - Security was absolutely critical and in most instances, ... > then we create a nice gui around this database and sell it to automotive ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Is there any way to prevent hacker trying to guess sa password?
    ... and port 1433 will not be open. ... If someone can crash SQL Server by connecting to port 1433, ... You don't need multiple security experts. ...
    (microsoft.public.sqlserver.security)
  • Re: Getting to the bottom of MSDE network connection problems ...
    ... Brilliant, Nick, especially the explanation for local network user being ... authenticated as GUEST in WinXP SP2. ... > on a desktop OS like XP (meaning that, you can not compare SQL Server ... > again and selected the security tab. ...
    (microsoft.public.sqlserver.msde)
  • [NT] SQL Extended Procedure Functions Contain Unchecked Buffers
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SQL Server 7.0 and 2000 provide extended stored procedures, ... Several of the Microsoft-provided extended stored procedures have been ... Exploiting the flaw could enable an attacker to either cause the SQL ...
    (Securiteam)
  • RE: Login failed for user (null).
    ... used at signon to authenticate in SQL Server. ... connect the remote SQL Server database), is there any other data accessing ... What's the security identity used to access the remote SQL Server, ... the worker process identity. ...
    (microsoft.public.dotnet.framework.aspnet.security)