Melville Thomson's Blog : Security

Configuring SQL Server 2005 Logins

Melville — Thu, 31 Aug 2006 01:36:00 GMT

One question I have been asked is about SQL Server 2005 Logins. Logins are the Server principles which give user’s access to SQL Server. We can create Logins using the SQL Server Management Studio (SSMS) graphically or use the CREATE LOGIN statement.
The syntax for a windows login

CREATE LOGIN [Domain\User] FROM WINDOWS
The password and account policy is managed by Active Directory.

The biggest change is with SQL Server logins the syntax is

CREATE LOGIN login_name WITH PASSWORD=’password’

You can use the following options when you create the login
MUST_CHANGE The user should change the password at the next login.
CHECK_EXPIRATION SQL Server will check the Windows expiration policy for the SQL Server login.
CHECK_POLICY SQL Server will apply the local Windows password policy on SQL Server logins.

For full syntax see CREATE LOGIN (Transact-SQL)

SQL Server 2005 Encryption

Melville — Fri, 25 Aug 2006 19:23:00 GMT

Steve asked me about encryption in SQL Server 2005. I have found a few areas of information that are useful. In BOL there is an article about the Encryption Hierarchy this explains quite a lot about how it is organised. I quite like it because it has a diagram which is easy to understand.

SQL Server encrypts data with a hierarchical encryption key management infrastructure. Each layer encrypts the layer below it.

The first is the service master key
This secures:

linked server passwords
Connection strings
Account credentials
All database master keys

There are optional database master key's
This is used for:

Certificates
Asymmetric Keys
Symmetric Keys

There are a number of Cryptographic Functions in Transact-SQL these support encryption, decryption, digital signing and the validation of digital signatures.

To see what is going on there are a number of Security Catalog Views which show you cryptographic information these are useful.

One tip I would recommend is to backup the service master key and secure it offsite for safety you can use ‘BACKUP MASTER KEY’ and ‘RESTORE MASTER KEY’ Transact-SQL statements.

BACKUP SERVICE MASTER KEY TO FILE = 'c:\temp_backups\keys\service_master_key' ENCRYPTION BY PASSWORD = '3dH85Hhk003GHk2597gheij4';
GO

RESTORE SERVICE MASTER KEY FROM FILE = 'c:\temp_backups\keys\service_master_key' DECRYPTION BY PASSWORD = '3dH85Hhk003GHk2597gheij4';
GO

But very important
When the service master key is restored, SQL Server decrypts all the keys and secrets that have been encrypted with the current service master key, and then encrypts them with the service master key loaded from the backup file.
If any one of the decryptions fails, the restore will fail. You can use the FORCE option to ignore errors, but this option will cause the loss of any data that cannot be decrypted.

SQL Server Security issues reduced

Melville — Thu, 30 Mar 2006 16:53:00 GMT

In Dan's Blog he talks about the Sans Top 20 Security Vulnerabilities. The main point being Microsoft SQL Server not making the top 20 but other database systems did. I looked back at previous years and we had our own section of vulnerabilities. I am wondering if that was because we were more open? Or are the different industries looking harder at security issues more now than in the past.

The Sans site publishes the list and provides useful links and tips to resolve and detect the various Database vulnerabilities mentioned.