Tag Info

New answers tagged

1

we're going to allow an external partner (i.e. not an employee of our org) access to this server, like so: Their credentials will own (belong to db_owner) a couple databases. A concern along with the service account being the same on multiple instances is that an outside entity can escalate their permissions quite easily. Given that outside entity is ...


1

Microsoft Best Practices recommend using separate service accounts for all services. See http://msdn.microsoft.com/en-us/library/ms144228.aspx#isolated_services for details. The salient points being: Isolate Services Isolating services reduces the risk that one compromised service could be used to compromise others. To isolate services, consider ...


1

You DB should probably not be publicly accessible, unless it really has to be. You can make DB accessible only to localhost, which would allow your web server to talk to it and you can use it over SSH or Remote Desktop or what have you. You'll want to watch out for brute-force attempts on your logins. I'm not sure what the Windows equivalent of Fail2Ban is, ...


1

There are not alot of dangers per say, other than some far-reaching ones suggested here. As was mentionned, it is hard to have auto-executing stuff in a database backup itself. It needs some kind of exterior triggerring mechanism. Get an old laptop/desktop and an evaluation version of your Database software (SQLExpress) if licensing is an issue. Copy the ...


1

You're handed a database backup and told to restore it to a server (that's already hosting other databases), but are given no useful information about what the backup contains or whether the source should be trusted. Nice. You demand a signed written statement from whoever is telling you to do this that they accept full responsibility for the ...


6

The question focuses mostly on a backup containing malware, but it's also possible to get unwanted and potentially malicious behaviour from the restore operation itself. I've accidentally found in the past that it's possible to crash SQL Server by trying to restore a corrupt backup file that causes SQL Server to try to read past the end of the backup file ...


8

I'm reaching here, but I can think of at least one dangerous scenario: if you restore a database that has a filetable, those files are now on your network by default (and specifically, on your SQL Server). You could restore a virus. That by itself won't do anything, of course - the virus doesn't suddenly become sentient - but if your users then try to ...


4

What risk is there is restoring an unknown database from an unknown source? None. What risk is there in letting an unknown application connect using a sysadmin account to connect to that database and start running code? LOTS! If the application account only has rights within the database and no server level access then there's nothing it can really do ...


2

Yes there is please follow below Microsoft web resource.It requires you to have admin access to windows machine and then start SQL server with -m option and create login in SQL server and grant it admin privileges. http://msdn.microsoft.com/en-us/library/dd207004.aspx Hope this helps


10

There are some prevention steps that you could do. Make sure no one but one sysadmin has access to the restored database. Put the db in single user mode after the restore is completed. Check the code inside all stored procedures and functions and triggers inside this database. Perform a dbcc checkdb to make sure there are no integrity issues. Check ...


6

RESTORE VERIFYONLY would seem to be a good first step. The ultimate answer is probably 'restore the database in a sandbox VM with no access to the outside world', but let's assume that option is off the table. What else should be done in this situation? Restore verifyonly verifies integrity of database it WILL NOT tell you whether backup includesa ...


15

A database may contain malicious code, possibly a procedure that is going to change a password for the "sa" login or drop every database. However the only way that I can see that causing an issue is for an individual to restore the database, and then manually execute any code within that database. It would not execute in any automated manner. There is no ...


0

Oops, as often, the answer was in the question. Must've been pretty tired, because as I said : Anyway, the important part is : datadir=/var/lib/mysql chroot=/var/lib/mysql But, if I wanna be consistent with myself, chroot must be /var/chroot/mysql. So the correct setting is : datadir=/var/lib/mysql chroot=/var/chroot/mysql And indeed ...


1

The IPv6 wilcard subnet mask is ::/0


0

Depending on how secure you want to make it (Not dwelling on it as you've requested), a proxy account could be setup for xp_cmdshell operations so that it does has local admin. xp_cmdshell_proxy Since you're interacting with the OS at this point, you could also create scripts to switch execution context to another user either through powershell or through ...



Top 50 recent answers are included