1

I'm doing data exchange and Insert update operations over the linked server between two database servers. To allow distributed transaction, I've changed settings in Windows to enable MS DTC services.

I want to make sure there is not security risk after enabling it for distributed transaction.

https://technet.microsoft.com/en-us/library/cc753620(v=ws.10).aspx

https://serverfault.com/questions/61269/security-risk-of-enabling-msdtc

0

The more features you turn on, the greater the risk. The Linux community openly says to turn features off if you don't need them. Microsoft has a Windows Server 2012 core mode:

Install Server Roles and Features on a Server Core Server

I don't see DTC on the list. There are good practices, but if there is a business need I turn it on. I always say the right tool for the right job. But you can change the default port for DTC, if you do this hacker scanning tools won't find it.

How to Configure MSDTC to Use a Specific Port in Windows Server 2012/2012R2

I have worked at banks that change the default port of all the SQL Servers. In some cases, each server had a port in a range of 100 and all the firewalls let that group through. It is a support nightmare, but it is VERY secure.

  • 6
    That isn't very secure, nmap will just report that port as sending SQL Server headers and the changed port just adds complexity without adding security. – Tom V Oct 12 '16 at 19:44
  • IT security should be like an onion, multiple layers. Changing the port adds another layer to the security. I have worked at multiple banks and they all change default port numbers. – Duane Lawrence Oct 19 '16 at 16:04
  • 1
    @DuaneLawrence that's security by obscurity. – dezso Oct 24 '17 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.