1

Is it possible for the SQL Server Error Logs to be encrypted?

Our SQL Server recently had a memory dump which it threw into the Error Log. While the dump was definitely useful to identify the issue, it got me wondering about the visibility of that dump to users who may have access to the server, but not necessarily SQL Server.

I know TDE protects Data, Log, and Backup files at rest, but potentially sensitive information can be exposed via a memory dump - especially if it is intentionally engineered by a malicious source.

The contents of the dump looks similar to this:

02f59f10  70b50b54 00000101 000000a2 00650073  T..p........s.e. 
02f59f20  00760072 00720065 0027003d 006f006c  r.v.e.r.=.'.l.o. 
02f59f30  00610063 0068006c 0073006f 00270074  c.a.l.h.o.s.t.'. 
02f59f40  0054003b 00750072 00740073 00640065  ;.T.r.u.s.t.e.d. 
02f59f50  0043005f 006e006f 0065006e 00740063  _.C.o.n.n.e.c.t. 
02f59f60  006f0069 003d006e 00720074 00650075  i.o.n.=.t.r.u.e. 
02f59f70  0041003b 00700070 0069006c 00610063  ;.A.p.p.l.i.c.a. 
02f59f80  00690074 006e006f 004e0020 006d0061  t.i.o.n. .N.a.m.

I want to be proactive and protect against possible data breaches by encrypting the SQL Server Error Log if possible to reduce the chance of intentional memory dumps exposing sensitive data to non-authorized users.

2

Is it possible for the SQL Server Error Logs to be encrypted?

There is no option that "turns on errorlog encryption", so you'll need to use encryption at a lower layer, such as bitlocker or similar disk encryption utilities.

Our SQL Server recently had a memory dump which it threw into the Error Log. While the dump was definitely useful to identify the issue, it got me wondering about the visibility of that dump to users who may have access to the server, but not necessarily SQL Server.

If they have access to the server then they have access to SQL Server. No two ways about it.

I know TDE protects Data, Log, and Backup files at rest, but potentially sensitive information can be exposed via a memory dump - especially if it is intentionally engineered by a malicious source.

TDE wouldn't help here, and in general full disk encryption won't help either if the sources can already log into the server - regardless of having access to SQL Server or not.

Anyone that can log into the server can potentially read memory. Some permissions might not be locked down and debuggers can be attached. Other avenues also exist which I won't get into here but if they have access, it's already too late.

I want to be proactive and protect against possible data breaches by encrypting the SQL Server Error Log if possible to reduce the chance of intentional memory dumps exposing sensitive data to non-authorized users.

I completely understand and you should be proactive, kudos! Sadly, there really isn't anything native inside of SQL Server to do this. Encrypting it through 3rd party solutions may cause other issues.

I would say the best thing is to make sure no one has access to the server and who has access to SQL Server. Anecdotal evidence: I once was able to see a bunch of data on a "locked down" server because there was a share that had "everyone" as read permissions.

  • 1
    Thanks for the breakdown response. I figured there was little to be done, but a question left un-asked is an opportunity missed, thus here I am. – SQL Sean Dec 11 '18 at 16:39
0

While its true that there is no native option to encrypt the SQL Error Log, you should be able to apply a domain certificate to the folder where the log exists, add the certificate to either the virtual service account or the service account assigned to the service, if they are different, and grant permissions and certificate access to anyone needing to see the folder. The feature is called EFS, or Encrypting File Service, and it's part of the Windows operating system. Anyone trying to open a file in the encrypted folder will get an error if they don't have permissions to use the certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.