I use domain accounts for SQL Server service accounts. Sometimes, when I have multiple servers that are logically or thematically related, I'll use the same set of domain accounts for the service accounts on all of them. The user account permissions on each server may be different, but there's usually a lot of overlap.
The gist of my question is this: can a user with access to one instance, but not the other, exploit the shared service accounts to gain access to the other server?
Here's the specific situation I'm trying to address:
- I have two servers with default SQL instances, call them org-sql-1 and org-sql-2.
- I use a domain account for each service, so I'd have mydomain\orgDBService, mydomain\orgAgentService, etc. (although I'm not sure that's strictly relevant -- I think I'd have the same question if I used a single account for all services).
- But I reuse these domain accounts on both servers, so the database service on both org-sql-1 and org-sql-2 runs under mydomain\orgDBService, for example.
To date, I've never particularly questioned the security implications, since these servers have a common purpose and user base, even if the specific user permissions may differ.
Now, we're about to add a third instance, let's call it org-sql-rpt. This one is a good thematic fit with the others, but there's one key difference: we're going to allow an external partner (i.e. not an employee of our org) access to this server, like so:
- Their credentials will own (belong to db_owner) a couple databases.
- But they won't belong to any Server Roles (other than public, of course).
- They may have admin access to the OS desktop for a limited time, prior to making this server live.
- They won't know the passwords for the service accounts.
Given that, should I worry about reusing the domain accounts as service accounts for this new instance? Is there any risk that this person could use their legitimate credentials on org-sql-rpt to gain access to either org-sql-1 or org-sql-2? (i.e. any risk that could be mitigated by using different service account credentials?)
Or is this just a generally bad idea for other reasons?
The new instance will be hosting Database, Integration, and Reporting services (for now, at least). No Analysis services.
The external user will have elevated database privileges, but no explicit instance permissions. They won't be able to create logins, jobs, or reports, for example.