Re: SQL Spider question

From: Chip Andrews (chipandrews@usa.net)
Date: 05/22/02 

From: "Chip Andrews" <chipandrews@usa.net>
To: <Gu1tarb0y@aol.com>, <focus-ms@securityfocus.com>
Date: Wed, 22 May 2002 15:04:13 -0400

> Name Type Default Database User
>
> cadb Standard master dbo
> sa Standard master dbo
> tng Standard TNGDB tng
> tngsa Standard TNGB dbo
>

cadb, tng, and tngsa are accounts created by Unicenter. You can see that
they two out of three of them are db_owners and the cadb account is likely a
sysadmin so be careful and make sure those accounts are locked down as well.

> If I was to guess that one of these was the admin account, I'd guess sa.
> Let's say I find the account and want to add a password, what processes
will this affect? As in.... do I need to go and add this info to start up
parms on services or re-establish a process to use this account AND it's new
password?

Windows services do not use SQL Server accounts as service accounts - they
use Windows accounts. If any applications you run on that machine are using
the 'sa' account for database access and you change the password then the
applications will likely fail. However, it should be stated that if you are
using the 'sa' account for runtime database access then you're sitting on a
time bomb anyways. Create a low-priv SQL account and give only the
necessary permissions. With a third-party product like Unicenter you can
probably refer to CA's support site to see if they have instructions for
hardening the installation.

Chip Andrews
www.sqlsecurity.com

Relevant Pages

  • Re: Please! Doesnt anyone know a better way to do this?
    ... account, they need to automatically be directed to the page to enter data ... session variable on the Account page. ... I assume here that you're checking a database when the user attempts to ... When a new user attempts to login or clicks to register, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Best way to parse file into db-type layout?
    ... That's an awful lot of columns to put into a database table, ... The rows are identified by Letter type and an account number (always the ... Off to search for dictionaries and databases now. ... > What you need is a clear appreciation of what you are trying to do ...
    (comp.lang.python)
  • Re: Help with WSS 3.0 Server Farm Config - Backend SQL 2005
    ... I had to use only "sharepoint" to get the ... What interest me though is that the database get created but fails after ... Virtual Server with DBSVR ... an account local to the WEBSVR) to create and access the SQL server, ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Relationships, forms and command buttons
    ... asking how to do a particular thing in terms of the database objects itself. ... If they change their bank account, ... tblIndividuals and tblCAFGAYEDons) with linking tables with an autonumber PK ...
    (microsoft.public.access.gettingstarted)
  • RE: Take This Value and Shove It
    ... because of the way I must acquire the loan account numbers and borrower ... To get that data into the Access database, and keep it updated, I have ... Your subform record source should be tblNotes or a query based on it. ...
    (microsoft.public.access.formscoding)