Re: Hiding MS SQL databases in Enterprise Manager

From: Thor (thor_at_hammerofgod.com)
Date: 11/20/03

  • Next message: Jannie Hanekom: "RE: Hiding MS SQL databases in Enterprise Manager" 
    To: "Chris Ess" <securityfocus@cae.tokimi.net>, <focus-ms@securityfocus.com>
Date: Wed, 19 Nov 2003 15:51:02 -0800

    > When I create a database in the Microsoft SQL Server, it shows up under
    > 'Databases' in Enterprise Manager for any user who logs in, whether or not
    > they have permissions to access it. Since this could potentially be a
    > security issue, I would like to set it up so that users can only see
    > databases for which they've been assigned a role.

    I know you've received many comments on this- some that are wildly
    inaccurate- but let's ignore those for now...

    Your security model should start at the authentication infrastructure for
    your SQL servers, not at preventing a list of them. Spend your time
    properly configuring and securing your servers, not trying to obfuscate
    their existence. Most are probably all at 1433, which would be easily
    scanned for. The "hide" option just moves it to known port, and a 2 byte
    query to the instance mapper on UDP 1434 tells all anyway.

    Besides, when the servers come on line, they register themselves with the
    master browser. "TSEnum," a tool I wrote to originally enum terminal
    servers on a network, will return the name of every system in the domain,
    its type (sever, wrkst), its role (PDC,BDC,etc), and app server roles (SQL,
    Exchange, Terminal Services) etc, all with a single command, even with a
    null session, and even with restrict anonymous set to 1.

    So I just pipe results to a txt file, search for SQL, and bling bling.
    Basically, don't waste your time trying to hide them in EM..

    hth

    t

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jannie Hanekom: "RE: Hiding MS SQL databases in Enterprise Manager"

    Relevant Pages

    • Re: How long to do this task in oledb?
      ... You can link the other databases into SQL and then you can use T-SQL scripts ... to do whatever you want between SQL Server and those databases. ... We were thinking of using the DTS API but thought OLE DB ... >> You should be able to do that all with linked servers and DTS packages. ...
      (microsoft.public.data.oledb)
    • Re: Remote disk space analysis
      ... Check the drive space on all of the servers listed in a text file and store the output like Server name, Drive Name, Disk Space and Free space information on a SQL Server table. ...
      (microsoft.public.scripting.vbscript)
    • Re: SQL Clustered Node restarting unexpectedly
      ... Found it to be a NMI that was caught by the system BIOS ... Mike Epprecht, Microsoft SQL Server MVP ... > Servers on 2 nodes connected to SAN Storage using Fibre ... > for network name resource SQL network name ...
      (microsoft.public.sqlserver.clustering)
    • Re: SQL Architecture Opinion
      ... than having 20 servers.. ... I think that CPU is more important than memory; ... 200 databases under 1gb; I would consolidate databases first; not ... his idea is to implement one large SQL Server ...
      (microsoft.public.sqlserver)
    • Re: using windows authentication...
      ... SQL Server DOES NOT TALK TO WEB ... Web clients request access and data from database servers, ... Server security. ...
      (microsoft.public.sqlserver.server)