Browse by Tags

Check Authentication Scheme (Kerberos) on SQL Server 2005

I had to redo SPNs today because we swapped out service accounts on some of our non-production SQL Servers. I wanted to verify that connections in bound were being made with Kerberos. If you've ever dealt with this, if the SPNs are wrong you usually get an SSPI error, but just to be safe, I wanted...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 08-07-2008
Avoid Domain Admin level accounts for SQL Server

Every so often I see a post in the forums where someone has stated they've used a Domain Admin level account to run the SQL Server service. The implications are that anyone who is a member of the sysadmin fixed server role is effectively a domain admin. That means if a developer is a member of this...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 06-12-2008
Security by Obscurity?

Andy Warren points to a TechNet article about Security by Obscurity and wanted me to post some notes. Let's start with the example they used. Rename the Administrator account: I agree with Roger's take. We intentionally rename the administrator account because it does stop the malware and scripts...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 06-04-2008
Security Issue with SQL Server Reporting Services 2008

I have a CTP of SSRS 2008 deployed to one of my servers. Today I built a couple of reports and from one of my systems, they all tested fine. However, this system, because it is a testing server, doesn't receive the Group Policy Object (GPO) controlling IE security settings that our standard systems...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 05-30-2008
Review of How to Cheat at Securing SQL Server 2005

SQL Server MVP Frank Kalis has posted a short review on How to Cheat at Securing SQL Server 2005 , a book I was able to contribute two chapters to last year. The chapters I focused on were related to Authentication and DDL Triggers . It was a great experience and I am humbled by the positive review from...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 05-20-2008
Setting Static Ports when dealing with Named Instances and Kerberos

I ran across this a week or so ago. There were a couple of SQL Servers running named instances that we wanted to setup Kerberos authentication against (in the event we would use Kerberos delegation). Here is how the ports were set according to SQL Server Configuration Manager: The problem here is that...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 05-17-2008
Thoughts on SQL Saturday in Jacksonville

I was able this Saturday to head down to Jacksonville and speak at the SQL Saturday there. There were a lot of folks, a lot of good presentations, and the area in and around Jacksonville was gorgeous. I gave two presentations, both of them security related, and I was pleasantly surprised and encouraged...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 05-07-2008
Recent slate of IIS attacks - more info

The recent slate of attacks on IIS servers don't seem to be an attack directly against IIS or against SQL Server itself. In other words, they aren't going after vulnerabilities in the server product (either one). Rather, the attacks are targeting weaknesses in the web application which permit...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 04-26-2008
SQL Server Forensics Book

I logged into Safari today to download some chapters I want to be able to review when I'm offline. I saw in the new titles there's a forthcoming book called SQL Server Forensics Analysis and it's by one of my co-authors from How to Cheat at Securing SQL Server 2005 , Kevvie Fowler. The book...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 04-05-2008
Jacksonville SQLSaturday less than a month away!

The SQLSaturday in Jacksonville, Florida, will be held May 3, 2008. I'm on track now to give two security based presentations: Protecting Your SQL Server From Treasure Seekers : This presentation is geared for system administrators, DBAs, and developers and covers the "low-hanging fruit"...

Posted to K. Brian Kelley - Databases, Infrastructure, and Security (Weblog) by bkelley on 04-05-2008

Page 1 of 2 (13 items) 1 2 Next >