Surface Area Configuration tools reduce exposure to security risks
| Executive Summary: Get answers to your questions about SQL Server 2005 Surface Area Configuration tools that can help you protect the SQL Server surface area from security breaches perpetrated by unauthorized users or applications. |
Q: What’s the SQL Server surface area, and what security risks are associated with it?
A: All SQL Server components that are accessible by users or applications are known as the surface area. Enabling all of SQL Server’s features increases the risk of a security breach by unauthorized users or applications. To make the vulnerabilities of the surface area less visible to potential attackers, the default installation of SQL Server 2005 disables most of the at-risk features (e.g., xp_cmdshell, dedicated administrator connection). You can also deactivate unused components to reduce surface area exposure.
Q: What tools are available to increase the security of the SQL Server surface area?
A: You can use two SQL Server 2005 Surface Area Configuration tools to increase surface area security and manage common service-related operations. These tools use Window Management Instrumentation (WMI) API calls to manage SQL Server’s registry operations. The Surface Area Configuration for Services and Connections tool gives you a simple method for configuring the security of local, as well as remote, SQL Server machines. For more information, see msdn2.microsoft.com/en-us/ library/ms188980.aspx. With the Surface Area Configuration for Features tool you can enable and disable features of the Database Engine, SQL Server Analysis Services (SSAS), and SQL Server Reporting Services (SSRS). For more information, see msdn2.microsoft.com/en-us/library/ms183753.aspx.
Q: What features does the Surface Area Configuration for Features tool include?
A: The features in the Surface Area Configuration for Features tool are divided into three main categories: SSAS, Database Engine, and SSRS. SSAS features include Ad Hoc Data Mining queries, Anonymous Connections, Linked Objects, and User-Defined functions. Database Engine features include Ad Hoc Remote Queries, Common Language Runtime (CLR) Integration, Database Mail, OLE Automation, Service Broker, SQL Mail, Web Assistant stored procedures, xp_cmdshell, Dedicated Administrator Connection, and Native XML Web Services. SSRS features include HTTP access and Web Service Requests, Scheduled Events and Report Delivery, and Windows Integrated Security.
Q: What database administrative services does the Surface Area Configuration for Features tool support?
A: The tool provides an interface from which you can start, stop, pause, or resume administrative services. You can also configure whether the startup is manual, automatic, or disabled. In addition to SSAS, SSRS, and SQL Server Integration Services (SSIS), these configuration services are supported:
- Database Engine
- Full-Text Search service
- SQL Server Integration Services (SSIS)
- MSSQLServerADHelper service
- Notification Services
- SQL Server Agent service
- SQL Server Browser service
- SQL Server Writer Service
Q: How do I use the Surface Area Configuration for Features tool?
A: You can use the tool’s GUI, T-SQL in the Query Editor, or a command-line utility. To use the GUI go to Start, All Programs, SQL Server 2005, Configuration Tools, SQL Server Surface Area Configuration for Features. You can use the GUI to select a component and configure its features. To use T-SQL in the SQL Server Query Editor you need to enable xp_cmdshell, as the following example shows.
options’, 1
RECONFIGURE
GO
sp_configure ‘xp_cmdshell’, 1
RECONFIGURE
GO
Use the command-line sac utility when you’re configuring multiple SQL Server machines with the same import and export Surface Area Settings. This utility creates a configuration file on the local server; this file is then exported to another server where the system imports it. The sac utility is in the \Program Files Microsoft SQL Server\90\Shared folder.
