Voice of the DBA

Author: way0utwest

  • Detecting Logins

    Do you have a login on any of your SQL Server instances that is named “default”? If you do, you might have an issue with the MrbMiner malware that has infected a number of SQL Server instances. This adds a login with the name of default and the password of “@fg125kjnhn987.”.

    Stop and double check your instances now. If you use SQL Monitor, you can also add this custom metric to your alerts to look for this on an ongoing basis.

    I don’t know this is a SQL Server problem. It’s really a user/administrator issue. This works by looking for weak passwords, which is always a problem. It’s also an issue if you have an exposed SQL Server connected directly to the Internet. Shodan shows lots of SQL Servers on the Internet, and if you own any, you might be sure you have *very* strong passwords.

    Or remove them from public Internet access.

    While this is easy to detect, what if the login were stevejones? Can you detect if logins are added to your SQL Server. Sure you can, but would you really notice something strange? On my instances, where I add all logins, I would. In many organizations where I’ve worked, more than one person added logins, and logins could be added on a regular basis. Often these are associated with tickets in some system, like Jira, but even if they are, would you know an extra one got added?
    I bet most people wouldn’t notice, especially across their estate and with a team of administrators.

    That’s a problem, and it’s one where we ought to perhaps have good controls in place. There are a few places I know where every change is submitted to a pipeline of sorts, meaning that everything is logged, and given the integration with release management tools and ticketing systems, things could be audited. Maybe more importantly, approved logins could be added to a list that might be compared with the actual list on a server.

    Possible, but not necessarily simple to implement or get right. Maybe the low tech solution I’d use is a daily report that included changes from the previous day. All administrators could check it to be sure any new logins were added by one of them.

    You should know how to secure your SQL Server. Implement strong controls, and be sure that you periodically audit for anything unusual. At the very least, ensure you have monitoring so that any unusual or strange activity might be detected.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Daily Coping 5 Oct 2020

    I started to add a daily coping tip to the SQLServerCentral newsletter and to the Community Circle, which is helping me deal with the issues in the world. I’m adding my responses for each day here.

    Today’s tip is to accept your mistakes as a way of helping you make progress.

    We all make mistakes. I coach kids, I work with less experienced people, and I have kids. In all cases, mistakes are what help us learn. I can tell you lots about how to do things, but some of the attempts you make to build something result in mistakes. The key is to learn from them.

    We always tell programmers to try things. It’s frustrating to have sites like mine (SQLServerCentral), Stack Overflow, etc. that allow people to get code without testing or learning. Lots of people do still test and experiment, but it seems many also just want code they can cut/paste.

    Enough of a soapbox. For me, I’ve forgotten to tackle tasks, or done them poorly. I write typos and mistakes and they get published regularly. I’d like to think not too often, but they happen.

    When they do, I have learned to stop and not chastise myself or feel I’ve failed. Instead, I try to identify why something went wrong and then think about it how I might change that in the future. A couple examples.

    I had a busy weekend, with my son coming home for a few days. Schedules misaligned, and we ended up not being able to get together for a family celebration until Monday night. We weren’t out too late, but the busy, long weekend, a hard day at the gym Monday and then the night had me tired. I had a horrible night’s sleep and ended up missing a meeting in the am. Partly I overslept, and I mis-read the time, so dragging myself to an 8:00am meeting at 7:59am felt fine. The problem was the meeting started at 7:30am, and I had another one at 8.

    I apologized, but I also went back and thought about what went wrong. Really, I should have double checked the time. I might have still missed it, but I could have been better prepared. It happens, and I can move on.

    A second example had me telling my wife that I would stop at the store for something. I forgot and came home. Home is 12 miles from the store, and a 20minute drive both ways. I got home, realized, and turned around to go back. A waste of time, money, gas, etc. because I didn’t add an item to a list. Rather than complain, or try to get out of going back, or anything else, I worked to correct the mistake right then.

    It’s an honest mistake, but one I need to own and be more careful about how I manage supplies when living in the country. No reason to get upset, just learn and move on.

  • Missing SQL Bits

    This week is SQL Bits week, which is taking place virtually over in the UK. Things are planned for UK time, and speakers are accommodating them. I had a webinar earlier in the with Grant at 930am my time, 1130 his.  This was after he’d completed a 7.5 hour precon for Bits. He’s quite dedicated to both the company and sharing with others.

    For a number of years, SQL Bits was the conference I looked forward to, planned on attending, and made sure to get submit early and promote my session. This is my favorite conference, and while I do enjoy going to most of them, I have always felt Bits, run by community members, was special, fun, and a highlight of my year.

    Once again, I’m missing the event, and especially missing the chance to see and chat with lots of friends. The last couple years Bits has been in the March/April time frame, conflicting with my coaching commitments in the US. This year I had hoped the move to September would allow me to go, but alas, the UK is still in a lockdown, and I can’t spend 14 days in quarantine.

    As I see the tweets and pictures from friends that are participating, I realize how much I miss the event and the interaction with others in the #sqlfamily. It’s sad to not have any events to go to, but I especially miss SQL Bits this year.

    I don’t know what the future will bring, and I hope that Bits will survive this difficult time. I also hope that they find a way to get back to a live event, whether in 2021 or 2022. I’m already mentally marking my calendar, and hoping I can find a way to go back.

    A few fun memories:

    IMG_1458

    IMG_7907

    DSC_4363_DxO

  • Daily Coping 2 Oct 2020

    I started to add a daily coping tip to the SQLServerCentral newsletter and to the Community Circle, which is helping me deal with the issues in the world. I’m adding my responses for each day here.

    Today’s tip is to take your time. Make space to just breathe and be still.

    I’ve been practicing yoga regularly for about 8 years now. It has helped me in many ways, but one very unexpected way for me is that I appreciate breathing more. While I’ve been listening to instructors say I just need to breathe, and let me breath guide me, most of the time I’m worried about moving my limbs and finding balance.

    However, the last year or so has me often stopping for a minute and just breathing throughout my life. Not just when I’m stressed, not just when I practice yoga, but I might sit at my desk and stop for a minute and just breathe.

    I’m not good at meditation or sitting still for long. However, focusing on my breath for a minute or two, even while I might be looking at something, has been helpful to me.