Voice of the DBA

Category: Blog

  • T-SQL Tuesday #58–Passwords

    It’s the second Tuesday of the month, time for T-SQL Tuesday again. This time the invitation to participate comes from Sebastian Meine (@sqlity, blog) with the topic of passwords. It’s a great topic, especially as security concerns are growing regularly.

    I would encourage anyone that looks to build their brand, and further their career to write a post for T-SQL Tuesday. It’s easy, just look for the invitation and then publish on the second Tuesday of the month.  Be sure to follow the #tsql2sday tag on Twitter.

    You can even go back and write about previous topics, and share your own thoughts and insight. I keep a list of previous topics here: T-SQL Tuesday Topics.

    SysAdmin Passwords

    I’ve tried to maintain strong passwords for years. I used to have a formula, similar to Bruce Schneier, where I’d use a sentence to build a password. However a few years back I went to Password Safe, and have been using that on Windows, OSX, iOS, and Android, with Dropbox keeping my password safes in sync. I let Pasword Safe generate my passwords, 12 characters), with random digits and I use this to stick passwords into systems.

    I use a different password for every system, which has been fine for me. It’s slightly annoying to unlock the safes on a mobile device, but I like the idea that a compromised password on one system doesn’t affect any others.

    Years ago, I worked as a DBA and we managed a large number of systems. One of our mandates was that administrative passwords would be changed every 30 days. That was fine for the people running the systems, but changing the administrator password for hundreds of Windows hosts was an issue. We grouped servers (IIS servers, Exchange servers, etc), to make it easier for each administrator to manage the systems, but it was still a challenge to create passwords for each group every 30 days.

    I introduced Password Safe, and simplified things. We let the application generate passwords for each group, stored them in the safe, and used a script that took the group and password as parameters to change all the systems passwords. This was still time consuming, but it provided for a limited window to crack a password, allowed us to use longer passwords, and we could also retrieve them when we needed to administer a particular system.

    Note that this was just for administrator passwords. We had a separate scheme for service accounts, which was to randomly create a long, 15+ character, password that was used to start the service, but was never stored. Similar to many applications, we couldn’t recover the service account passwords. If we needed one, we changed it, and sent a note to the security group whose event log scanners would note the change.

    I know that strong passwords don’t necessarily solve our security issues with hackers and social engineering, but I do think this is the lowest bar you can tolerate. If “sa” and blank, or “sa” and “password”, or “system” and “manager” (for the Oracle folks) work on your database, you deserve to be fired. There’s no excuse for not picking a strong password for privileged accounts.

  • The BBQ Crawl at SQL Saturday #300

    This weekend is SQL Saturday #300 in Kansas City. I’ll be traveling Friday for the event, hoping to arrive in time to go on the pre-event barbeque crawl that the organizers set up every year. It’s hard to believe it’s been 4 years since I was last in KC. I still have, and often wear the shirt I got from SQL Saturday #53 when I travel and was surprised to note recently that it’s a 4 year old shirt. How time flies.

    Kansas City is a neat city, and the event is a lot of fun in a very unique setting. An old river casino, converted to a training center. I still remember driving up and being unsure if it was the right place, and then enjoying the view inside.

    This week I’ll be talking about Continuous Integration for Databases, so if you’re in the area and have time Saturday, then register and come by,

  • Better Presentations–Fonts

    This is part of a series of tips for speakers to make your presentations better.

    Please, please, please, learn how to set up your machine to look good on screen.

    I saw Brent Ozar write a few notes on how to make your presentations better recently. This was primarily for the people presenting at the PASS Summit, with a few specifics to that event. Buck Woody also had a mini rant about sizing the fonts on your laptop.

    Both are worth reading. The visual display of your work can overcome some poor speaking habits. Likewise, great speaking performances overcome some poor visual displays. Having both fail means your presentation may fail.

    Note by failure, I mean that the attendees don’t like the talk and lose out on information because they’re bothered by the way your session appears. This could be at a conference, a SQL Saturday, or a lunch and learn at work.

    Increase Fonts

    To move on from Buck’s post, change the defaults in SSMS. Paul Randal has a nice post on configuring SSMS. Read it and try it.

    I go for 14 point fonts, but note that you need to set Text and Grid results separately and restart SSMS. Do this before you walk in front of people.

    It’s easy to do in SSMS. Click the Tools and then Options menu items. You’ll get a dialog like this, and on the left, under Environment, there’s a Fonts and Colors selection. Click it.

    badpresent4

    The top drop down on the right controls the section of SSMS. Query Windows are the Text Editor items. Below this, I have a font (Consolas) and a size (14). Below that on the left I have the various items in the Text Editor I can change fonts for. There are so many settings that this could be a weeklong project.

    I usually just change the “Plain Text” to 14. I don’t’ worry about the others, but if you use other items in your presentation (like line numbers), change them.

    If you select the top drop down, you’ll see this

    badpresent5

    These are the other places you can change fonts. The two I want to point out (I use them) are the Grid Results about 2/3 of the way down and Text Results a few below that. Change both of these font sizes, though you’ll have to restart SSMS.

    If you make these changes, your attendees might not thank you, but they’ll be less likely to complain. Even in the largest rooms, 14 points seems to reach to the back of the room. And if it doesn’t, learn to zoom.

  • Silicon Valley is a different world

    I spent the last couple days at Flowcon 2014, a conference that is bringing people together to talk about growing their organizations with continuous delivery and design, and lean product development.

    It does some of that, but it wasn’t what I expected. The attendees for the most part were people that already believe in continuous delivery, in lean principles for their organization, and in flow. If you don’t know what flow is, read the Phoenix Project, Martin Fowler, and other lean, agile methodology books. It’s a concept from labor and manufacturing, with the idea that we can increase the rate at which we get work done.

    I believe in it, it’s a tenet of DevOps, and I think it works well. The conference features people from Netflix, Nordstrom, Etsy, Thoughtworks, and other companies that are already using these ideas. They believe, and they are looking for ways to better smooth out their own groups.

    However they also have ideas about rapidly changing and adaptive groups and organizations, which isn’t where most of us work. Far, far too many people are still stuck performing waterfall work, or even waterfall-like work.

    It’s also a world where people are looking for startup ideas, looking to move quickly and build something new. It’s a world that’s quite unlike my own. While there’s a buzz and energy from many people, it also feels somewhat shallow and hollow from some that are searching for riches. It’s also a bubble of thought that is so far away from most of my experiences, that it feels sheltered and idealistic.

    Don’t get me wrong, it’s exciting, and there is a passion some of these people have for their craft that’s inspiring. I’m just not sure it’s a place I’d want to be every week.

    However I do wish more and more people would look to better develop software. If we are to improve as an industry, I think many of the ideas and techniques that are invading the software development world related to flow need to be adopted.