Voice of the DBA

Category: Editorial

  • No More SQL Server Installs

    This occurred to me recently, and I’m wondering what some of you think of as the answer to this question: when will you expect to no longer install SQL Server?

    It’s not that I think many of you are retiring from SQL Server work. It’s not that your organization won’t use SQL Server. It’s that I wonder if we’ll stop installing SQL Server on the host OS. We’ll make use of SQL Server in new ways, which won’t require an installation.

    Lately I’ve seen a lot of tweets, post, and more about SQL Server in containers or Kubernetes. Anthony Nocentino and Andrew Pruski are doing lots of work here, and I’m moving my work to containers for demos. With a container, you don’t really install SQL Server. Instead you install the Docker engine and then “start” a pre-installed SQL Server image inside a container. You might modify this before starting it, but you aren’t installing a version and upgrades are pulling a new image and then restarting the new image. With the better support for containers on Linux, this means I’m also starting to think Linux first.

    Plenty of you are also looking to do more work in Azure, AWS, or some other cloud service where you likewise don’t need to install SQL Server. In those cases, you’re really working with a service that implements a database, not an instance. There are some variations, such as the Azure Managed Instance, but you still don’t need to install SQL Server. You apply your database code, point your application, and off you go.

    SQL Server 2019 is starting to feel like the first version where I’ll be looking to ignore the SQL Server instance and think in terms of containers most of the time. I’ll probably still install it, as I need to test and check things, plus, I’m still learning how to work containers into my workload, but I’m guessing that with SQL Server 2020, or 2021, I’ll just stop installing SQL Server.

    Unless I need to document the installation for some of you, but in that case, I’ll try to get you to stop installing the binaries and just use a container.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.4MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • What’s Worse than Announcing a Data Breach?

    What’s Worse than Announcing a Data Breach? You might think that’s the worst thing that you could tell your boss these days. Imagine discovering that sensitive data has been exposed and you need to go inform an executive. Hopefully no one is looking to punish the messenger, but it will still be a very uncomfortable conversation.

    Now imagine that you need to go back and have a second discussion a day or two later. Why? More data was exposed, and potentially lost. I’m not sure which conversation is worse, though if you don’t have a list of things you’ve checked, changed, or fixed between the two meetings, I would argue the second one is worse.

    That happened to a mortgage loan company. The data breach was already bad, with an Elastisearch server out there without any security. Data had been converted from paper documents through an OCR process, which resulted in no shortage of mistakes, but there was still plenty of sensitive information out there. Things got worse when security researchers discovered the source of the OCR process was an Amazon S3 bucket that container the original images, also without a password.

    Before I comment on anything else, there should be NO shares, buckets, containers, databases, or any sort of server without a password. None, nada, zip, zilch, no excuses. At least protect everything with a password that meets your organizations password requirements. No “12345” or “asdf” or default passwords. Before you do anything else, go set passwords. If you have S3 buckets or Azure storage, write a script to check them all. Set. A. Password. On. Everything.

    We will all make mistakes in configuration, and there might be security issues at times. These ought to be rare, with today’s vulnerabilities scanners, static code analysis, configuration as code, global policies, etc. There really isn’t any excuse why we don’t set things up at the beginning, but if things change and mistakes are made, we ought to detect them quickly. And then fix them. That’s why we should use automation, configuration as code, and regular evaluation of our systems.

    One of the greatest strengths of the DevOps philosophies is that we can deploy changes quickly to fix things. We’ll make mistakes, we’ll have issues, but when we find them, there is no long waiting period to get the fix into our client’s hands. That ought to be true for both software and infrastructure.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.3MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Who Are Your Authenticated Users?

    I ran across a data breach at Dow Jones, the parent company of the Wall Street Journal newspaper. Apparently there was a database export that was stored on an Amazon S3 bucket. A security researcher discovered this and notified the company. Once the issue was corrected, the article linked above was published.

    The details note that the security on the bucket was set to authenticated users, which is good. So, some security was set up. To me, if I were operating in an Azure or AWS environment, I would assume this meant authenticated users in my subscription/account/etc. In other words, my business partners and employees.

    That’s not the case. This means anyone with an AWS account, which means anyone bothering to register for an account because they’re free. This meant that anyone, from security researchers to criminals to any of you that do work in AWS, could have downloaded the data. The report was released after security was changed, which is a responsible approach. We, as an industry, need to know about these things, but we also don’t want to unnecessarily expand a data breach.

    Since this has been published, however, it’s likely that plenty of people are scanning S3 buckets, looking for data that has “Authenticated Users” as a security setting. If you have any doubts, check and change your security now. This setting amounts to “public” since anyone can get an AWS account in a couple minutes. Double check your account and ensure security is set to meet the requirements of your organization.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.5MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Republish: Bad Management

    Out of town at the MVP Summit, so you get Bad Management.