Voice of the DBA

Category: Editorial

  • Securing Your Instances

    I wrote a post about finding the port number of a SQL instance using PowerShell. Almost immediately I was taken to task by someone that noted port scanners can easily find SQL ports, so it’s silly to move off 1433. Just use it because applications expect it. I can see that, and changing ports doesn’t provide much security, but it does provide some obscurity, which may or may not be helpful. Certainly this also creates administrative and support burdens for a system. If you want other opinions, there’s a Q&A on Stack Exchange for this topic as well.

    Tom LaRock wote a post that this can be a way to obfuscate your database, prevent simple default connections, and potentially detect security issues before they become a problem. I tend to learn towards this approach as well, because these small changes can potentially provide a little protection. A port scan is quick, but firewalls are getting better at detecting these. Certainly criminals get smarter, but changing a port number isn’t intended to stop everyone. If it stops a few, then that’s fine.

    Security comes about because of layers, and limitations, and will never be perfect. There will always be ways that someone can get around security, but the more layers, the more obstacles you place in their way, the fewer people that will overcome all of them. I’d also note that plenty of attacks come from vandals. People that are just bored and looking for easy ways to get into a system. Most of these people are using pre-written scripts and programs that try out defaults. These aren’t concerted, directed attacks. They’re attacks from boredom.

    I’m curious today how many of you think a little bit of security from obfuscating ports is a good idea. I wouldn’t recommend the SQL Browser be open, but that legitimate connections know about the port needed, and use that in their connection strings. I think it helps, and if this limits some attacks, especially inside-the-firewall virus attacks from trusted machines, I think it’s worth doing.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.4MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Backup Data Security

    It seems there is no end to the insecure ways in which people manage data. I haven’t seen this one before, but I’m sure it’s happened. In fact, I bet it’s happening right now in more than one company. A company was using rsync to keep data files copied between two insecure servers. Insecure because of a lack of username and password on the systems. In this case, the problem was a subcontractor that dealt with confidential US military personnel data.

    I appreciate that many of you are talented scripters that solve problems and build great solutions. I wonder how many of you actually think about security and the potential implications of small mistakes in configuration that others might make. When you build that PoSh script to copy backup files, are you ensuring the transfer takes place in a secure manner? Do you assume that because you use an IP address or server with no DNS entries to receive data that no one else can find it?

    All too often I find that sysadmins and developers make assumptions about the security of their process. They think because discovering the process or information would be hard for them or they wouldn’t bother, the data will be secure. And we find that time and time again that the ways in which we build systems without considering security aren’t secure. Someone will find a way to access the data, often with a fairly simple technique. Steal a laptop that’s unencrypted. Get a user to click on a link that installs keystroke logger or uses phishing to gain credentials. Scan a server for known software running with un-patched vulnerabilities or default accounts. I can’t tell you how many times I’ve logged into Oracle database servers with “System” and “Manager” in various organizations.

    Certainly our software platforms haven’t been well designed with security in mind. All sorts of expected, happy path behaviors are assumed by software developers, many of which are susceptible to attacks. While modern platforms are better designed and patches are becoming widely available, far too few companies apply these patches and consider security in the software they build on top of the OSes, databases, and other frameworks used for software. As an industry, we are far too guilty of granting more security than needed, opening more ports than necessary, re-using accounts too often, and assuming that our network paths are secure.

    Good security comes from having layers that don’t open our systems to a single mis-configuration or simple attack. Disks should be encrypted, minimal privileges granted, accounts not re-used across systems, and network communications, even for simple copies, secured. I know this can slow some development and be painful to implement, but as we become used to using secure credentials and techniques in all of our work, the complexity will fade into the background, and it will be as easy to deploy a secure system as an insecure one.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.2MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Not Excited by Linux

    You’re not excited by Linux. At least most of you in this community aren’t excited. A recent poll we ran showed that nearly two thirds of the people answering aren’t interested in even evaluating SQL Server on Linux. That’s an interesting result because in some groups I’ve spoken with, quite a few people are excited by the prospect of using a different host platform for their database.

    When Microsoft first announced they were going to run SQL Server on Linux, I was excited, mostly because I think this means more applications and organizations would consider using SQL Server, which I think is a fantastic platform. It’s been the platform of choice for my entire career. However, from a business perspective, I wasn’t sure if this was a great idea. After all, Microsoft may reduce their revenue from Windows licenses if a large number of people moved to Linux for their underlying OS.

    Does the OS matter? I don’t know if it does. I’m not sure how much revenue comes in from Windows Server licenses for hosting SQL Server. I’m sure it’s a significant number, but will the number decline substantially if some people move to Linux from Windows for their SQL Servers? Perhaps, but I wouldn’t think many people make that move.

    Instead, I think the people excited by Linux hosting SQL Server are those that already are deeply committed to the Linux platform and avoid SQL Server because they don’t want to run Windows servers. There will be DB2 and Oracle databases that might move to a much less expensive SQL Server license. Certainly I expect lots of (free) Express editions installed by developers, which will allow them to gain experience, and perhaps be more comfortable in the future with SQL Server as a data platform.

    It’s hard to know if the move to Linux will result in a big change to Microsoft’s bottom line, but I do think it opens up many new opportunities for us, as data professionals, to find work. With the way that SQL Server works and the seamless way the Linux version seems to behave, I don’t even think most of us need to know much about Linux to develop or manage an instance on that platform.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.5MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • SQL Server is Getting More Popular

    At the db-engines.com site, SQL Server was named the DMBS of the year. This was the site’s choice based on a measure of how popularity changed from Jan 2016 -Jan 2017. Apparently SQL Server grew in popularity in a number of ways, including job offers and LinkedIn profiles, but also with various search engine metrics and forum discussions. A few people have noted that SQL Server isn’t the most popular DBMS, as Oracle and MySQL are above it in January 2017. However, the change in score was dramatic for SQL Server, with MySQL a close second.

    Perhaps Microsoft’s embracing of open source is a reason why SQL Server is growing in popularity. That’s what some people think. With the announcement of SQL Server on Linux, as well as the regular commitments they make to Github, where Microsoft is the largest contributor. Microsoft has had a place for open source projects, CodePlex, for years, but now they have an open source site as well where they have numerous announcements and resources about how one might integrate some of the open source products with their closed source products.

    I certainly think the popularity of SQL Server is increasing as it grows to encompass more and more features. Compared to Oracle, SQL Server is a much less expensive, and it integrates well with the .NET stack of programming tools. Microsoft has made strides to make it easier for connections from Java and Python code to SQL Server. I’ve run across quite a few people using Redis, ElasticSearch, and more in applications along with SQL Server, which implies it’s becoming more acceptable and easier to integrate different data platforms than in the past.

    SQL Server has been a part of my career for over two decades, and in that time I’ve seen it become more and more popular, more useful, and easier to integrate into a wide variety of applications. I expect this will continue with the Azure SQL Database and Azure SQL Data Warehouse, as well as the Azure Data Lake. There might not be as many installations of SQL Server as Oracle or MySQL, but I think it’s the best database platform for me.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.9MB) podcast or subscribe to the feed at iTunes and Libsyn.