Voice of the DBA

Tag: sql server

  • Unprotected Queries

    SQL Injection
    SQL Injection is a constant problem in many applications.

    Today’s editorial was originally released on Dec 4, 2007. It is being republished as Steve is at the PASS Summit.

    This is absolutely amazing;over half a million database servers have no firewall. How can you put up a database server, SQL Server, Oracle, DB2, even MySQL, without a firewall?

    How can you put any server on the Internet without a firewall? Even most home routers enable a NAT router and basic firewall these days, not allowing connections in by default. In the last 5-6 years, the technology has been widely available, even to uninformed home users, to not deploy any system on the Internet without protection.

    So how do these servers get out there? Are these development systems? Are people opening 1433 so they can test an application or access their remote SQL Servers? That’s what I suspect. Many developers I know are optimists and they don’t expect people to be pinging their servers or accessing their systems in any way other than how it’s designed.

    We’ve been hacked here at SQLServerCentral.com a few times over the years with SQL Injection techniques, but never to my knowledge with an attack directly against our SQL Server. For a long time we did have our SQL Server exposed, but not on 1433. It was on a high, random port that was unused by any other service and we had strong passwords on accounts. It was a convenience service, we had login tracking, and I never saw an unexpected attempt in our logs.

    However if you run a corporate SQL Server and need to stick servers outside your firm’s firewall in some type of DMZ, at least close off port 1433 to anonymous access. Go spend the $100 out of your pocket for a small router that can at least protect your servers with basic NAT and prevent traffic from getting directly to your database server. It might not be the best solution, but it’s better than nothing.

    There’s no excuse these days for putting a server out on the Internet without at least basic NAT protection. Some type of router or firewall should protect every server, and probably every computer, and only allow those services that are really needed. For most servers, this is port 80 and nothing else. Allowing access to SQL Server, RPCs, or any other port that’s not meant for anonymous access, is really stupid.

    And if you can’t figure out a way to securely make your service available to partners or customers, then you should hire someone that can. There are plenty of networking professionals out there that can help you set things up correctly.

    Know your limits, ask for help, and don’t jeopardize your company’s security because of ignorance, pride, or laziness.

    Steve Jones

    The Voice of the DBA

    Wakamojo

    The podcast feeds are now available atsqlservercentral.podshow.comto get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted. You can get feeds from there.

    Today’s podcast features music by Wakamojo, the Kansas band featuring our very own Adam Angelini, DBA from the heartland and SQLServerCentral.com community member.

    I really appreciate and value feedback on the podcasts. Let us know what you like, don’t like, or even send in ideas for the show. If you’d like to comment, post something here. The boss will be sure to read it.

  • SQL in the City Slides

    I’m making the slides available from my SQL in the City 2012 talks. You can download them here

    If you attended, you’ll get an email with links to videos to watch soon.

  • Database Maintenance Essentials

    Abstract: SQL Server requires a minimal level of maintenance to ensure that the platform functions at an optimum level without any unnecessary outages or problems. This talk will look at the basics of the maintenance operations that should be performed on SQL Server on a regular basis. The topics covered include:

    • Managing MDF and LDF Files
    • Managing Indexes
    • Maintaining Statistics
    • Checking for Corruption
    • Creating Backups That Will Restore
    • Managing Maintenance Jobs

    I cover the reasons why maintenance is required and include a number of references to help you enable this maintenance in your environment.
    In some presentations I will also cover the Red Gate tools that make this maintenance easier to perform. This is optional.

    Level: 100

    Length: 60 minutes

    Slides: Database Maintenance Essentials (SQL in the City)

    Presentations:

    You can view my complete speaking schedule here: http://wp.me/P14wgJ-1tV

  • Searching Binary Data in SQL Server

    More and more data collected in organizations is in an encoded format, essentially a binary classification of data. These can be images, audio files, video, or even common formats like Word and Excel files. This data contains lots of important data, but the formatting must be stripped out in order for users to effectively search this data.

    This presentation starts with a discussion of the three types of data in SQL Server to set the framework. It demos and explains:

    • structured data
    • semi-structured data
    • unstructured data

    The talk then looks at how unstructured data is stored in SQL Server, specifically briefly looking at Filestream and Filetable.

    There is a short discussion of full text search, with a look at the changes in SQL Server 2012 before moving on to the iFilter interfaces which are used to search the binary data while ignoring the encoding. There are demos of the basics of CONTAINS and FREETEXT searches, along with some of the more advanced options, like customizable NEAR and weighting of search terms.

    The talk finishes with a short look at the new semantic search feature in SQL Server 2012.

    Level: 200

    Length: 60 minutes

    Downloads: PPTX, code

    Presentation Schedule:

    June 1, 2013 – SQL Saturday #200 – Philadelphia

    May 3, 2013 – SQL Bits XI

    April 7, 2013 – SQL Saturday #197 – Omaha

    October 30, 2012 – SQL Connections, Fall 2012