SQL Server....what would happen

SkyHog

SkyHog

Touchdown! Greaser!
Joined
Feb 23, 2005
Messages
18,510
Location
Middle of nowhere Texas
Display Name
Everything Offends Me
Home Airfield
KLUD
We were discussing stuff today, and my brain just thought of something.

Lets say you have a SQL Server that requires Windows Authentication, and it is attached to domain "DOMAIN1."

Now, you steal that physical server, and attach it to DOMAIN2. Simply by attaching it to a different domain, and authenticating to DOMAIN2, are you now authorized to grab the data from the server?

If I'm not explaining clearly, I can try again or draw a diagram.
 
SkyHog said:
We were discussing stuff today, and my brain just thought of something.

Lets say you have a SQL Server that requires Windows Authentication, and it is attached to domain "DOMAIN1."

Now, you steal that physical server, and attach it to DOMAIN2. Simply by attaching it to a different domain, and authenticating to DOMAIN2, are you now authorized to grab the data from the server?

If I'm not explaining clearly, I can try again or draw a diagram.
Click to expand...

Yes, but to get it to join DOMAIN2, you'd need administrative privileges on the server anyway.

Right?
 
SkyHog said:
So, if one were to employ one of the methods found here: http://www.petri.co.il/forgot_administrator_password.htm they could very easily gain access to this data?
Click to expand...

They could gain administrative access to the box which, 99% of the time I'd wager, on SQL Server boxes configured to use Windows Authentication, means access to the DB, because I believe any account that's in the local Administrator group is going to be in the dbo role or whatever by default. But...

SkyHog said:
If so, I have some work to do to find a way to stop this.
Click to expand...

Make sure that only domain accounts are SQL Server users, and that Local Administrators (and all other local users/groups) don't have SQL rights. That should do it, but then there's the whole cached credentials thing...

Long story short, if somebody gets local administrator rights to a box, they're going to get access to all the data on it no matter what you do (edit: short of EFS, maybe.)
 
It doesn't really matter Nick. If you have physical access to a machine all bets are essentially off. Things get a little better with disk encryption, etc -- but this isn't that viable to a server.

If you can physically touch the server -- then there is no more security. If you have an administrator account, same thing.
 
jesse said:
It doesn't really matter Nick. If you have physical access to a machine all bets are essentially off. Things get a little better with disk encryption, etc -- but this isn't that viable to a server.

If you can physically touch the server -- then there is no more security. If you have an administrator account, same thing.
Click to expand...

What he said.
 
You must log in or register to reply here.
Back
Top