Disable SA user for remote Access (SQL Server)

[elenlace]

Hi,

I was just wondering if there is a way to disable the 'SA' user for SQL Server Express 2005 exclusively for Remote Access (through port 1433).

If that is not possible, will renaming the SA user to a different username would affect Plesk? I guess is just a matter of changing the username in the Plesk Admin Panel (Servers > Database > MS SQL)

I intend to do what is explained here:

http://www.sql-server-performance.com/faq/system_administrator_role_p1.aspx

We just had a security issue on a brand new Windows Server 2003R2 with Plesk 8.2 server where after a few hours of the server being delivered to us, the server was infected with a Backdoor.

After some research, it seems they got in through SQL Server Express 2005 using the SA account.

We want a solution that is not just closing port 1433, our customers demand the need to be able to administer their SQL databases remotely.

 

[somnath]

1. I dont think changing SA will work as Plesk seems to be connecting using its password only - however, other experts may have different opinions. No harm in trying it for once I guess as SQL Server is totally alienated from Plesk if your Plesk database is using Access DB.

2. Having a very long and strong password for SA should do the job. You normally wont be needing it after specifying it once in Plesk.

3. ASP.NET Enterprise Manager also does a neat job in managing SQL databases remotely using a web interface thereby not requiring you to open port 1433.

4. You can change the port SQL listens to i.e. instead of 1433 it could be any port of your choice by configuring SQL to do so. Search MS KB for the same.

5. Applying regular Windows updates normally keeps these backdoor entrants at bay.

6. Ensure unnecesary ports are not open in the Windows Firewall

7. Ensure atleast 10% memory is always available for the system i.e. do not overload your server too much.

8. Do not allow clients to disable antivirus for their accounts and have serverwide antivirus enabled always and for all options available.

 

[JackL]

Actually you can use IPsec to secure tcp port 1433.

John S.G.

 

[elenlace]

JackL,

Could you be so kind to point out how could this be achieved?

Warmest Regards

 

[sergius]

Could you be so kind to point out how could this be achieved?

http://msdn2.microsoft.com/en-us/library/aa302366.aspx