Shulou(Shulou.com)05/31 Report--

This article shows you how to set up your MS SQL security identity. The content is concise and easy to understand. It will definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

The following involves modifying NTFS disk permissions and setting security policies, so be sure to make any changes after making sure you understand the possible consequences of the operation. The permissions mentioned in this article are all rights attached to the original permissions.

[background]

By default, when the MS SQL service is installed, the service startup account is set to the system account (SYSTEM) or a designated user. If it is set up as a system account, because this account represents the system itself, in the case of MS SQL defects, malicious users or intruders can take advantage of these defects to operate on the final resources of the system with the privileges of the system itself. The same problem occurs if you set up to run the MS SQL service under the account of the administrators group. The way to solve the problem completely is to reduce the system permissions of the MS SQL operator to ensure that even if the MS SQL is breached, the intruder can not threaten the security of the system. This article mainly describes what permissions need to be set to ensure the normal operation of the MS SQL itself after reducing the permissions of the MS SQL operator.

[modification steps]

1. Create a user

Create a user named mssqlusr and set a random password, preferably no less than 20 characters in length.

2. Set the identity of the user

Add mssqlusr users to the Guests group and remove any other groups.

3. Set the user's group policy rights

In the Control Panel → Administrative tools → Local Security Policy, find the local policy → user rights assignment and confirm the following two permissions: deny local login: it should include the Guests group login as a service: it should include the mssqlusr user

4. Modify relevant disk permissions

C: disk-related permissions

C:

Mssqlusr (only this folder)

Traversing folders / running files

List folders / read data

Read attribute

Read extended attributes

* Note: the above permissions need to be set in the advanced settings on the permissions page.

C:Program FilesMicrosoft SQL Server

Mssqlusr

Read and run

List folder directories

Read

C:Program FilesMicrosoft SQL ServerMSSQLData

(if this directory is used to place mssql users or backups)

Usr

Modify

Read and run

List folder directories

Read

Write

Other disk-related permissions

(suppose the user's database is set up in D:hostingmssqldb)

D:

(if this partition is used to place mssql user databases or backups)

Mssqlusr (only this folder)

Traversing folders / running files

List folders / read data

Read attribute

Read extended attributes

D:hostingmssqldb

(if this directory is used to place mssql user databases or backups)

Mssqlusr

Modify

Read and run

List folder directories

Read

Write

Backup related settin

(suppose the administrator backs up the database in E:ackupmssqldb)

E:

(if this partition is used to place mssql user databases or backups)

Mssqlusr (only this folder)

Traversing folders / running files

List folders / read data

Read attribute

Read extended attributes

E:ackupmssqldb

(if this directory is used to place mssql user databases or backups)

Mssqlusr

Modify

Read and run

List folder directories

Read

Write

The above content is how to set MS SQL security identity. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.