Do You trust your DBA

I noticed a new tool appeared last week from Sentrigo that scrambles SQL Server passwords so that they cannot be seen in plain text by the DBA. 

This is to address a supposed vulnerability in SQL Server 2000/5 where by allowed memory dumps which exposed users passwords (BTW I am not doing a post on how to).  This only applies to installations where mixed mode is set and those passwords belong to a SQL Server (as opposed to a windows authentication) account. 

I was interested in what the Microsoft security team had to say about this and what their recommendations are as they have usually fixed this sort of thing before most of us are aware that it exists.

Firstly the problem doesn’t apply to:

• SQL Server 2008 in mixed mode.
• Any version of SQL Server in windows authentication mode

Secondly you have to be a member of sysadmins to run these tools so as with any security it all comes down to how much you trust the gatekeeper i.e. the DBA. This is why there is no fix from Microsoft to address this issue nor will there be.

If this is a concern for you and it might be because this could mean that a sysadmin could impersonate a user without their knowledge I don’t really see how the Sentrigo utility is going to help. It it runs a scheduled job to scramble memory according to some unknown algorithm which I assume any sysadmin would be aware of.

Having said that SQL Server 2005 has a common criteria version cleared for use in governments so I don’t consider this is a big deal. BTW SQL Sever 2008 as it is still going through this process whihc could only start once the product was released

Technorati Tags: Sentrigo,SQL Server,security