Fog Creek Software
Discussion Board




MSDE Desktop Security

I have heard that it's generally a bad idea to run MS-SQL on a machine that's either has a real IP or is not behind a firewall, so I'm wondering if it's a bad idea to run the free MSDE Desktop (or ASP) server.  Microsoft's website says that you can run MSDE as the database server for ASP.NET websites.  However, I'm worried if I run it, I'll be compromising my machine.

Has anyone here had any experience running the MSDE Desktop (or ASP) edition with a direct connection to the Net?  Am I being an overly paranoid MySQL fan?

Thanks!

Andrew Burton
Wednesday, April 07, 2004

If you're running the database for a website, it doesn't need to be open to the 'net - it only needs to be open to the process running the site. Even if it's on the same machine, you can firewall it so 1433 calls are only allowed from the local host.

Philo

Philo
Wednesday, April 07, 2004

I think there's a setup switch for MSDE to disable all network protocols.

To be doubly sure you can run svrnetcn.exe (it should be in your PATH after installing MSDE) - here you can disable all network protocols. To connect to the database on the local machine you use:   
  (local)
or
  (local)\InstanceName

which connects via shared memory rather than via any network gubbins.

Duncan Smart
Wednesday, April 07, 2004

Philo: I'm ashamed to say this, but blocking that port from the outside hadn't even occured to me.  Thank you!

Duncan: Thank you.  Getting even further away from the network is even better.  (Mind you, I think I'll still block that port. *g*)

Thanks, guys!

Andrew Burton
Wednesday, April 07, 2004

Being a pedant... blocking 1433 wouldn't be enough as this only block calls via the TCP/IP Socket NetLib, Named pipes is also enabled by default so you'd need to block SMB/NetBIOS/NetBT too - which would also stop you being able to share out files (which might not be a huge problem).

Duncan Smart
Thursday, April 08, 2004

...and Slammer was exploiting port *1434* which is where SQL announces/confirms its presence.

Duncan Smart
Thursday, April 08, 2004

Attention all firewall users:

YOU DO NOT BLOCK PORTS!!!

Rather, you should be blocking EVERYTHING and explicitly OPENING ports ONLY FOR THE SERVICES YOU USE.

If you are not sure what services you use, then open nothing, and let your user's bitching be a guide.

This "default deny" policy protects you from things you don't know about as well as those you do.  If MS SQL decides they need a new protocol and port, the default deny will maintain your protection from outside.

David Jones
Thursday, April 08, 2004

amen, brother!

Michael Kale
Thursday, April 08, 2004

*  Recent Topics

*  Fog Creek Home