As many articles have covered SQL passwords are very easy to figure out. SQL passwords

are stored in the sysxlogins table in master database. To access this table you have to be

a member of the fixed role sysadmin or sysadministrator. Still there are programs out

there that use the lack of SQL accounts lockout to hack a password. What can

we do to prevent this or at least make it harder for them?

Log logins

When performing an installation of SQL server you will be asked if to use SQL Server and/or

Windows authentication, default it is set only to Windows authentication. Even

though you

choose not to allow SQL logins this is not that hard to change in the registry and then

allow SQL accounts to login as well. There is always at least one SQL account to hack -

sa.

If you change to do some type of log of logins, you will have a fair chance to trace

someone trying to hack your SQL server through a SQL password. To change so that SQL server

log logins in the errorlog you right-click on the server in SQL Server Enterprise Manager

and select Properties. Change to the Security-tab and review your options:

Audit level
• None
• Success
• Failure
• All

Choose carefully, since All and Success might cause your errorlog to fill

up the disk rather quick depending on the applications/users using your SQL server.

Any changes made at the Security-tab needs a restart of SQL server to take affect.

After changing you are able to use different ways to check the SQL server errorlog for any

login attempts, but that "how to" will not be covered in this article.

Safe passwords

Dictionary word are one of the first ways any hacker will try to crack a password, that

is why a combination of letters, digits and special characters are required in order to

have a really safe password. Making any password to hard to remember will end up in users writing their

passwords in a document or even on a "post it".

My idea of a safe password that is not to hard to remember:

Password requirements
• Minimum 6 characters long
• Minimum 1 uppercase letter
• Minimum 2 alphanumeric characters
• Maximum 2 equal letters after each other
• Not the same as the login

There are only two sp's that perform any type of password check sp_addlogin and

sp_password. It is not recommended to make any changes in any stored

procedures

shipped by MS but this is the only way you can check for password requirements.

Update stored procedures

After updating the two stored procedures and inserting a password check for new or existing

users can add a insecure password. Then trying to, an error message will appear prompting for

a safer password:

First, make a backup of your master-database, then run the two scripts:

• alter_sp_addlogin.sql
• alter_sp_password.sql

Remember that both scripts may be updated in hotfixes and servicepacks. So

remember to check

the password requirements after applying a SQL update.

Note: None of the existing password will be checked. This will only affect existing

users that change their current password and new users that will be added to SQL server.

Existing passwords

This is only a fairly easy check of the existing passwords in your SQL server. The only

things that will be checked is if the password is:

• NULL
• Same as login name *
• Same as login name but reversed *
• Only one char long

Run this script in Query Analyzer:

• check_weak_passwords.sql

The script will generate a list of the SQL users passwords that are fairly easy figure out.

Talk to the users and make them understand about the password sequrity, and what they should

do about it.

* Same does not check for upper- and lower cases. SQL login "abc" and password "Abc"

will report as same.

Summary

Even if you do all of above, your SQL server will not be safe from hackers. Your

environment

is always a potential target of any hackers out there. But at least you have made it harder for

them.