Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was just using Sql Server Management Studio on my WiFi, and I was actually wondering how secure the traffic/database communication is. Is traffic from querying secure, or is it easily sniffed for passwords and sensitive data?

share|improve this question

3 Answers 3

up vote 11 down vote accepted

By default the database communications are unencrypted and vulnerable to sniffing. To utilize encryption, you need to configure the SQL server with a certificate and then configure the client to take advantage of it. There's a pretty simple walkthrough for the process here

share|improve this answer

Tunnel the SSMS connection through SSH. To specify a port in the SSMS connection string use comma + port. For example...

Without tunnel: "sql.northwind.com" (which is the same as sql.northwind.com,1433)

With tunnel: "localhost,1433"

Or if you need to change the source port (if you have SQL running on your local box): "localhost,50000" with the SSH tunnel forwarding to 1433/tcp on the remote end

share|improve this answer

gowenfawr suggestion is partially wrong on this one. Your initially connection (username and password) to SQL Server may or may not pass your username in clear text. This can depend on what connection type you use (ODBC, OLE DB, etc). Your password is always passed in encrypted format by SQL Server. Now your data itself from the queries being passed will show up in clear text, by default.

I wrote up a tip on MSSQLTips.com about this and show the captures from Wireshark. Which it shows your username will be passed in clear text if you are using ODBC, but SSMS uses OLE DB and will not show your username.

To easily hide your data itself, you can just enable "Force Encryption" as I wrote about, and let it use the cert SQL Server generates. Although a stronger encryption would be accomplished using gowenfawr suggestion. You will want to read up on this as using this feature will deny connections to your applications in some circumstances.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.