1

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take.

  1. Block all remote access :- I have heard that through firewall you can block all the remote users to connect your server unless you have allowed a specific IP to access the server (by adding a rule to firewall). Will this be enough to keep hackers away?

  2. If a SQL user is only given GRANT EXEC rights will he be able to do anything except run the store procedures?

  3. Should i go for Microsoft or Linux based OS : I have heard linux based I/O is very fast that is necessary for my application but is it more secure as compared to Microsoft?

Please feel free to correct me wherever i am going wrong as i am a newbie .

Thanks in advance

closed as too broad by Deer Hunter, Matthew, Xander, schroeder Jan 29 '16 at 15:49

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You're not going to learn to secure a big project, from scratch, covering OS, database and firewall, in the answers to a security.stackexchange post. It's too broad, and too vaguely-specified, and I've voted to close it as too broad to give a valid answer. – TessellatingHeckler Jan 29 '16 at 7:10
  • @TessellatingHeckler i am just asking for the above 3 points no more no less – Developer Nation Jan 29 '16 at 9:16
  • 1
    @DeveloperNation you keep saying that you are just asking about OS, database, and firewall, but those are MASSIVE topics each. The 3 answers below are far too light on details to be of any help to you. – schroeder Jan 29 '16 at 15:49
  • How secure an operating system is depends entirely on you... That said, Linux is a more secure operating system. If you're not computer literate enough to prefer *nix systems yet, chances are deploying a server that requires security onto the public internet isn't a good idea. – Parthian Shot Jan 30 '16 at 18:37
0

You've not specified what SQL your using. Keep in mind that Microsoft SQL Server will only execute onto Windows operating system.

I'll make the assume that your using Windows Server and Microsoft SQL Server.

Firewall:

  • Blocked all connections.
  • Allow port 1433 (SQL TCP) for your computer which talks to SQL only
  • Allow port 1433 (SQL UDP) for your computer which talks to SQL only
  • Any other network related services you require such as RDP etc.

Windows: If your server can be hacked, once the attacker is on your server then they'll have full access to your SQL. So, ensure you're windows updates are up-to-date, guest account is disabled, your using strong password and so on.

SQL: Make sure all accounts within SQL have strong passwords. GRANT EXEC may not give you desired permissions you require. If the object is created by another owner, you'll require permissions of what your stored procedure actually does. For example, if you had SELECT * FROM dbo.Product in your stored procedure which was created by user Paul then user Developer Nation would not able to execute it as it would have SELECT permission denied for table dbo.Product.

I hope this is a good starting point for you.

  • yeah that is pretty much what i was looking for. But i want to know that i heard that through firewall we can restrict people accessing the server by matching the IP (manually written in rule) mentioned in the rule with the current user trying to connect the server directly. Is this true or not? – Developer Nation Jan 29 '16 at 11:10
  • You can only blocked per IP in firewall. There is nothing to IP restrict within SQL natively. You should write your own code in SQL to manage IP restriction per user but it's not recommended. So, basically you would use logon trigger and check IPs in there and cancel logon if doesn't match your restiction but like I said before it's not recommended to use triggers for security. – Paul Jan 29 '16 at 11:21
0

For securing a server you can follow the TCP/IP Model for trying to have the most secured system possible.

enter image description here

With this model you will apply the principe of secure in depth and you will apply a secured principe on each layer of the model.

Example: If your SQL server talk with only a few servers in the same local network you can do a static ARP table with each server.

To protect your layer 3 and 4 (protocol IP and TCP), you will apply firewall rules like this :

# MYSQL FROM WEB SERVERS
-A INPUT -s <ip source> -d <ip destination> -i eth0 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -s <ip source> -d <ip destination> -o eth0 -p tcp -m state --state ESTABLISHED -m tcp --sport 3306 -j ACCEPT

After, you will apply secured rules on your SQL server :

  • create users with appropriate rights on the DBs don't connect with root credentials, create a user per db and all others secured principes specific to your SQL server
  • secure your server (the OS) physically and logically

And finally, you will be aware to secure the applications (if you can) which connect to your SQL server.

With all of that, you have a starter point to begin to secure your system.

  • thanks for the additional knowledge but can you tell me are the above 3 methods worth implementing or not? and will they have any use if it is implemented? – Developer Nation Jan 29 '16 at 9:19
0

I'm with TesselatingHeckler that you should really think twice about this because making a big project with half-assed copy pasta solutions in server and SQL is really a bad idea. You can read up the information necessary but as said, its just really broad. You should probably start with the database as this is the most critical part of an application and look up some info about the most common security issue, SQL injection. OWASP is the best reference for this:

https://www.owasp.org/index.php/SQL_Injection
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
https://www.owasp.org/index.php/Query_Parameterization_Cheat_Sheet

  • i am just asking for the above 3 points no more no less – Developer Nation Jan 29 '16 at 9:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.