1

We have DBAs who want to access SQL DBs over DirectAccess (DA). The ask is to open port TCP 1530 over DA. At the moment, we have 6,000 people using DA, we can't filter on a specific group of DBAs. Effectively if we open the DA rules to all clients, that's 6000 individuals with access to the DBs (TCP 1530).

What's the best practice approach? Preferentially backed with official vendor/body preferences.

Improve this question
1
  • I'm not a Windows guy by any means, but after reading the Wikipedia articles on DirectAccess and Group Policies, I think you'll have to revisit the "we can't filter on a specific group of DBAs" bit and figure out how to, or you simply can't achieve what you're trying to(I can't imagine a scenario in which allowing 6k people access to a system so a few of that group who need access can have it will ever fit "best practice"). Hopefully I'm wrong, for your sake. Best of luck either way.
    – TCooper
    Oct 22, 2020 at 21:52

1 Answer 1

Reset to default
1

Directly exposing core services' admin ports and access is not best practice. The better approach is to create a "jump box" which is a remotely accessible workstation (often virtual) where your admins log into to perform admin tasks as if they where on your local network.

The jump box can be locked down, monitored, and have additional security.

If you expose admin ports, you are limited in how you can secure that access.

Improve this answer
1
  • As a side note: I would use openssh as the tool to give this access, it is both battle tested and has the capability to only allow traffic to a specific port and with public key encryption instead of a password.
    – LvB
    Oct 23, 2020 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.