| Author |
Messages |
|
Bruce
 |
| 02/13/2002 10:15 PM |
 Quote
 Reply
 Alert
|
| The SQL Servers at my job do NOT have any mail setup on them, which makes supporting them a problem. The main reason is security concerns. Is there really ANY concern. I know about how people could attach a file in an email, and send something that way, but, is there any problem with having SQL Mail in place? I've never NOT had it on all servers. Any thoughts? Anything you've done to still have email in palce so DBA's could get notified of failed jobs, etc... but OTHER people couldn't send "anonymous" emails?? Thanks, Bruce |
|
|
|
|
Jason Morrow
|
| 02/14/2002 12:30 AM |
Quote
Reply
Alert
|
| I believe the main security concern with SQL Mail is the ability of a SQL server having the ability to easily send data to an external destination via email as you mentioned.
SQL Mail works in conjunction with Microsoft Exchange in almost all cases. The only other option is a Microsoft Mail Postoffice if I remember correctly.
The exchange mailbox used by SQL Mail can be restricted to never send or recieve internet email. This would keep any data send via SQL Mail from getting outside the MS Exchange Organization.
SQL Mail runs under the privileges of the SQL Server Agent Service so this account would need permission to the Exchange mailbox. Your out of luck if you run the Agent Service as LocalSystem you'll need a domain user account that the SQL Server and Exchange Server can authenticate. Since this is the only account that should have permissions to the exchange mailbox, sending anonymous email shouldn't be possible. |
|
|
|
|
Bruce
|
| 02/14/2002 7:11 AM |
Quote
Reply
Alert
|
| Thanks Jason. By sending "anonymous" mail, I was referring to the use of xp_sendmail, cause you don't really know who sent mail using that command, or from which program or machine either.
Is there any OTHER way that you can notify an operator on an alert?
Any way to restrict the mail xp's, so just anyone can't use them, but any alerts could be sent? Meaning, if I removed xp_sendmail, is that what the job scheduler and alerts use to send mail??
Very good point about restricting the email account to be internal to the company, so it could only send/recieve from within... Thanks, Bruce |
|
|
|
|
Jason Morrow
|
| 02/14/2002 11:55 AM |
Quote
Reply
Alert
|
| The default permissions on xp_sendmail is execute for the sysadmin role only.
I still don't know how to audit who or what host specifically used xp_sendmail within sql. |
|
|
|
|
Charl Reid
|
| 03/26/2002 8:12 AM |
Quote
Reply
Alert
|
| The simplest way to trap who has sent a given mail via xp_sendmail would be to provide a 'wrapper' stored procedure that would identify the user before calling xp_sendmail.
Alternatively you could write all messages to a messages table with sendmail functionality provided by custom stored procedures - this would also give you an audit trail.
Best regards |
|
|
|
|
|