| Reply To Message: |
| Posted By |
n/a on 9/6/2007 8:29:40 AM |
| Subject: |
SQL Server Browser Service - Logon Account Privileges |
| Message: |
I read an MSDB article that states the following.
SQL Server Browser listens on a UDP port and accepts unauthenticated requests using SQL Server Resolution Protocol (SSRP). SQL Server Browser should be run in the security context of a low-privileged user to minimize exposure to a malicious attack. By default, SQL Server Browser starts using the Local System account. The logon account can be changed by using the Windows Services program. The minimum user rights for SQL Server Browser are as follows:
* Deny access to this computer from the network.
* Deny logon locally.
* Deny logon as a batch job.
* Deny logon through Terminal Services.
* Log on as a service.
* Read and write the SQL Server registry keys related to network communication (ports and pipes).
In our case the SQL Server Browser service is running under the same Windows account as our other SQL Server services. Do you recommend creating a separate Windows account for the SQL Server Browser service as described above?
Can you help me understand how an attack can occur?
Thanks, Dave
|
|