Guardicore has released a PowerShell script that examines servers to determine if they’ve been infected. We’ve safely run the scripts on SQL Servers in our lab environment and for many of our clients.

If you routinely apply regular updates to your servers, practice the Principle of Least Privilege, regularly change critical passwords, have stringent password complexity requirements, and don’t expose your SQL Servers directly to the internet, the likelihood of a brute force attack succeeding is greatly reduced.

Here are six scripts that can help determine your level of potential exposure.

Who Has sysadmin or serveradmin Privileges?

The Vollgar attack is a brute force attack that attempts to guess the password for SQL Logins with elevated privileges. To be successful it needs logins that can execute sp_configure to change server-level settings. This are implicitly held by the sysadmin and serveradmin fixed server roles.

So, the first step in determining your exposure to Vollgar is to discover the members of the sysadmin and serveradmin roles. The following script will show you the members of each role.

USE master; 
GO

EXEC sp_helpsrvrolemember
	'sysadmin';

EXEC sp_helpsrvrolemember
	'serveradmin';

In my sample database, the following is returned.

Another approach to retrieving the same information in one consolidated result set is to use the following script.

--list of logins that are members of the sysadmin or serveradmin roles
SELECT SP1.[name] AS 'Login',
	SP2.[name] AS 'ServerRole'
FROM sys.server_principals AS SP1
	JOIN sys.server_role_members AS SRM 
		ON SP1.principal_id = SRM.member_principal_id
	JOIN sys.server_principals AS SP2 
		ON SRM.role_principal_id = SP2.principal_id
WHERE SP2.[name] IN ('sysadmin', 'serveradmin')
ORDER BY SP2.[name],
	 SP1.[name];

As expected, this script produces the same results.

Of course, it’s best practice to only grant the minimum rights required by each login, a practice known as least privilege. If these queries return more logins than absolutely necessary, it’s time to review your security practices.

Who has Passwords that Do Not Expire and without Password Complexity Requirements?

Having a complex password and changing it regularly is part of the basic blocking and tackling of security. Passwords like “Password123”, “Qwerty”, and “Puddles!” can be cracked in very short order using tools freely available on the web. And if these passwords never expire, users have no reason to change them regularly, making them even more of a liability.

For Windows Integrated Authentication, password complexity and expiration is handled at the network domain level. For SQL logins, these are enforced inside of SQL Server.

To find active SQL logins (e.g. not disabled) that do not require a basic level of complexity and are set to not expired, run the following script.

--Active SQL Logins where passwords do not expire
--and do not have complexity requirements 
SELECT name, 
	type_desc, 
	create_date, 
	modify_date, 
	default_database_name
FROM sys.sql_logins
WHERE is_expiration_checked = 0
	 AND is_disabled = 0 
	 AND is_policy_checked = 0 ; 

In my sample system, the script produces the following list.

Regularly changing passwords creates a moving target for potential attackers. If you have SQL logins that do not expire and do not have minimum complexity requirements, consider turning these features on for all your logins.

Putting some of the above queries together will give us a list of all active SQL logins that are members of the sysadmin or serveradmin fixed server roles along with whether their logins adhere to password complexity and expiration policies.

--list of SQL logins that are members of the sysadmin or serveradmin roles
SELECT SP1.[name] AS 'Login',
	SP2.[name] AS 'ServerRole',
	CASE l.is_disabled WHEN 1 THEN 'No' ELSE 'Yes' END AS Is_Enabled,
	CASE l.is_expiration_checked WHEN 1 THEN 'Yes' ELSE 'No' End AS Pwd_Expires,
	CASE l.is_policy_checked WHEN 1 THEN 'Yes' ELSE 'No' END AS Pwd_Complexity_Reqs
FROM sys.server_principals AS SP1
	JOIN sys.server_role_members AS SRM
	ON SP1.principal_id = SRM.member_principal_id
	JOIN sys.server_principals AS SP2
	ON SRM.role_principal_id = SP2.principal_id
	JOIN sys.sql_logins AS l
	ON l.principal_id = SRM.member_principal_id
WHERE SP2.[name] IN ('sysadmin', 'serveradmin')
ORDER BY SP2.[name],
	 SP1.[name];

The following results are returned on my test system.

When was a SQL Login Password Changed?

From the prior two queries, we can see that Alice and Donnie are both active members of the sysadmin fixed server role. Donnie’s password doesn’t expire and doesn’t have to meet any password complexity requirements. Of course, this is a big red flag for security. Alice’s login, on the other hand, is set to adhere to complexity and expiration requirements. That’s good.

But how long has it been since Alice actually changed her password? We can use the LOGINPROPERTY() function to help us. Note: that for the function to return meaningful information, both CHECK_POLICY and CHECK_EXPIRATION must be enabled for the login.

--when was a login's password last changed?
SELECT 'Alice' AS username,
	LOGINPROPERTY('Alice', 'PasswordLastSetTime') AS PasswordLastSetTime;

In this case, we can see that Alice last set her password on March 26, 2020.

We can use other properties in the LOGINPROPERTY() function, such as BadPasswordCount and BadPasswordTime. I wouldn’t rely too heavily on the results, though. The BadPasswordCount is reset to 0 as soon as Alice successfully logs in. And, just as importantly, it’s only relevant for those SQL Logins who have CHECK_POLICY and CHECK_EXPIRATION enabled.

--bad password attempts
SELECT name, 
	LOGINPROPERTY(name, 'BadPasswordCount') AS BadPasswordCount,
	LOGINPROPERTY(name, 'BadPasswordTime') AS BadPasswordTime
FROM sys.sql_logins 
WHERE is_expiration_checked = 1
	AND is_disabled = 0 
	AND is_policy_checked = 1; 

The results from my test system are shown below.

How to See Failed Login Attempts

Assuming your SQL Server is configured to log failed login attempts, and of course it should be, you can query the error log files using the sp_readerrorlog procedure to see the failed attempts.

EXEC sp_readerrorlog 0, 1, 'Login failed' ;

The following is returned on my test system.

Better yet, use a monitoring tool to proactively monitor failed login attempts and alert when a minimum threshold is exceeded. For our DBA as a Service clients, we provide SentryOne‘s SQLSentry monitoring tool to help with this and other events that should be monitored.

Parting Thoughts

Many years ago, I set up a test system for a writing project I was involved with. As part of the test, I set the sa password to something like “Cat123Dog!” The password met most requirements of the day – upper and lower case, at least one number and one letter, and a special symbol. “Not bad,” I thought to myself.

Then I downloaded Ophcrack, a free Windows password cracker, and released it on my unsuspecting SQL Server. Expecting the utility to run for hours, if not days, I returned to work.

A few minutes later, I decided to check on it, wanting to make sure it wasn’t hung for some reason. I was stunned. Ophcrack had already found the password! That was at least 10 years ago. I’m sure the tools of the hacker trade have gotten much better since then.

Recently, I’ve read where most breaches are a result of social engineering – someone receives an e-Card from a secret admirer, finds a thumb drive in the parking lot, or clicks an email link. “The days of brute force attacks are over,” they say.

Vollgar has proven them wrong. Basic security measures are still best practice. You owe it to yourself to make sure you’re doing it well. Here are a few links that may help.

• Introduction to SQL Server Security
• Securing SQL Server
• SQL Server Security Checklist

The post Vollgar: 6 Scripts to Help Review Your SQL Servers appeared first on The SERO Group.

What version is my SQL Server currently running?

There are several ways to check the version of SQL Server you’re currently running – all of them documented in countless places on the the web. Checking the instance property page in Management Studio and executing SELECT @@VERSION are two of the more common.

My preference is to run the following script using SERVERPROPERTY. When used in combination with Central Management Server, you can check the current level for all the SQL Server instances in your environment with one click of the Execute button.

SELECT
	SERVERPROPERTY('servername') AS Server_Name,
	SERVERPROPERTY('edition') AS Edition,
	SERVERPROPERTY('productlevel') AS Product_Level, 
	SERVERPROPERTY('productversion') AS Product_Version,
	SERVERPROPERTY('productupdatelevel') AS Product_Update_Level,
	SERVERPROPERTY('productupdatereference') AS Product_Update_Reference,
	SERVERPROPERTY('resourceversion') AS Resource_Version, 
	@@VERSION AS Version_Information 

Running the query on my Docker container instance returns the following.

Keep in mind that SERVERPROPERTY can behave slightly differently for older versions of SQL Server. ProductUpdateLevel and ProductUpdateReference, for instance, were introduced as part of SQL Server 2012. When run against an older version, such as SQL Server 2005, these will return NULL.

Running against another older SQL Server produces the following. Still, it gives you the information you need.

So, is that up to date or not for this version of SQL Server?

What is the latest update level for my version of SQL Server?

To answer that question, let’s turn to the definitive source – Microsoft. Microsoft has gotten into a fairly predictable cadence of regularly releasing updates for SQL Server. To help us keep track of the releases they’ve provided a SQL Docs page that lists all versions of SQL Server for the past 20 years. Yes, all the way back to SQL Server 2000.

The list shows the Product Version, the Latest Service Pack (if applicable), the Latest GDR (General Distribution Release), the Latest cumulative update (CU), the CU Release Date, and a link to some General Guidance for the each version. Here’s what the site looks like today, March 31, 2020.

Not sure of the difference in a SP, GDR, and CU? Here’s a blog post I wrote 12 years ago when I blogged at SQLTeam that explains the vernacular.

Additional Information

Here are a few other links that may help.

• SQL Server Release Blog – A Micosoft Tech Community blog dedicated to SQL Server Releases.
• SQL Server Builds Blog – I particularly like this blog since it shows each version along with relevant build numbers.
• SQL Server Updates – Brent Ozar also maintains a great site for keeping track of version update information.

The post Is There an Update for My SQL Server? appeared first on The SERO Group.

Free SQL Server Training Resources

Often these IT Professionals, sometimes called “Accidental DBAs,” do an admirable job, even with little formal SQL Server training. Fortunately, there are a lot of great resources available online for the “Accidental DBA.” Here are a few free SQL Server learning resources worth checking out:

1. Microsoft Resources and Labs

Microsoft has put together quite a few learning opportunities available to the public for free. These are in several different formats so you can pick the one you’re most comfortable with. Here are a few you may want to check out:

1. Microsoft SQL Server 2019 (CTP 3.2) Lab. In this self-paced lab, you’ll learn how to use SQL Server 2019 to solve business challenges.
2. Microsoft AI School. Artificial Intelligence is a hot topic in today’s business environment. In Microsoft AI School, you’ll “find the information, learning materials, and resources you need to start building intelligence into your solutions.”
3. SQL Server Tutorials. More than just Online Documentation, SQL Docs is a great place for detailed information about how to use SQL Server. It includes tutorials that will step you through learning the database technology.
4. EdX. Founded by Harvard and MIT, EdX is a place where education is freely available to everyone online. Microsoft has partnered with EdX to provide free courses online for SQL Server. Here are a few:
   • Querying Data with Transact-SQL.
   • Developing SQL Databases.
   • Analyzing and Visualizing Data with SQL Server Reporting Services.
5. Channel 9. Microsoft produces a lot of video content for SQL Server and other products. They make it available online via Channel 9.

2. YouTube Channels

YouTube can be a great resource for learning just about anything. From changing a tire to playing the ukulele, you can find it on YouTube. It should come as no surprise that there are a lot of great SQL Server training videos available as well. Of course, since just about anyone can create a video, you’ll want to be careful. Not everyone is the expert that they portend to be online. Do your own research. Here are a couple of places to start.

1. SQL Server YouTube Search. A list of SQL Server-related videos.
2. Microsoft SQL Server YouTube Channel. Microsoft SQL Server home on YouTube.

3. SQLSaturdays and Virtual Groups

For many years, I was on the board of Directors for a global user group called PASS. The organization is committed to providing learning opportunities for professionals around the globe and to helping the community to better connect with one another. There are a couple of ways PASS helps with this.

1. SQLSaturdays are a series of free one-day training events in cities around the world. These events, as the name suggests are held on Saturdays and are free to attend. They typically have some of the best and most well-known SQL Server experts around. Look for a SQLSaturday near you and plan to attend. You’ll see some great content and better yet make some incredible connections.
2. Virtual Groups. Through live webinars, PASS Virtual Groups offer top-notch training no matter where you happen to be. Check out a list of upcoming webinars.

Summary

With a new release every 18 to 24 months, keeping up with the latest changes can be a challenge. Hopefully, these free resources will help. We also have an ever growing SQL Script Library available to help get you started with some of the more common tasks.

Want to work with The Sero Group?

Want to learn more about how SERO Group helps organizations take the guesswork out of managing their SQL Servers? It’s easy and there is no obligation. 

Schedule a call with us to get started.

The post Want to Learn SQL Server? Here Are 3 Free Sources appeared first on The SERO Group.

What Is tempdb?

Let’s start with a very brief description of tempdb. When SQL Server needs some additional workspace to resolve a query, it uses a built-in system database called tempdb. A query may use tempdb for sorting operations, cursors, temporary tables, or even aggregation operations among other things. Since there is only one tempdb database for each SQL Server instance, it can be quite heavily used. 

By default, when you install SQL Server, one data file is created for the tempdb database. Having only one data file, however, can hinder SQL Server’s performance. The solitary file can become a bottleneck for queries that require tempdb. This is a pretty common issue, in fact, it made our Top 5 List. 

How Many tempdb Files Do You Need?

So, if the default value is likely not right for you, how many tempdb data files should you have? The answer is: it depends. According to Microsoft Support, the best approach is to create one tempdb data file per logical processor up to 8 data files.

If your system has more than 8 logical processors, start with 8 data files and monitor your server’s workload to determine if more data files would be beneficial. If you do find that an increase is warranted, add 4 data files at a time, but do not add more than the number of logical processors.

How Many tempdb Files Do You Have?

How many tempdb data files does your SQL Server have? A fairly straightforward query can answer the question. Open Management Studio and run the following query.

--tell me about my tempdb
SELECT
  f.name AS [file_name],
  CAST((f.size / 128.0) AS DECIMAL(15, 2)) AS [size_in_MB],
  CAST(f.size / 128.0 - CAST(FILEPROPERTY(f.name, 'SpaceUsed') AS INT) / 128.0 AS DECIMAL(15, 2)) AS [space_available_in_MB],
  [file_id] AS [file_id],
  ISNULL(fg.name, 'LOG') AS [filegroup_name],
  f.physical_name AS [physical_name]
FROM sys.master_files AS f
LEFT OUTER JOIN sys.data_spaces AS fg
  ON f.data_space_id = fg.data_space_id
WHERE f.database_id = 2;

You’ll notice that the results from the query above include the folder location for each tempdb file. That’s because file placement can also have a dramatic impact on performance and even reliability. But that’s another story.

For more information about tempdb, check out Microsoft’s SQL Docs. 

Want to know more about other configuration options that could affect performance and reliability? Check out Is My SQL Server Configured Properly?

[EDIT Oct 5, 2021] – Also see How to Configure SQL Server tempdb? for other tempdb configuration settings that can affect performance.

Want to work with The Sero Group?

Want to learn more about how SERO Group helps organizations take the guesswork out of managing their SQL Servers? It’s easy and there is no obligation.

Schedule a call with us to get started.

The post How Many tempdb Data Files Should My SQL Server Have? appeared first on The SERO Group.

Someone has started a database restore (or backup) using a T-SQL command. Now he wants to know how long the process will take to complete. He’s gone to the bathroom and even gotten a coffee, yet it’s still running. 

If he had used the WITH STATS option for either the BACKUP DATABASE or RESTORE DATABASE command, the percentage processed would have been piped to the Messages tab of Management Studio a little at a time. 10 percent processed. 20 percent processed. And so on as shown below.

BACKUP DATABASE wideworldimporters TO DISK = 'c:\temp\wwi.bak' WITH STATS;

SQL Server backup/restore information using DMVs

Still, that doesn’t provide an estimate of how long the process is likely to run. Fortunately, the Dynamic Management Views in SQL Server allow us to gather and report backup and restore estimates.

Here’s a script that I’ve found useful. It’s an amalgamation of a script I found on StackOverflow and my own handiwork. As always, this is for your reference only and no guarantees are implied.

SELECT SERVERPROPERTY('ServerName') AS [Instance],
   reqs.session_id,
   sess.login_name,
   reqs.command,
   CAST(reqs.percent_complete AS NUMERIC(10, 2)) AS [Percent Complete],
   CONVERT(VARCHAR(20), DATEADD(ms, reqs.estimated_completion_time, GETDATE()), 20) AS [Estimated Completion Time],
   CAST(reqs.total_elapsed_time / 60000.0 AS NUMERIC(10, 2)) AS [Elapsed Minutes],
   CAST(reqs.estimated_completion_time / 60000.0 AS NUMERIC(10, 2)) AS [Estimated Remaining Time in Minutes],
   CAST(reqs.estimated_completion_time / 3600000.0 AS NUMERIC(10, 2)) AS [Estimated Remaining Time in Hours],
   CAST((
     SELECT SUBSTRING(text, reqs.statement_start_offset/2,
                CASE
                WHEN reqs.statement_end_offset = -1
                THEN 1000
                ELSE(reqs.statement_end_offset-reqs.statement_start_offset)/2
                END)
     FROM sys.dm_exec_sql_text(sql_handle)) AS VARCHAR(1000)) AS [SQL]
FROM sys.dm_exec_requests AS reqs
 JOIN sys.dm_exec_sessions AS sess ON sess.session_id = reqs.session_id
WHERE command IN('RESTORE DATABASE', 'BACKUP DATABASE');

The script returns the following information:

• Instance Name
• Session Id 
• Login Name
• Command 
• Percent Complete
• Estimated Completion Time
• Elapsed Time in Minutes
• Estimated Remaining Time in Minutes
• Estimated Remaining Time in Hours
• The Complete Command Used to Start Backup/Restore
  

Since this script uses Dynamic Management Views, it won’t work on ancient versions of SQL Server. I’ve tested it on SQL Server 2008 R2 and forward on the Windows version. I haven’t tried it on SQL Server 2017 running on Linux. 

Hopefully, you’ll find this script handy. Here are a few more that you may find helpful.

• High Availability and Disaster Recovery in SQL Server
• How to Create SQL Server 2019 Failover Clustered Instances in Azure
• Vollgar: 6 Scripts to Help Review Your SQL Servers

Want to work with The Sero Group?

Want to learn more about how SERO Group helps organizations take the guesswork out of managing their SQL Servers? It’s easy and there is no obligation. 

Schedule a call with us to get started.

The post Script: How Long Until My SQL Server Backup/Restore Completes? appeared first on The SERO Group.