MS SQL Server 2016 Instance Security Technical Implementation Guide
- Version/Release: V3R2
- Published: 2024-09-09
- Released: 2024-10-24
-
Expand All:
- Severity:
-
Sort:
Compare
Select any two versions of this STIG to compare the individual requirements
View
Select any old version/release of this STIG to view the previous requirements
- RMF Control
- AC-10
- Severity
- Medium
- CCI
- CCI-000054
- Version
- SQL6-D0-003600
- Vuln IDs
-
- V-213929
- V-79119
- Rule IDs
-
- SV-213929r1018580_rule
- SV-93825
Checks: C-15146r1018578_chk
Review the system documentation to determine whether any concurrent session limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. Due to excessive CPU consumption when utilizing a logon trigger, an alternative method of limiting concurrent sessions is setting the max connection limit within SQL Server to an appropriate value. This serves to block a distributed denial-of-service (DDOS) attack by limiting the attacker's connections while allowing a database administrator to still force a SQL connection. In SQL Server Management Studio's Object Explorer tree: Right-click on the Server Name >> Select Properties >> Select Connections Tab OR Run the query: EXEC sys.sp_configure N'user connections' If the max connection limit is set to 0 (unlimited) or does not match the documented value, this is a finding. Otherwise, determine if a logon trigger exists: In SQL Server Management Studio's Object Explorer tree: Expand [SQL Server Instance] >> Server Objects >> Triggers OR Run the query: SELECT name FROM master.sys.server_triggers; If no triggers are listed, this is a finding. If triggers are listed, identify the trigger(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.
Fix: F-15144r1018579_fix
If a trigger consumes too much CPU, an example alternative method for limiting the concurrent users is setting the max connection limit on SQL Server. In SQL Server Management Studio's Object Explorer tree, right-click on the Server Name >> Select Properties >> Select Connections Tab >> Set the Maximum Number of Concurrent Connections to a value other than 0 (0 = unlimited), and document it. OR Run the query: EXEC sys.sp_configure N'user connections','5000' /* this is an example max limit */ GO RECONFIGURE WITH OVERRIDE GO Restart SQL Server for the setting to take effect. Reference: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-user-connections-server-configuration-option? Otherwise, establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users. Example script below: CREATE TRIGGER SQL_STIG_Connection_Limit ON ALL SERVER WITH EXECUTE AS 'renamed_sa' /*Make sure to use the renamed SA account here*/ FOR LOGON AS BEGIN If (Select COUNT(1) from sys.dm_exec_sessions WHERE is_user_process = 1 AND original_login_name = ORIGINAL_LOGIN() ) > (CASE ORIGINAL_LOGIN() WHEN 'domain/ima.dba' THEN 150 /*this is a busy DBA’s domain account */ WHEN 'application1_login' THEN 6 /* this is a SQL login for an application */ WHEN 'application2_login' THEN 20 /* this is a SQL login for another application */ … ELSE 1 /* All unspecified users are restricted to a single login */ END) BEGIN PRINT 'The login [' + ORIGINAL_LOGIN() + '] has exceeded its concurrent session limit.' ROLLBACK; END END; Reference: https://msdn.microsoft.com/en-us/library/ms189799.aspx
- RMF Control
- AC-2
- Severity
- High
- CCI
- CCI-000015
- Version
- SQL6-D0-003700
- Vuln IDs
-
- V-213930
- V-79121
- Rule IDs
-
- SV-213930r1018583_rule
- SV-93827
Checks: C-15147r1018581_chk
Determine whether SQL Server is configured to use only Windows authentication. In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance. Select "Properties". Select the Security page. If Windows Authentication Mode is selected, this is not a finding. OR In a query interface such as the SSMS Transact-SQL editor, run the statement: SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'Windows and SQL Server Authentication' END as [Authentication Mode] If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding. Mixed mode (both SQL Server authentication and Windows authentication) is in use. If the need for mixed mode has not been documented and approved by the information system security officer (ISSO)/information system security manager (ISSM), this is a finding. From the documentation, obtain the list of accounts authorized to be managed by SQL Server. Determine the accounts (SQL Logins) actually managed by SQL Server. Run the statement: SELECT name FROM sys.sql_logins WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0; If any accounts listed by the query are not listed in the documentation, this is a finding.
Fix: F-15145r1018582_fix
If mixed mode is required, document the need and justification; describe the measures taken to ensure the use of SQL Server authentication is kept to a minimum; describe the measures taken to safeguard passwords; and list or describe the SQL Logins used. Documentation must be approved by the ISSO/ISSM. If mixed mode is not required, disable it as follows: In the SSMS Object Explorer, right-click on the server instance. Select "Properties". Select the Security page. Click on the radio button for "Windows Authentication Mode". Click on "OK". Restart the SQL Server instance. OR Run the statement: USE [master] EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2 GO Restart the SQL Server instance. For each account being managed by SQL Server but not requiring it, drop or disable the SQL Login. Replace it with an appropriately configured account, as needed. To drop or disable a login in the SSMS Object Explorer: Navigate to "Security Logins". Right-click on the login name and click "Delete" or "Disable". To drop or disable a login by using a query: USE master; DROP LOGIN login_name; ALTER LOGIN login_name DISABLE; Dropping a login does not delete the equivalent database user(s). There may be more than one database containing a user mapped to the login. Drop the user(s) unless still needed. To drop a user in the SSMS Object Explorer: Navigate to Databases >> Security Users. Right-click on the user name. Click "Delete". To drop a user via a query: USE database_name; DROP USER <user_name>;
- RMF Control
- AC-2
- Severity
- Medium
- CCI
- CCI-000015
- Version
- SQL6-D0-003800
- Vuln IDs
-
- V-213931
- V-79123
- Rule IDs
-
- SV-213931r960768_rule
- SV-93829
Checks: C-15148r754572_chk
If the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. Obtain the fully qualified domain name of the SQL Server instance: Launch Windows Explorer. Right-click on "Computer" or "This PC" (Varies by OS level), click "Properties". Note the value shown for "Full computer name". *** Note: For a cluster, this value must be obtained from the Failover Cluster Manager. *** Obtain the TCP port that is supporting the SQL Server instance: Click Start >> Type "SQL Server 2016 Configuration Manager" >> From the search results, click "SQL Server 2016 Configuration Manager". From the tree on the left, expand "SQL Server Network Configuration". Click "Protocols for <Instance Name>" where <Instance Name> is the name of the instance (MSSQLSERVER is the default name). In the right pane, right-click on "TCP/IP" and choose "Properties". In the window that opens, click the "IP Addresses" tab. Note the TCP port configured for the instance. Obtain the service account that is running the SQL Server service: Click "Start". Type "SQL Server 2016 Configuration Manager". From the search results, click "SQL Server 2016 Configuration Manager". From the tree on the left, select "SQL Server Services". Note the account listed in the "Log On As" column for the SQL Server instance being reviewed. Launch a command-line or PowerShell window. Enter the following command where <Service Account> is the identity of the service account. setspn -L <Service Account> Example: setspn -L CONTOSO\sql2016svc Review the Registered Service Principal Names returned. If the listing does not contain the following supported service principal names (SPN) formats, this is a finding. Named instance MSSQLSvc/<FQDN>:[<port> | <instancename>], where: MSSQLSvc is the service that is being registered. <FQDN> is the fully qualified domain name of the server. <port> is the TCP port number. <instancename> is the name of the SQL Server instance. Default instance MSSQLSvc/<FQDN>:<port> | MSSQLSvc/<FQDN>, where: MSSQLSvc is the service that is being registered. <FQDN> is the fully qualified domain name of the server. <port> is the TCP port number. If the MSSQLSvc service is registered for any fully qualified domain names that do not match the current server, this may indicate the service account is shared across SQL Server instances. Review server documentation, if the sharing of service accounts across instances is not documented and authorized, this is a finding.
Fix: F-15146r810824_fix
Ensure Service Principal Names (SPNs) are properly registered for the SQL Server instance. Utilize the Microsoft Kerberos Configuration Manager to review Kerberos configuration issues for a given SQL Server instance. https://www.microsoft.com/en-us/download/details.aspx?id=39046 Alternatively, SPNs for SQL Server can be manually registered. For other connections that support Kerberos the SPN is registered in the format MSSQLSvc/<FQDN>/<instancename> for a named instance. The format for registering the default instance is MSSQLSvc/<FQDN>. Using an account with permissions to register SPNs, issue the following commands from a command-prompt: setspn -S MSSQLSvc/<Fully Qualified Domain Name> <Service Account> setspn -S MSSQLSvc/<Fully Qualified Domain Name>:<TCP Port> <Service Account> For a named instance, use: setspn -S MSSQLSvc/<FQDN>:<instancename> <Service Account> setspn -S MSSQLSvc/<FQDN>:<TCP Port> <Service Account> Restart the SQL Server instance. More information regarding this process is available at: https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections#Manual
- RMF Control
- AC-3
- Severity
- High
- CCI
- CCI-000213
- Version
- SQL6-D0-003900
- Vuln IDs
-
- V-213932
- V-79125
- Rule IDs
-
- SV-213932r960792_rule
- SV-93831
Checks: C-15149r313579_chk
Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. Review the permissions actually in place on the server. If the actual permissions do not match the documented requirements, this is a finding. Use the supplemental file "Instance permissions assignments to logins and roles.sql."
Fix: F-15147r313580_fix
Use GRANT, REVOKE, DENY, ALTER SERVER ROLE … ADD MEMBER … and/or ALTER SERVER ROLE …. DROP MEMBER statements to add and remove permissions on server-level securables, bringing them into line with the documented requirements.
- RMF Control
- AU-10
- Severity
- Medium
- CCI
- CCI-000166
- Version
- SQL6-D0-004000
- Vuln IDs
-
- V-213933
- V-79127
- Rule IDs
-
- SV-213933r960864_rule
- SV-93833
Checks: C-15150r313582_chk
Obtain the list of authorized SQL Server accounts in the system documentation. Determine if any accounts are shared. A shared account is defined as a username and password that are used by multiple individuals to log into SQL Server. An example of a shared account is the SQL Server installation account. Windows Groups are not shared accounts as the group itself does not have a password. If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. The key is individual accountability. If this can be traced, this is not a finding. If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.
Fix: F-15148r313583_fix
Remove user-accessible shared accounts and use individual user IDs. Build/configure applications to ensure successful individual authentication prior to shared account access. Ensure each user's identity is received and used in audit data in all relevant circumstances. Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.
- RMF Control
- AU-10
- Severity
- Medium
- CCI
- CCI-000166
- Version
- SQL6-D0-004100
- Vuln IDs
-
- V-213934
- V-79129
- Rule IDs
-
- SV-213934r960864_rule
- SV-93835
Checks: C-15151r313585_chk
Execute the following queries. The first query checks for Clustering and Availability Groups being provisioned in the Database Engine. The second query lists permissions granted to the Local System account. SELECT SERVERPROPERTY('IsClustered') AS [IsClustered], SERVERPROPERTY('IsHadrEnabled') AS [IsHadrEnabled] EXECUTE AS LOGIN = 'NT AUTHORITY\SYSTEM' SELECT * FROM fn_my_permissions(NULL, 'server') REVERT GO If IsClustered returns 1, IsHadrEnabled returns 0, and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding. If IsHadrEnabled returns 1 and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding. If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.
Fix: F-15149r313586_fix
Remove permissions that were identified as not allowed in the check content. USE Master; REVOKE <Permission> TO [NT AUTHORITY\SYSTEM] GO To grant permissions to services or applications, utilize the Service SID of the service or a domain service account.
- RMF Control
- AU-10
- Severity
- Medium
- CCI
- CCI-000166
- Version
- SQL6-D0-004200
- Vuln IDs
-
- V-213935
- V-79131
- Rule IDs
-
- SV-213935r960864_rule
- SV-93837
Checks: C-15152r313588_chk
Execute the following query: SELECT name FROM sys.server_principals WHERE type in ('U','G') AND name LIKE '%$' If no logins are returned, this is not a finding. If logins are returned, determine whether each login is a computer account. Launch PowerShell. Execute the following code: Note: <name> represents the username portion of the login. For example, if the login is "CONTOSO\user1$", the username is "user1". ([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll() If no account information is returned, this is not a finding. If account information is returned, this is a finding.
Fix: F-15150r313589_fix
Remove all logins that were returned in the check content.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000169
- Version
- SQL6-D0-004300
- Vuln IDs
-
- V-213936
- V-79133
- Rule IDs
-
- SV-213936r960879_rule
- SV-93839
Checks: C-15153r313591_chk
Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. Execute the following query to get all of the installed audits: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. To view the actions being audited by the audits, execute the following query: SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 Compare the documentation to the list of generated audit events. If there are any missing events, this is a finding.
Fix: F-15151r313592_fix
Add all required audit events to the STIG Compliant audit specification server documentation.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000171
- Version
- SQL6-D0-004400
- Vuln IDs
-
- V-213937
- V-79135
- Rule IDs
-
- SV-213937r960882_rule
- SV-93841
Checks: C-15154r313594_chk
Obtain the list of approved audit maintainers from the system documentation. Review the server roles and individual logins that have the following role memberships, all of which enable the ability to create and maintain audit definitions. sysadmin dbcreator Review the server roles and individual logins that have the following permissions, all of which enable the ability to create and maintain audit definitions. ALTER ANY SERVER AUDIT CONTROL SERVER ALTER ANY DATABASE CREATE ANY DATABASE Use the following query to determine the roles and logins that have the listed permissions: SELECT-- DISTINCT CASE WHEN SP.class_desc IS NOT NULL THEN CASE WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' ELSE SP.class_desc END WHEN E.name IS NOT NULL THEN 'ENDPOINT' WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' ELSE '???' END AS [Securable Class], CASE WHEN E.name IS NOT NULL THEN E.name WHEN S.name IS NOT NULL THEN S.name WHEN P.name IS NOT NULL THEN P.name ELSE '???' END AS [Securable], P1.name AS [Grantee], P1.type_desc AS [Grantee Type], sp.permission_name AS [Permission], sp.state_desc AS [State], P2.name AS [Grantor], P2.type_desc AS [Grantor Type], R.name AS [Role Name] FROM sys.server_permissions SP INNER JOIN sys.server_principals P1 ON P1.principal_id = SP.grantee_principal_id INNER JOIN sys.server_principals P2 ON P2.principal_id = SP.grantor_principal_id FULL OUTER JOIN sys.servers S ON SP.class_desc = 'SERVER' AND S.server_id = SP.major_id FULL OUTER JOIN sys.endpoints E ON SP.class_desc = 'ENDPOINT' AND E.endpoint_id = SP.major_id FULL OUTER JOIN sys.server_principals P ON SP.class_desc = 'SERVER_PRINCIPAL' AND P.principal_id = SP.major_id FULL OUTER JOIN sys.server_role_members SRM ON P.principal_id = SRM.member_principal_id LEFT OUTER JOIN sys.server_principals R ON SRM.role_principal_id = R.principal_id WHERE sp.permission_name IN ('ALTER ANY SERVER AUDIT','CONTROL SERVER','ALTER ANY DATABASE','CREATE ANY DATABASE') OR R.name IN ('sysadmin','dbcreator') If any of the logins, roles, or role memberships returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding.
Fix: F-15152r313595_fix
Create a server role specifically for audit maintainers and give it permission to maintain audits without granting it unnecessary permissions (the role name used here is an example; other names may be used): CREATE SERVER ROLE SERVER_AUDIT_MAINTAINERS; GO GRANT ALTER ANY SERVER AUDIT TO SERVER_AUDIT_MAINTAINERS; GO Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove the ALTER ANY SERVER AUDIT permission from all logins. Then, for each authorized login, run the statement: ALTER SERVER ROLE SERVER_AUDIT_MAINTAINERS ADD MEMBER; GO Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove CONTROL SERVER, ALTER ANY DATABASE and CREATE ANY DATABASE permissions from logins that do not need them.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-004600
- Vuln IDs
-
- V-213939
- V-79139
- Rule IDs
-
- SV-213939r960885_rule
- SV-93845
Checks: C-15156r313600_chk
Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.
Fix: F-15154r313601_fix
Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".
- RMF Control
- AU-14
- Severity
- Medium
- CCI
- CCI-001464
- Version
- SQL6-D0-004700
- Vuln IDs
-
- V-213940
- V-79141
- Rule IDs
-
- SV-213940r960888_rule
- SV-93847
Checks: C-15157r313603_chk
When Audits are enabled, they start up when the instance starts. https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 Check if an audit is configured and enabled. Execute the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED' All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.
Fix: F-15155r313604_fix
Configure the SQL Audit(s) to automatically start during system start-up. ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON Execute the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED' Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.
- RMF Control
- AU-3
- Severity
- Medium
- CCI
- CCI-000135
- Version
- SQL6-D0-005500
- Vuln IDs
-
- V-213941
- V-79145
- Rule IDs
-
- SV-213941r960909_rule
- SV-93851
Checks: C-15158r313606_chk
If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. Review system documentation to determine whether SQL Server is required to audit any events, and any fields, in addition to those in the standard audit. If there are none specified, this is not a finding. If SQL Server Audit is in use, compare the audit specification(s) with the documented requirements. If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding.
Fix: F-15156r313607_fix
Design and deploy an Audit that captures all auditable events and data items. In the event a third-party tool is used for auditing it must contain all the required information including but not limited to events, type, location, subject, date and time and by whom the change occurred. Implement additional custom audits to capture the additional organizational required information.
- RMF Control
- AU-5
- Severity
- Medium
- CCI
- CCI-000140
- Version
- SQL6-D0-005600
- Vuln IDs
-
- V-213942
- V-79147
- Rule IDs
-
- SV-213942r960915_rule
- SV-93853
Checks: C-15159r313609_chk
If the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA). If SQL Server Audit is in use, review the defined server audits by running the statement: SELECT * FROM sys.server_audits; By observing the [name] and [is_state_enabled] columns, identify the row or rows in use. If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.
Fix: F-15157r313610_fix
If SQL Server Audit is in use, configure SQL Server Audit to shut SQL Server down upon audit failure, to include running out of space for audit logs. Run this T-SQL script for each identified audit: ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = OFF); GO ALTER SERVER AUDIT [AuditNameHere] WITH (ON_FAILURE = SHUTDOWN); GO ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = ON); GO
- RMF Control
- AU-5
- Severity
- Medium
- CCI
- CCI-000140
- Version
- SQL6-D0-005700
- Vuln IDs
-
- V-213943
- V-79149
- Rule IDs
-
- SV-213943r960915_rule
- SV-93855
Checks: C-15160r754586_chk
If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). Execute the following query: SELECT a.name 'audit_name', a.type_desc 'storage_type', f.max_rollover_files FROM sys.server_audits a LEFT JOIN sys.server_file_audits f ON a.audit_id = f.audit_id WHERE a.is_state_enabled = 1 If no records are returned, this is a finding. If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG", this is not a finding. If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding.
Fix: F-15158r313613_fix
If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure. Run this T-SQL script for each identified audit: ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF); GO ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue); GO ALTER SERVER AUDIT [AuditName] WITH (STATE = ON); GO
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000162
- Version
- SQL6-D0-005900
- Vuln IDs
-
- V-213944
- V-79151
- Rule IDs
-
- SV-213944r960930_rule
- SV-93857
Checks: C-15161r754588_chk
If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is N/A. Obtain the SQL Server audit file location(s) by running the following SQL script: SELECT log_file_path AS "Audit Path" FROM sys.server_file_audits For each audit, the path column will give the location of the file. Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: Administrator (read) Users (none) Audit Administrator (Full Control) Auditors group (Read) SQL Server Service SID OR Service Account (Full Control) SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.
Fix: F-15159r754589_fix
Modify audit file permissions to meet the requirement to protect against unauthorized access. Application event log and security log permissions are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use. Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click the file and click "Properties". On the Security tab, modify the security permissions to: Administrator (read) Users (none) Audit Administrator(Full Control) Auditors group (Read) SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] ----- Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.130).aspx. Note 2: Tips for adding a service SID/virtual account to a folder's permission list. 1) In Windows Explorer, right-click the folder and select "Properties". 2) Select the "Security" tab. 3) Click "Edit". 4) Click "Add". 5) Click "Locations". 6) Select the computer name. 7) Search for the name. 7.a) SQL Server Service 7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) 7.a.ii) Select the "MSSQL$" user and click "OK". 7.b) SQL Agent Service 7.b.i) Type "NT SERVICE\SQL" and click "Check Names". 7.b.ii) Select the "SQLAgent$" user and click "OK". 8) Click "OK". 9) Permission like a normal user from here.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-001494
- Version
- SQL6-D0-006300
- Vuln IDs
-
- V-213948
- V-79159
- Rule IDs
-
- SV-213948r960942_rule
- SV-93865
Checks: C-15165r902985_chk
Check the server documentation for a list of approved users with access to SQL Server Audits. To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER: SELECT login.name, perm.permission_name, perm.state_desc FROM sys.server_permissions perm JOIN sys.server_principals login ON perm.grantee_principal_id = login.principal_id WHERE permission_name in ('ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT', 'CONTROL SERVER') and login.name not like '##MS_%'; If unauthorized accounts have these privileges, this is a finding.
Fix: F-15163r313628_fix
Remove audit-related permissions from individuals and roles not authorized to have them. USE master; DENY [ALTER ANY SERVER AUDIT] TO [User]; GO
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- SQL6-D0-006500
- Vuln IDs
-
- V-213950
- V-79163
- Rule IDs
-
- SV-213950r960960_rule
- SV-93869
Checks: C-15167r313633_chk
Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk. If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding. To determine the location for these instance-specific binaries, Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property. Navigate to the folder above, and review the "Binn" subdirectory.
Fix: F-15165r313634_fix
Change the ownership of all shared software libraries on disk to the authorized account. Remove any modify permissions granted to unauthorized users or groups.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- SQL6-D0-006600
- Vuln IDs
-
- V-213951
- V-79165
- Rule IDs
-
- SV-213951r960960_rule
- SV-93871
Checks: C-15168r313636_chk
Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum. If alerts do not at least hash their value, this is a finding. To determine the location for these instance-specific binaries: Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.
Fix: F-15166r313637_fix
Implement and document a process by which changes made to software libraries are monitored and alerted. A PowerShell based hashing solution is one such process. The Get-FileHash command (https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash) can be used to compute the SHA-2 hash of one or more files. Using the Export-Clixml command (https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Export-Clixml), a baseline can be established and exported to a file. Using the Compare-Object command (https://technet.microsoft.com/en-us/library/ee156812.aspx), a comparison of the latest baseline versus the original baseline can be used to expose the differences.
- RMF Control
- CM-5
- Severity
- High
- CCI
- CCI-001499
- Version
- SQL6-D0-006700
- Vuln IDs
-
- V-213952
- V-79167
- Rule IDs
-
- SV-213952r960960_rule
- SV-93873
Checks: C-15169r822455_chk
From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. sl "C:\program files\microsoft sql server\130\setup bootstrap\Log" Get-ChildItem -Recurse | Select-String -Pattern "LogonUser = " If any accounts are shown that are not authorized in the system documentation, this is a finding.
Fix: F-15167r822456_fix
From a command prompt, open lusrmgr.msc. Navigate to Users and right-click Individual User. Select Properties >> Member Of. Configure SQL Server and OS settings and access controls to restrict user access to objects and data that the user is authorized to view/use.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- SQL6-D0-006800
- Vuln IDs
-
- V-213953
- V-79169
- Rule IDs
-
- SV-213953r960960_rule
- SV-93875
Checks: C-15170r313642_chk
Determine the directory in which SQL Server has been installed: Using SQL Server Management Studio's Object Explorer: - Right-click [SQL Server Instance] - Select "Facets" - Record the value of RootDirectory Determine the Operating System directory: - Click "Start" - Type "Run" - Press "Enter" - Type "%windir%" - Click "Ok" - Record the value in the address bar Verify the SQL Server RootDirectory is not in the Operating System directory. Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding. Verify the SQL Server RootDirectory is not in another application's directory. Navigate to the SQL RootDirectory using Windows Explorer. Examine each directory for evidence another application is stored in it. If evidence exists the SQL RootDirectory is in another application's directory, this is a finding. If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding. Examples: 1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding. 2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding. 3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.
Fix: F-15168r313643_fix
Re-install SQL Server application components using dedicated directories that are separate from the operating system. Relocate or reinstall other application software that currently shares directories with SQL Server components. Separate from the operating system and/or temporary storage.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-006900
- Vuln IDs
-
- V-213954
- V-79171
- Rule IDs
-
- SV-213954r960963_rule
- SV-93877
Checks: C-15171r313645_chk
Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. If this system is identified as production, gather a listing of databases from the server and look for any matching the following general demonstration database names: pubs Northwind AdventureWorks WorldwideImporters If any of these databases exist, this is a finding.
Fix: F-15169r313646_fix
Remove all demonstration or sample databases from production instances.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-007000
- Vuln IDs
-
- V-213955
- V-79173
- Rule IDs
-
- SV-213955r960963_rule
- SV-93879
Checks: C-15172r313648_chk
From the server documentation, obtain a listing of required components. Generate a listing of components installed on the server. Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.
Fix: F-15170r313649_fix
Remove all features that are not required.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-007100
- Vuln IDs
-
- V-213956
- V-79175
- Rule IDs
-
- SV-213956r960963_rule
- SV-93881
Checks: C-15173r313651_chk
From the server documentation, obtain a listing of required components. Generate a listing of components installed on the server. Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" Compare the feature listing against the required components listing. Note any components that are installed, but not required. Launch SQL Server Configuration Manager. If any components that are installed but are not required are not disabled, this is a finding. If any required components are not installed, this is a finding.
Fix: F-15171r313652_fix
Disable any unused components or features that cannot be uninstalled.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-007200
- Vuln IDs
-
- V-213957
- V-79177
- Rule IDs
-
- SV-213957r960963_rule
- SV-93883
Checks: C-15174r313654_chk
The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. To determine if xp_cmdshell is enabled, execute the following commands: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'xp_cmdshell'; If the value of "config_value" is "0", this is not a finding. Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.
Fix: F-15172r313655_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of xp_cmdshell, from the query prompt: EXEC sp_configure 'show advanced options', 1; GO RECONFIGURE; GO EXEC sp_configure 'xp_cmdshell', 0; GO RECONFIGURE; GO??
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-007300
- Vuln IDs
-
- V-213958
- V-79179
- Rule IDs
-
- SV-213958r960963_rule
- SV-93885
Checks: C-15175r313657_chk
The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. To determine if CLR is enabled, execute the following commands: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'clr enabled'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. If CLR code is approved, check the database for UNSAFE assembly permission using the following script: USE [master] SELECT * FROM sys.assemblies WHERE permission_set_desc != 'SAFE' AND is_user_defined = 1; If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.
Fix: F-15173r313658_fix
Disable use of or remove any CLR code that is not authorized. To disable the use of CLR, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'clr enabled', 0; GO RECONFIGURE; GO For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-007400
- Vuln IDs
-
- V-213959
- V-79181
- Rule IDs
-
- SV-213959r960963_rule
- SV-93887
Checks: C-15176r313660_chk
Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible. To determine if non-standard extended stored procedures exist, run the following: ------------------------------------------------------------------------ USE [master] GO DECLARE @xplist AS TABLE ( xp_name sysname, source_dll nvarchar(255) ) INSERT INTO @xplist EXEC sp_helpextendedproc SELECT X.xp_name, X.source_dll, O.is_ms_shipped FROM @xplist X JOIN sys.all_objects O ON X.xp_name = O.name WHERE O.is_ms_shipped = 0 ORDER BY X.xp_name ------------------------------------------------------------------------ If any records are returned, review the system documentation to determine whether the use of Non-Standard extended stored procedures are required and approved. If it is not approved, this is a finding.
Fix: F-15174r313661_fix
Remove any Non-Standard extended stored procedures that are not documented and approved. sp_dropextendedproc 'proc name'
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-007500
- Vuln IDs
-
- V-213960
- V-79183
- Rule IDs
-
- SV-213960r1018585_rule
- SV-93889
Checks: C-15177r1018584_chk
A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. To obtain a list of linked servers, execute the following command: SELECT name FROM sys.servers s WHERE s.is_linked = 1 Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding. Run the following to get a linked server login mapping: SELECT s.name, p.principal_id, l.remote_name FROM sys.servers s JOIN sys.linked_logins l ON s.server_id = l.server_id LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id WHERE s.is_linked = 1 Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.
Fix: F-15175r313664_fix
Disable use of or remove any linked servers that are not authorized. To remove a linked server and all associated logins run the following: sp_dropserver 'LinkedServerName', 'droplogins'; To remove a login from a linked server run the following: EXEC sp_droplinkedsrvlogin 'LoginName', NULL;
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000382
- Version
- SQL6-D0-007600
- Vuln IDs
-
- V-213961
- V-79185
- Rule IDs
-
- SV-213961r960966_rule
- SV-93891
Checks: C-15178r313666_chk
To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance. If Named Pipes is enabled and not specifically required and authorized, this is a finding. If any listed protocol is enabled but not authorized, this is a finding.
Fix: F-15176r313667_fix
In SQL Server Configuration Manager >> SQL Server Network Configuration >> Protocols, right-click on each listed protocol that is enabled but not authorized and Select "Disable".
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000382
- Version
- SQL6-D0-007700
- Vuln IDs
-
- V-213962
- V-79187
- Rule IDs
-
- SV-213962r960966_rule
- SV-93893
Checks: C-15179r313669_chk
Review SQL Server Configuration for the ports used by SQL Server. To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.) If these are in conflict with PPSM guidance, and not explained and approved in the system documentation, this is a finding.
Fix: F-15177r313670_fix
Use SQL Server Configuration to change the ports used by SQL Server to comply with PPSM guidance, or document the need for other ports, and obtain written approval. Close ports no longer needed.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000764
- Version
- SQL6-D0-007800
- Vuln IDs
-
- V-213963
- V-79189
- Rule IDs
-
- SV-213963r960969_rule
- SV-93895
Checks: C-15180r313672_chk
Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.) If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.
Fix: F-15178r313673_fix
Remove user-accessible shared accounts and use individual userIDs. Configure applications to ensure successful individual authentication prior to shared account access. Ensure each user's identity is received and used in audit data in all relevant circumstances.
- RMF Control
- Severity
- High
- CCI
- CCI-004066
- Version
- SQL6-D0-007900
- Vuln IDs
-
- V-213964
- V-79191
- Rule IDs
-
- SV-213964r1018609_rule
- SV-93897
Checks: C-15181r951660_chk
Check for use of SQL Server Authentication: SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode] If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding. If the returned value in the "Authentication Mode" column is "SQL Server Authentication", SQL Server should be configured to inherit password complexity and password lifetime rules from the operating system. Review SQL Server to ensure logons are created with respect to the complexity settings and password lifetime rules by running the statement: SELECT [name], is_expiration_checked, is_policy_checked FROM sys.sql_logins Review any accounts returned by the query other than the disabled SA account, ##MS_PolicyTsqlExecutionLogin##, and ##MS_PolicyEventProcessingLogin##. If any account does not have both "is_expiration_checked" and "is_policy_checked" equal to “1”, this is a finding. Review the operating system settings relating to password complexity. To check the server operating system for password complexity: Navigate to Start >> All Programs >> Administrative Tools >> Local Security Policy, and to review the local policies on the machine, go to Account Policy >> Password Policy. Ensure the DISA Windows Password Policy is set on the SQL Server member server. If any are not, this is a finding.
Fix: F-15179r1018586_fix
Configure the SQL Server operating system and SQL Server logins for compliance. Review the Operating System settings relating to password complexity. Ensure SQL Server is configured to inherit password complexity rules from the operating system for SQL logins. Ensure check of policy and expiration are enforced when SQL logins are created. CREATE LOGIN <login_name> WITH PASSWORD= <enterStrongPasswordHere>, CHECK_EXPIRATION = ON, CHECK_POLICY = ON;
- RMF Control
- Severity
- Medium
- CCI
- CCI-004066
- Version
- SQL6-D0-008000
- Vuln IDs
-
- V-213965
- V-79193
- Rule IDs
-
- SV-213965r1018610_rule
- SV-93899
Checks: C-15182r998247_chk
Execute the following query to determine if contained databases are used: SELECT * FROM sys.databases WHERE containment = 1 If any records are returned. Check the server documentation for a list of authorized contained database users. Ensure contained database users are not using SQL Authentication. EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, * FROM sys.database_principals WHERE authentication_type = 2' If any records are returned, this is a finding.
Fix: F-15180r313679_fix
Configure the SQL Server contained databases to have users originating from Windows principals. Remove any users not created from Windows principals.
- RMF Control
- IA-5
- Severity
- High
- CCI
- CCI-000197
- Version
- SQL6-D0-008200
- Vuln IDs
-
- V-213966
- V-79195
- Rule IDs
-
- SV-213966r1018589_rule
- SV-93901
Checks: C-15183r1018588_chk
If you are using "Windows Authentication mode" this requirement can be marked as Not Applicable. From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "Enter". Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on "Protocols", where there is a placeholder for the SQL Server instance name, and click on “Properties”. On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding. On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. If it is not a DOD approved certificate, or if no certificate is listed, this is a finding. For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager. 1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "Enter". 2. In the left side of the window, expand the "Personal" folder, and click "Certificates". 3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint. 4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate". 5. Run this on each node of the cluster. If any nodes have a certificate in use by SQL that is not issued or approved by DOD, this is a finding.
Fix: F-15181r313682_fix
Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography. Deploy encryption to the SQL Server Network Connections. From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service. For clustered instances install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manger. 1. Navigate to the certificate store where the FQDN certificate is stored, by typing "certlm.msc" and pressing "ENTER". 2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window. 3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad. 4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate 5. If the SQL virtual server is currently on this node, failover to another node in your cluster, and then reboot the node where the registry change occurred. 6. Repeat this procedure on all the nodes.
- RMF Control
- IA-5
- Severity
- High
- CCI
- CCI-000197
- Version
- SQL6-D0-008300
- Vuln IDs
-
- V-213967
- V-97521
- Rule IDs
-
- SV-213967r961029_rule
- SV-106625
Checks: C-15184r822460_chk
Access the SQL Server. Access an administrator command prompt. Type "regedit" to launch the Registry Editor. Navigate to: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 If this key does not exist, this is a finding. Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. Navigate to: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys. If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3.
Fix: F-15182r822461_fix
Important Note: Incorrectly modifying the Windows Registry can result in serious system errors. Before making any modifications, ensure you have a recent backup of the system and registry settings. Access the SQL Server. Access an administrator command prompt. Type "regedit" to launch the Registry Editor. Enable TLS 1.2: 1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols. a.If the "TLS 1.2" key does not exist, right-click "Protocols". b.Click "New". c.Click "Key". d.Type the name "TLS 1.2". 2.Navigate to the "TLS 1.2" subkey. a.If the subkey "Client" does not exist, right-click "TLS 1.2" b.Click "New". c.Click "Key". d.Type the name "Client". e.Repeat steps A – D for the "Server" subkey. 3.Navigate to the "Client" subkey. a.If the value "Enabled" does not exist, right-click on "Client". b.Click "New". c.Click "DWORD". d.Enter "Enabled" as the name. e.Repeat steps A-D for the value "DisabledByDefault". 4.Double-click "Enabled". 5.In Value Data, enter "1". 6.Click "OK". 7.Double-click "DisabledByDefault". 8.In Value Data, enter "0". 9.Click "OK". 10.Repeat steps 3 – 9 for the "Server" subkey. Disable unwanted SSL/TLS protocol versions: 1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols. a.If the "TLS 1.0" key does not exist, right-click "Protocols". b.Click "New". c.Click "Key". d.Type the name "TLS 1.0". 2.Navigate to the "TLS 1.0" subkey. a.If the subkey "Client" does not exist, right-click "TLS 1.0". b.Click "New". c.Click "Key". d.Type the name "Client". e.Repeat steps A – D for the "Server" subkey. 3.Navigate to the "Client" subkey. a.If the value "Enabled" does not exist, right-click on "Client". b.Click "New". c.Click "DWORD". d.Enter "Enabled" as the name. e.Repeat steps A-D for the value "DisabledByDefault". 4.Double-click "Enabled". 5.In Value Data, enter "0". 6.Click "OK". 7.Double-click "DisabledByDefault". 8.In Value Data, enter "1". 9.Click "OK". 10.Repeat steps 3 – 9 for the "Server" subkey. 11.Repeat steps 1 – 10 for "TLS 1.1", "SSL 2.0", and "SSL 3.0".
- RMF Control
- IA-5
- Severity
- High
- CCI
- CCI-000186
- Version
- SQL6-D0-008400
- Vuln IDs
-
- V-213968
- V-79197
- Rule IDs
-
- SV-213968r961041_rule
- SV-93903
Checks: C-15185r863335_chk
Review system configuration to determine whether FIPS compliant support has been enabled. Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options Ensure that "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is enabled. If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. For more information, see https://support.microsoft.com/en-us/kb/3141890.
Fix: F-15183r863336_fix
Enable use of FIPS-compliant algorithms. Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options Double-click "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing." Click Enabled >> Apply.
- RMF Control
- IA-7
- Severity
- High
- CCI
- CCI-000803
- Version
- SQL6-D0-008700
- Vuln IDs
-
- V-213969
- V-79199
- Rule IDs
-
- SV-213969r961050_rule
- SV-93905
Checks: C-15186r822463_chk
In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing". If, in the "Security Setting" column, the value is "Disabled," this is a finding. https://support.microsoft.com/en-us/kb/955720
Fix: F-15184r822464_fix
In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing". In the dialog box that appears, if the radio buttons are active, click "Enabled", and then click "Apply". If the radio buttons are grayed out, use Group Policy Management (on the appropriate server for this domain) to enforce the Enabled policy, and deploy it to the server(s) running SQL Server.
- RMF Control
- IA-8
- Severity
- Medium
- CCI
- CCI-000804
- Version
- SQL6-D0-008800
- Vuln IDs
-
- V-213970
- V-79201
- Rule IDs
-
- SV-213970r961053_rule
- SV-93907
Checks: C-15187r313693_chk
Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable: SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U') If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding. If non-organizational users are not uniquely identified and authenticated, this is a finding.
Fix: F-15185r313694_fix
Ensure all logins are uniquely identifiable and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.
- RMF Control
- SC-23
- Severity
- Medium
- CCI
- CCI-001188
- Version
- SQL6-D0-009200
- Vuln IDs
-
- V-213971
- V-79203
- Rule IDs
-
- SV-213971r961119_rule
- SV-93909
Checks: C-15188r313696_chk
Verify that Windows is configured to require the use of FIPS compliant algorithms. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." If the Security Setting for this option is "Disabled", this is a finding.
Fix: F-15186r313697_fix
Configure Windows to require the use of FIPS compliant algorithms. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart Windows
- RMF Control
- SC-28
- Severity
- High
- CCI
- CCI-001199
- Version
- SQL6-D0-009500
- Vuln IDs
-
- V-213972
- V-79205
- Rule IDs
-
- SV-213972r961128_rule
- SV-93911
Checks: C-15189r313699_chk
Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. If the application owner and Authorizing Official have determined that encryption of data at rest is required, ensure the data on secondary devices is encrypted. If full-disk encryption is being used, this is not a finding. If data encryption is required, ensure the data is encrypted before being put on the secondary device by executing: SELECT d.name AS [Database Name], CASE e.encryption_state WHEN 0 THEN 'No database encryption key present, no encryption' WHEN 1 THEN 'Unencrypted' WHEN 2 THEN 'Encryption in progress' WHEN 3 THEN 'Encrypted' WHEN 4 THEN 'Key change in progress' WHEN 5 THEN 'Decryption in progress' WHEN 6 THEN 'Protection change in progress' END AS [Encryption State] FROM sys.dm_database_encryption_keys e RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name WHERE d.name NOT IN ('master','model','msdb') ORDER BY [Database Name] ; For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding.
Fix: F-15187r313700_fix
Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption. To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on. Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).
- RMF Control
- SC-28
- Severity
- Medium
- CCI
- CCI-001199
- Version
- SQL6-D0-009600
- Vuln IDs
-
- V-213973
- V-79207
- Rule IDs
-
- SV-213973r961128_rule
- SV-93913
Checks: C-15190r952220_chk
Review procedures for and evidence of backup of the Server Service Master Key in the System Security Plan. If the procedures or evidence does not exist, this is a finding. If the procedures do not indicate that a backup of the Service Master Key is stored in a secure location that is not on the SQL Server, this is a finding. If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.
Fix: F-15188r951664_fix
Document and implement procedures to safely back up and store the Service Master Key in a secure location that is not on the SQL Server. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key. BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file' ENCRYPTION BY PASSWORD = 'password'; As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.
- RMF Control
- SC-28
- Severity
- Medium
- CCI
- CCI-001199
- Version
- SQL6-D0-009700
- Vuln IDs
-
- V-213974
- V-79209
- Rule IDs
-
- SV-213974r961128_rule
- SV-93915
Checks: C-15191r952221_chk
If the application owner and authorizing official have determined that encryption of data at rest is not required, this is not a finding. Review procedures for and evidence of backup of the Master Key in the System Security Plan. If the procedures or evidence does not exist, this is a finding. If the procedures do not indicate that a backup of the Master Key is stored in a secure location that is not on the SQL Server, this is a finding. If procedures do not indicate access restrictions to the Master Key backup, this is a finding.
Fix: F-15189r951667_fix
Document and implement procedures to safely back up and store the Master Key in a secure location that is not on the SQL Server. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Master Key. BACKUP MASTER KEY TO FILE = 'path_to_file' ENCRYPTION BY PASSWORD = 'password'; As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.
- RMF Control
- SC-4
- Severity
- Medium
- CCI
- CCI-001090
- Version
- SQL6-D0-009800
- Vuln IDs
-
- V-213975
- V-79211
- Rule IDs
-
- SV-213975r961149_rule
- SV-93917
Checks: C-15192r313708_chk
Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. Review the Instance configuration: SELECT value_in_use FROM sys.configurations WHERE name = 'common criteria compliance enabled' If "value_in_use" is set to "1" this is not a finding. If "value_in_use" is set to "0" this is a finding. NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding.
Fix: F-15190r313709_fix
Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process. sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'common criteria compliance enabled', 1; GO RECONFIGURE GO
- RMF Control
- SC-4
- Severity
- Medium
- CCI
- CCI-001090
- Version
- SQL6-D0-009900
- Vuln IDs
-
- V-213976
- V-79213
- Rule IDs
-
- SV-213976r961149_rule
- SV-93919
Checks: C-15193r951669_chk
Review system configuration to determine whether IFI support has been enabled (by default in SQL Server 2016). Start >> Control Panel >> System and Security >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment >> Perform volume maintenance tasks The default SQL service account for a default instance is NT SERVICE\MSSQLSERVER or for a named instance is NT SERVICE\MSSQL$InstanceName. If the SQL service account or SQL service SID has been granted "Perform volume maintenance tasks" Local Rights Assignment, this means that Instant File Initialization (IFI) is enabled. Review the system documentation to determine if Instant File Initialization (IFI) is required. If IFI is enabled but not documented as required, this is a finding. If IFI is not enabled, this is not a finding.
Fix: F-15191r313712_fix
If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.
- RMF Control
- SC-4
- Severity
- Medium
- CCI
- CCI-001090
- Version
- SQL6-D0-010000
- Vuln IDs
-
- V-213977
- V-79215
- Rule IDs
-
- SV-213977r961149_rule
- SV-93921
Checks: C-15194r313714_chk
Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". For each of the directories returned by the above script, verify whether the correct permissions have been applied. 1) Launch Windows Explorer. 2) Navigate to the folder. 3) Right-click the folder and click "Properties". 4) Navigate to the "Security" tab. 5) Review the listing of principals and permissions. Account Type Directory Type Permission ----------------------------------------------------------------------------------------------- Database Administrators ALL Full Control SQL Server Service SID Data; Log; Backup; Full Control SQL Server Agent Service SID Backup Full Control SYSTEM ALL Full Control CREATOR OWNER ALL Full Control For information on how to determine a "Service SID", go to: https://aka.ms/sql-service-sids Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: https://aka.ms/sqlservicepermissions If any additional permissions are granted but not documented as authorized, this is a finding.
Fix: F-15192r313715_fix
Remove any unauthorized permission grants from SQL Server data, log, and backup directories. 1) On the "Security" tab, highlight the user entry. 2) Click "Remove".
- RMF Control
- SI-11
- Severity
- Medium
- CCI
- CCI-001314
- Version
- SQL6-D0-010100
- Vuln IDs
-
- V-213978
- V-79217
- Rule IDs
-
- SV-213978r1024933_rule
- SV-93923
Checks: C-15195r1018590_chk
Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: USE master GO SELECT Name FROM syslogins WHERE (sysadmin = 1 or securityadmin = 1) and hasaccess = 1; If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding. In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed. If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, this is a finding. If vendor documentation does not exist stating that full error messages must be returned, this is a finding. Otherwise, verify if trace flag 3625 is enabled to mask certain system-level error information returned to nonadministrative users. Launch SQL Server Configuration Manager >> select SQL Server Services >> select the SQL Server >> right-click and select Properties >> select Startup Parameters tab >> verify -T3625 exists in the dialogue window. OR Run the query: DBCC TRACESTATUS; If TraceFlag 3625 does not return with Status = 1, this is a finding.
Fix: F-15193r1024933_fix
Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles. If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. Consider enabling trace flag 3625 to mask certain system-level error information returned to nonadministrative users. Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles. If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. Enable trace flag 3625 to mask certain system-level error information returned to nonadministrative users. To launch SQL Server Configuration Manager, select SQL Server Services, select the SQL Server, right-click and select Properties. Select Startup Parameters tab, enter "-T3625", and then click Add, click OK, then restart SQL instance. To launch SQL Server Configuration Manager, click SQL Services, open the instance properties, click the Service Parameters tab, enter "-T3625", and then click Add, click OK, then restart SQL instance.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-002235
- Version
- SQL6-D0-010400
- Vuln IDs
-
- V-213979
- V-79219
- Rule IDs
-
- SV-213979r961353_rule
- SV-93925
Checks: C-15196r313720_chk
Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. Review the permissions in place on the server. If the actual permissions do not match the documented requirements, this is a finding. Get all permission assignments to logins and roles: SELECT DISTINCT CASE WHEN SP.class_desc IS NOT NULL THEN CASE WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' ELSE SP.class_desc END WHEN E.name IS NOT NULL THEN 'ENDPOINT' WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' ELSE '???' END AS [Securable Class], CASE WHEN E.name IS NOT NULL THEN E.name WHEN S.name IS NOT NULL THEN S.name WHEN P.name IS NOT NULL THEN P.name ELSE '???' END AS [Securable], P1.name AS [Grantee], P1.type_desc AS [Grantee Type], sp.permission_name AS [Permission], sp.state_desc AS [State], P2.name AS [Grantor], P2.type_desc AS [Grantor Type] FROM sys.server_permissions SP INNER JOIN sys.server_principals P1 ON P1.principal_id = SP.grantee_principal_id INNER JOIN sys.server_principals P2 ON P2.principal_id = SP.grantor_principal_id FULL OUTER JOIN sys.servers S ON SP.class_desc = 'SERVER' AND S.server_id = SP.major_id FULL OUTER JOIN sys.endpoints E ON SP.class_desc = 'ENDPOINT' AND E.endpoint_id = SP.major_id FULL OUTER JOIN sys.server_principals P ON SP.class_desc = 'SERVER_PRINCIPAL' AND P.principal_id = SP.major_id Get all server role memberships: SELECT R.name AS [Role], M.name AS [Member] FROM sys.server_role_members X INNER JOIN sys.server_principals R ON R.principal_id = X.role_principal_id INNER JOIN sys.server_principals M ON M.principal_id = X.member_principal_id The CONTROL SERVER permission is similar but not identical to the sysadmin fixed server role. Permissions do not imply role memberships and role memberships do not grant permissions. (e.g., CONTROL SERVER does not imply membership in the sysadmin fixed server role.) Ensure only the documented and approved logins have privileged functions in SQL Server. If the current configuration does not match the documented baseline, this is a finding.
Fix: F-15194r313721_fix
Restrict the granting of permissions to server-level securables to only those authorized. Most notably, members of sysadmin and securityadmin built-in instance-level roles, CONTROL SERVER permission, and use of the GRANT with GRANT permission.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-002233
- Version
- SQL6-D0-010500
- Vuln IDs
-
- V-213980
- V-79221
- Rule IDs
-
- SV-213980r961359_rule
- SV-93927
Checks: C-15197r313723_chk
Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. SELECT C.name AS credential_name, C.credential_identity FROM sys.credentials C GO SELECT P.name AS proxy_name, C.name AS credential_name, C.credential_identity FROM sys.credentials C JOIN msdb.dbo.sysproxies P ON C.credential_id = P.credential_id WHERE P.enabled = 1 GO If any Credentials or SQL Agent Proxy accounts are returned that are not documented and authorized, this is a finding.
Fix: F-15195r313724_fix
Remove any SQL Agent Proxy accounts and credentials that are not authorized. DROP CREDENTIAL <Credential Name> GO USE [msdb] EXEC sp_delete_proxy @proxy_name = '<Proxy Name>' GO
- RMF Control
- AU-4
- Severity
- Medium
- CCI
- CCI-001849
- Version
- SQL6-D0-010900
- Vuln IDs
-
- V-213983
- V-79227
- Rule IDs
-
- SV-213983r1018595_rule
- SV-93933
Checks: C-15200r1018593_chk
If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is Not Applicable. Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path" FROM sys.server_file_audits Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties. If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location, this is a finding; OR if "max_file_size" is set to "0" (Unlimited), this is a finding; OR if "max_rollover_files" are set to "0" (None) or "2147483647" (Unlimited), this is a finding.
Fix: F-15198r1018594_fix
Review the SQL Audit file location; ensure the destination has enough space available to accommodate the maximum total size of all files that could be written. Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support. Update the "max_files" or "max_rollover_files" parameter of the audits to ensure the correct number of files is defined. If writing to application event logs or security logs, space considerations are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use.
- RMF Control
- AU-5
- Severity
- Medium
- CCI
- CCI-001855
- Version
- SQL6-D0-011000
- Vuln IDs
-
- V-213984
- V-79229
- Rule IDs
-
- SV-213984r961398_rule
- SV-93935
Checks: C-15201r313735_chk
The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration. If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.
Fix: F-15199r313736_fix
Utilize operating system alerting mechanisms, SQL Agent, Operations Management tools, and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.
- RMF Control
- AU-5
- Severity
- Medium
- CCI
- CCI-001858
- Version
- SQL6-D0-011100
- Vuln IDs
-
- V-213985
- V-79231
- Rule IDs
-
- SV-213985r961401_rule
- SV-93937
Checks: C-15202r754630_chk
Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason. If real-time alerts are not sent upon auditing failure, this is a finding.
Fix: F-15200r495408_fix
Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.
- RMF Control
- AU-8
- Severity
- Medium
- CCI
- CCI-001890
- Version
- SQL6-D0-011200
- Vuln IDs
-
- V-213986
- V-79233
- Rule IDs
-
- SV-213986r961443_rule
- SV-93939
Checks: C-15203r313741_chk
SQL Server audits store the timestamp in UTC time. Determine if the computer is joined to a domain. SELECT DEFAULT_DOMAIN()[DomainName] If this is not NULL, this is not a finding. If the computer is not joined to a domain, determine what the time source is. (Run the following command in an elevated PowerShell session.) w32tm /query /source If the results of the command return "Local CMOS Clock" and is not documented with justification and AO authorization, this is a finding. If the OS does not synchronize with a time server, review the procedure for maintaining accurate time on the system. If such a procedure does not exist, this is a finding. If the procedure exists, review evidence that the correct time is actually maintained. If the evidence indicates otherwise, this is a finding.
Fix: F-15201r313742_fix
Where possible, configure the operating system to automatic synchronize with an official time server, using NTP. Where there is reason not to implement automatic synchronization with an official time server, using NTP, document the reason, and the procedure for maintaining the correct time, and obtain AO approval. Enforce the procedure.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001813
- Version
- SQL6-D0-011400
- Vuln IDs
-
- V-213987
- V-79235
- Rule IDs
-
- SV-213987r961461_rule
- SV-93941
Checks: C-15204r313744_chk
Obtain a list of logins who have privileged permissions and role memberships in SQL. Execute the following query to obtain a list of logins and roles and their respective permissions assignment: SELECT p.name AS Principal, p.type_desc AS Type, sp.permission_name AS Permission, sp.state_desc AS State FROM sys.server_principals p INNER JOIN sys.server_permissions sp ON p.principal_id = sp.grantee_principal_id WHERE sp.permission_name = 'CONTROL SERVER' OR sp.state = 'W' Execute the following query to obtain a list of logins and their role memberships. SELECT m.name AS Member, m.type_desc AS Type, r.name AS Role FROM sys.server_principals m INNER JOIN sys.server_role_members rm ON m.principal_id = rm.member_principal_id INNER JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id WHERE r.name IN ('sysadmin','securityadmin','serveradmin') Check the server documentation to verify the logins and roles returned are authorized. If the logins and/or roles are not documented and authorized, this is a finding.
Fix: F-15202r313745_fix
Revoke unauthorized permissions from principals. https://msdn.microsoft.com/en-us/library/ms186308.aspx Remove unauthorized logins from roles. ALTER SERVER ROLE DROP MEMBER login; https://technet.microsoft.com/en-us/library/ee677634.aspx
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001813
- Version
- SQL6-D0-011500
- Vuln IDs
-
- V-213988
- V-79237
- Rule IDs
-
- SV-213988r961461_rule
- SV-93943
Checks: C-15205r313747_chk
Obtain a list of users who have privileged access to the server via the local Administrators group. Launch lusrmgr.msc Select Groups Double-click Administrators Alternatively, execute the following command in PowerShell: net localgroup administrators Check the server documentation to verify the users returned are authorized. If the users are not documented and authorized, this is a finding.
Fix: F-15203r313748_fix
Remove users from the local Administrators group who are not authorized.
- RMF Control
- Severity
- Medium
- CCI
- CCI-003938
- Version
- SQL6-D0-011800
- Vuln IDs
-
- V-213989
- V-79239
- Rule IDs
-
- SV-213989r1018611_rule
- SV-93945
Checks: C-15206r754635_chk
Determine if an audit is configured to capture denied actions and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the following events are included in the server audit specification: APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, AUDIT_CHANGE_GROUP, BACKUP_RESTORE_GROUP, DATABASE_CHANGE_GROUP, DATABASE_OBJECT_ACCESS_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OWNERSHIP_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, DBCC_GROUP, LOGIN_CHANGE_PASSWORD_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SERVER_OBJECT_CHANGE_GROUP, SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP, SERVER_OBJECT_PERMISSION_CHANGE_GROUP, SERVER_OPERATION_GROUP, SERVER_PERMISSION_CHANGE_GROUP, SERVER_PRINCIPAL_IMPERSONATION_GROUP, SERVER_ROLE_MEMBER_CHANGE_GROUP, SERVER_STATE_CHANGE_GROUP, TRACE_CHANGE_GROUP SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ( 'APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', 'AUDIT_CHANGE_GROUP', 'BACKUP_RESTORE_GROUP', 'DATABASE_CHANGE_GROUP', 'DATABASE_OBJECT_ACCESS_GROUP', 'DATABASE_OBJECT_CHANGE_GROUP', 'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', 'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', 'DATABASE_OWNERSHIP_CHANGE_GROUP', 'DATABASE_OPERATION_GROUP', 'DATABASE_PERMISSION_CHANGE_GROUP', 'DATABASE_PRINCIPAL_CHANGE_GROUP', 'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', 'DATABASE_ROLE_MEMBER_CHANGE_GROUP', 'DBCC_GROUP', 'LOGIN_CHANGE_PASSWORD_GROUP', 'SCHEMA_OBJECT_CHANGE_GROUP', 'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', 'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', 'SERVER_OBJECT_CHANGE_GROUP', 'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', 'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', 'SERVER_OPERATION_GROUP', 'SERVER_PERMISSION_CHANGE_GROUP', 'SERVER_PRINCIPAL_IMPERSONATION_GROUP', 'SERVER_ROLE_MEMBER_CHANGE_GROUP', 'SERVER_STATE_CHANGE_GROUP', 'TRACE_CHANGE_GROUP' ) Order by d.audit_action_name If the identified groups are not returned, this is a finding.
Fix: F-15204r998249_fix
Add the required events to the server audit specification to audit denied actions. USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_ACCESS_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP ); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP ); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-001762
- Version
- SQL6-D0-011900
- Vuln IDs
-
- V-213990
- V-79241
- Rule IDs
-
- SV-213990r961470_rule
- SV-93947
Checks: C-15207r313753_chk
SQL Server must only use approved network communication libraries, ports, and protocols. Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. Verify that the protocols are enabled for the instance. If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding.
Fix: F-15205r313754_fix
Assign the approved TCP/IP port number to the SQL Server Database Engine. 1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for <instance name>, and then double-click "TCP/IP". 2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure. 3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0". 4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK". 5. In the console pane, click "SQL Server Services". 6. In the details pane, right-click "SQL Server (<instance name>)" and then click "Restart", to stop and restart SQL Server. To disable a server network protocol for an instance: 1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. 2. In the console pane, click "Protocols" for <instance name>. 3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable". 4. In the console pane, click "SQL Server Services". 5. In the details pane, right-click "SQL Server (<instance name>)", and then click "Restart", to stop and restart the SQL Server service.
- RMF Control
- SC-39
- Severity
- Medium
- CCI
- CCI-002530
- Version
- SQL6-D0-012300
- Vuln IDs
-
- V-213991
- V-79243
- Rule IDs
-
- SV-213991r961608_rule
- SV-93949
Checks: C-15208r313756_chk
Review the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: SELECT name, value, value_in_use FROM sys.configurations WHERE name = 'clr enabled' If "value_in_use" is a "1" and CLR is not required, this is a finding.
Fix: F-15206r313757_fix
Disable CLR support in SQL Server by executing the following query: EXEC sp_configure 'clr enabled', 0 GO RECONFIGURE GO
- RMF Control
- SC-39
- Severity
- Medium
- CCI
- CCI-002530
- Version
- SQL6-D0-012400
- Vuln IDs
-
- V-213992
- V-79245
- Rule IDs
-
- SV-213992r961608_rule
- SV-93951
Checks: C-15209r313759_chk
Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. Click Start >> Type "SQL Server Configuration Manager" >> Launch the program >> Click SQL Server Services tree node. Review the "Log On As" column for each service. If any services are configured with the same service account or are configured with an account that is not documented and authorized, this is a finding.
Fix: F-15207r313760_fix
Configure SQL Server services to have a documented, dedicated account. For non-domain servers, consider using virtual service accounts (VSA). See https://msdn.microsoft.com/en-us/library/ms143504.aspx#VA_Desc for more information. For standalone, domain-joined servers, consider using managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#MSA for more information. For clustered instances, consider using group managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#GMSA or https://blogs.msdn.microsoft.com/markweberblog/2016/05/25/group-managed-service-accounts-gmsa-and-sql-server-2016/ for more information.
- RMF Control
- SI-2
- Severity
- Medium
- CCI
- CCI-002617
- Version
- SQL6-D0-012700
- Vuln IDs
-
- V-213993
- V-79247
- Rule IDs
-
- SV-213993r961677_rule
- SV-93953
Checks: C-15210r313762_chk
From the server documentation, obtain a listing of required components. Generate a listing of components installed on the server. Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.
Fix: F-15208r313763_fix
Remove all features that are not required.
- RMF Control
- SI-2
- Severity
- Medium
- CCI
- CCI-002605
- Version
- SQL6-D0-012800
- Vuln IDs
-
- V-213994
- V-79249
- Rule IDs
-
- SV-213994r1001008_rule
- SV-93955
Checks: C-15211r917656_chk
Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates Check the SQL Server version by running the following script: Print @@version If the SQL Server version is not shown as supported, this is a finding. If such evidence cannot be obtained, or the evidence that is obtained indicates a pattern of noncompliance, this is a finding.
Fix: F-15209r313766_fix
Upgrade SQL Server to the Microsoft-supported version. Institute and adhere to policies and procedures to ensure that patches are consistently applied to SQL Server within the time allowed.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-012900
- Vuln IDs
-
- V-213995
- V-79251
- Rule IDs
-
- SV-213995r961791_rule
- SV-93957
Checks: C-15212r810826_chk
Review the system documentation to determine if SQL Server is required to audit the retrieval of when security objects are accessed. If this is not required, this is not a finding. If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query. SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.
Fix: F-15210r754694_fix
Deploy an audit to audit the retrieval of privilege/permission/role membership information when successful and unsuccessful attempts to access security objects occur. See the supplemental file "SQL 2016 Audit.sql".
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-013200
- Vuln IDs
-
- V-213998
- V-79257
- Rule IDs
-
- SV-213998r961797_rule
- SV-93963
Checks: C-15215r902987_chk
Review the system documentation to determine if SQL Server is required to audit when data classifications are both successfully and unsuccessfully retrieved. If this is not required, this is not a finding. If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query. SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.
Fix: F-15213r902988_fix
Deploy an audit to audit when data classifications are both successfully and unsuccessfully retrieved. See the supplemental file "SQL 2016 Audit.sql".
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-013400
- Vuln IDs
-
- V-214000
- V-79261
- Rule IDs
-
- SV-214000r961800_rule
- SV-93967
Checks: C-15217r902990_chk
Check that SQL Server Audit is being used for the STIG compliant audit. Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status Execute the following query to verify the required audit actions are included in the server audit specification: SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' ,'DATABASE_OWNERSHIP_CHANGE_GROUP' ,'DATABASE_PERMISSION_CHANGE_GROUP' ,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' ,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' ,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' ,'SERVER_PERMISSION_CHANGE_GROUP' ,'SERVER_ROLE_MEMBER_CHANGE_GROUP') If the any of the following audit actions are not returned in an active audit, this is a finding. DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP If no records are returned, this is a finding.
Fix: F-15215r313784_fix
Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP See the supplemental file "SQL 2016 Audit.sql". Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-013600
- Vuln IDs
-
- V-214002
- V-79265
- Rule IDs
-
- SV-214002r961800_rule
- SV-93971
Checks: C-15219r902992_chk
Check that SQL Server Audit is being used for the STIG compliant audit. Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status Execute the following query to verify the required audit actions are included in the server audit specification: SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' ,'DATABASE_OWNERSHIP_CHANGE_GROUP' ,'DATABASE_PERMISSION_CHANGE_GROUP' ,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' ,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' ,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' ,'SERVER_PERMISSION_CHANGE_GROUP' ,'SERVER_ROLE_MEMBER_CHANGE_GROUP') If the any of the following audit actions are not returned in an active audit, this is a finding. DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP If no records are returned, this is a finding.
Fix: F-15217r313790_fix
Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP See the supplemental file "SQL 2016 Audit.sql". Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-013800
- Vuln IDs
-
- V-214004
- V-79269
- Rule IDs
-
- SV-214004r961803_rule
- SV-93975
Checks: C-15221r313795_chk
Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.
Fix: F-15219r313796_fix
Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO See supplemental script "SQL 2016 Audit.sql".
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-014000
- Vuln IDs
-
- V-214006
- V-79273
- Rule IDs
-
- SV-214006r961809_rule
- SV-93979
Checks: C-15223r902995_chk
Review the system documentation to determine if SQL Server is required to audit when data classifications are successfully and unsuccessfully modified. If this is not required, this is not a finding. If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.
Fix: F-15221r313802_fix
Deploy an audit to audit when data classifications are unsuccessfully modified. See the supplemental file "SQL 2016 Audit.sql".
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-014200
- Vuln IDs
-
- V-214008
- V-79277
- Rule IDs
-
- SV-214008r961812_rule
- SV-93983
Checks: C-15225r799965_chk
Check that SQL Server Audit is being used for the STIG compliant audit. Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status Execute the following query to verify the required audit actions are included in the server audit specification: SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' ,'DATABASE_OWNERSHIP_CHANGE_GROUP' ,'DATABASE_PERMISSION_CHANGE_GROUP' ,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' ,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' ,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' ,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' ,'SERVER_PERMISSION_CHANGE_GROUP' ,'SERVER_ROLE_MEMBER_CHANGE_GROUP') If the any of the following audit actions are not returned in an active audit, this is a finding. DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx
Fix: F-15223r313808_fix
Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP See the supplemental file "SQL 2016 Audit.sql". Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-014400
- Vuln IDs
-
- V-214010
- V-79281
- Rule IDs
-
- SV-214010r961818_rule
- SV-93987
Checks: C-15227r902997_chk
Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.
Fix: F-15225r313814_fix
Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO See the supplemental script "SQL 2016 Audit.sql" for complete script.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-014600
- Vuln IDs
-
- V-214012
- V-79285
- Rule IDs
-
- SV-214012r1018597_rule
- SV-93991
Checks: C-15229r1018596_chk
Review the system documentation to determine if SQL Server is required to audit when data classifications are successfully and unsuccessfully deleted. If this is not required, this is not a finding. If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.
Fix: F-15227r313820_fix
Deploy an audit to audit when data classifications are unsuccessfully deleted. See the supplemental file "SQL 2016 Audit.sql".
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-014800
- Vuln IDs
-
- V-214014
- V-79289
- Rule IDs
-
- SV-214014r961824_rule
- SV-93995
Checks: C-15231r903001_chk
Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP and FAILED_LOGIN_GROUP are included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('SUCCESSFUL_LOGIN_GROUP', 'FAILED_LOGIN_GROUP') If both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" are returned in an active audit, this is not a finding. If both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" are not in the active audit, determine whether "Both failed and successful logins" is enabled. In SQL Management Studio Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" If "Both failed and successful logins" is not selected, this is a finding.
Fix: F-15229r903002_fix
Add both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" to the server audit specification. USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (FAILED_LOGIN_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO Alternatively, enable "Both failed and successful logins". In SQL Management Studio: Right-click on the instance. - Select "Properties". - Select "Security" on the left-hand side. - Select "Both failed and successful logins". - Click "OK".
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-014900
- Vuln IDs
-
- V-214015
- V-79291
- Rule IDs
-
- SV-214015r961827_rule
- SV-93997
Checks: C-15232r313828_chk
Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the following events are included in the server audit specification: APPLICATION_ROLE_CHANGE_PASSWORD_GROUP AUDIT_CHANGE_GROUP BACKUP_RESTORE_GROUP DATABASE_CHANGE_GROUP DATABASE_OBJECT_CHANGE_GROUP DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OPERATION_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_PRINCIPAL_CHANGE_GROUP DATABASE_PRINCIPAL_IMPERSONATION_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP DBCC_GROUP LOGIN_CHANGE_PASSWORD_GROUP SCHEMA_OBJECT_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OPERATION_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_PRINCIPAL_CHANGE_GROUP SERVER_PRINCIPAL_IMPERSONATION_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP SERVER_STATE_CHANGE_GROUP TRACE_CHANGE_GROUP USER_CHANGE_PASSWORD_GROUP SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') If the identified groups are not returned, this is a finding.
Fix: F-15230r313829_fix
Add the required events to the server audit specification USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-015000
- Vuln IDs
-
- V-214016
- V-79293
- Rule IDs
-
- SV-214016r961827_rule
- SV-93999
Checks: C-15233r313831_chk
Determine if an audit is configured and started by executing the following query. SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the following events are included in the server audit specification: APPLICATION_ROLE_CHANGE_PASSWORD_GROUP AUDIT_CHANGE_GROUP BACKUP_RESTORE_GROUP DATABASE_CHANGE_GROUP DATABASE_OBJECT_CHANGE_GROUP DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OPERATION_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_PRINCIPAL_CHANGE_GROUP DATABASE_PRINCIPAL_IMPERSONATION_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP DBCC_GROUP LOGIN_CHANGE_PASSWORD_GROUP LOGOUT_GROUP SCHEMA_OBJECT_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OPERATION_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_PRINCIPAL_CHANGE_GROUP SERVER_PRINCIPAL_IMPERSONATION_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP SERVER_STATE_CHANGE_GROUP TRACE_CHANGE_GROUP USER_CHANGE_PASSWORD_GROUP SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', 'AUDIT_CHANGE_GROUP', 'BACKUP_RESTORE_GROUP', 'DATABASE_CHANGE_GROUP', 'DATABASE_OBJECT_CHANGE_GROUP', 'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', 'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', 'DATABASE_OPERATION_GROUP', 'DATABASE_OWNERSHIP_CHANGE_GROUP', 'DATABASE_PERMISSION_CHANGE_GROUP', 'DATABASE_PRINCIPAL_CHANGE_GROUP', 'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', 'DATABASE_ROLE_MEMBER_CHANGE_GROUP', 'DBCC_GROUP', 'LOGIN_CHANGE_PASSWORD_GROUP', 'LOGOUT_GROUP', 'SCHEMA_OBJECT_CHANGE_GROUP', 'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', 'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', 'SERVER_OBJECT_CHANGE_GROUP', 'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', 'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', 'SERVER_OPERATION_GROUP', 'SERVER_PERMISSION_CHANGE_GROUP', 'SERVER_PRINCIPAL_CHANGE_GROUP', 'SERVER_PRINCIPAL_IMPERSONATION_GROUP', 'SERVER_ROLE_MEMBER_CHANGE_GROUP', 'SERVER_STATE_CHANGE_GROUP', 'TRACE_CHANGE_GROUP', 'USER_CHANGE_PASSWORD_GROUP' ) Order by d.audit_action_name If the identified groups are not returned, this is a finding.
Fix: F-15231r313832_fix
Add the required events to the server audit specification USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-015100
- Vuln IDs
-
- V-214017
- V-79295
- Rule IDs
-
- SV-214017r961830_rule
- SV-94001
Checks: C-15234r313834_chk
Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the following events are included in the server audit specification: APPLICATION_ROLE_CHANGE_PASSWORD_GROUP AUDIT_CHANGE_GROUP BACKUP_RESTORE_GROUP DATABASE_CHANGE_GROUP DATABASE_OBJECT_CHANGE_GROUP DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OPERATION_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_PRINCIPAL_CHANGE_GROUP DATABASE_PRINCIPAL_IMPERSONATION_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP DBCC_GROUP LOGIN_CHANGE_PASSWORD_GROUP LOGOUT_GROUP SCHEMA_OBJECT_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OBJECT_CHANGE_GROUP SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP SERVER_OBJECT_PERMISSION_CHANGE_GROUP SERVER_OPERATION_GROUP SERVER_PERMISSION_CHANGE_GROUP SERVER_PRINCIPAL_CHANGE_GROUP SERVER_PRINCIPAL_IMPERSONATION_GROUP SERVER_ROLE_MEMBER_CHANGE_GROUP SERVER_STATE_CHANGE_GROUP TRACE_CHANGE_GROUP USER_CHANGE_PASSWORD_GROUP SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', 'AUDIT_CHANGE_GROUP', 'BACKUP_RESTORE_GROUP', 'DATABASE_CHANGE_GROUP', 'DATABASE_OBJECT_CHANGE_GROUP', 'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', 'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', 'DATABASE_OPERATION_GROUP', 'DATABASE_OWNERSHIP_CHANGE_GROUP', 'DATABASE_PERMISSION_CHANGE_GROUP', 'DATABASE_PRINCIPAL_CHANGE_GROUP', 'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', 'DATABASE_ROLE_MEMBER_CHANGE_GROUP', 'DBCC_GROUP', 'LOGIN_CHANGE_PASSWORD_GROUP', 'LOGOUT_GROUP', 'SCHEMA_OBJECT_CHANGE_GROUP', 'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', 'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', 'SERVER_OBJECT_CHANGE_GROUP', 'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', 'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', 'SERVER_OPERATION_GROUP', 'SERVER_PERMISSION_CHANGE_GROUP', 'SERVER_PRINCIPAL_CHANGE_GROUP', 'SERVER_PRINCIPAL_IMPERSONATION_GROUP', 'SERVER_ROLE_MEMBER_CHANGE_GROUP', 'SERVER_STATE_CHANGE_GROUP', 'TRACE_CHANGE_GROUP', 'USER_CHANGE_PASSWORD_GROUP' ) Order by d.audit_action_name If the identified groups are not returned, this is a finding.
Fix: F-15232r313835_fix
Add the "LOGOUT_GROUP" to the server audit specification USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-015200
- Vuln IDs
-
- V-214018
- V-79297
- Rule IDs
-
- SV-214018r961833_rule
- SV-94003
Checks: C-15235r313837_chk
Determine if an audit is configured and started by executing the following query. SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. Execute the following query to verify the "SUCCESSFUL_LOGIN_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. In SQL Management Studio: Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" If "Both failed and successful logins" is not selected, this is a finding.
Fix: F-15233r313838_fix
Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. USE [master]; GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); GO ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO Alternatively, enable "Both failed and successful logins" In SQL Management Studio: Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Select "Both failed and successful logins" >> Click "OK"
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-015400
- Vuln IDs
-
- V-214020
- V-79301
- Rule IDs
-
- SV-214020r961836_rule
- SV-94007
Checks: C-15237r903004_chk
Review the system documentation to determine if SQL Server is required to audit when successful and unsuccessful accesses to objects occur. If this is not required, this is not a finding. If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status If no records are returned, this is a finding. If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', s.name AS 'SpecName', d.audit_action_name AS 'ActionName', d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.
Fix: F-15235r903005_fix
Deploy an audit to audit when successful and unsuccessful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000172
- Version
- SQL6-D0-015500
- Vuln IDs
-
- V-214021
- V-79303
- Rule IDs
-
- SV-214021r961839_rule
- SV-94009
Checks: C-15238r313846_chk
Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio execute the following query: SELECT name AS AuditName, predicate AS AuditFilter FROM sys.server_audits WHERE predicate IS NOT NULL If any audits are returned, review the associated filters to determine whether administrative activities are being excluded. If any audits are configured to exclude administrative activities, this is a finding.
Fix: F-15236r313847_fix
Check the system documentation for required SQL Server Audits. Remove any Audit filters that exclude or reduce required auditing. Update filters to ensure administrative activity is not excluded.
- RMF Control
- SC-13
- Severity
- High
- CCI
- CCI-002450
- Version
- SQL6-D0-015600
- Vuln IDs
-
- V-214022
- V-79305
- Rule IDs
-
- SV-214022r961857_rule
- SV-94011
Checks: C-15239r313849_chk
Verify that Windows is configured to require the use of FIPS compliant algorithms. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." If the Security Setting for this option is "Disabled" this is a finding.
Fix: F-15237r313850_fix
In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing."
- RMF Control
- SC-13
- Severity
- High
- CCI
- CCI-002450
- Version
- SQL6-D0-015700
- Vuln IDs
-
- V-214023
- V-79307
- Rule IDs
-
- SV-214023r961857_rule
- SV-94013
Checks: C-15240r863341_chk
Verify that Windows is configured to require the use of FIPS-compliant algorithms. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.
Fix: F-15238r313853_fix
Configure Windows to require the use of FIPS compliant algorithms. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart Windows
- RMF Control
- SC-13
- Severity
- Medium
- CCI
- CCI-002450
- Version
- SQL6-D0-015800
- Vuln IDs
-
- V-214024
- V-79309
- Rule IDs
-
- SV-214024r961857_rule
- SV-94015
Checks: C-15241r863343_chk
Review the server documentation, if this system does not contain data that must be encrypted, this finding is NA. Verify that Windows is configured to require the use of FIPS compliant algorithms for the unclassified information that requires it. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.
Fix: F-15239r313856_fix
Configure Windows to require the use of FIPS compliant algorithms for the unclassified information that requires it. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart Windows
- RMF Control
- AU-4
- Severity
- Medium
- CCI
- CCI-001851
- Version
- SQL6-D0-015900
- Vuln IDs
-
- V-214025
- V-79311
- Rule IDs
-
- SV-214025r961860_rule
- SV-94017
Checks: C-15242r313858_chk
Review the system documentation for a description of how audit records are off-loaded. If the system has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding. If the system does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding.
Fix: F-15240r313859_fix
Configure the system or deploy and configure software tools to transfer audit records to a centralized log management system, continuously and in near-real time where a continuous network connection to the log management system exists, or at least weekly in the absence of such a connection.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- SQL6-D0-016000
- Vuln IDs
-
- V-214026
- V-79313
- Rule IDs
-
- SV-214026r961863_rule
- SV-94019
Checks: C-15243r313861_chk
Launch "Registry Editor" Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE Review the following values: CustomerFeedback, EnableErrorReporting Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130 Review the following values: CustomerFeedback, EnableErrorReporting If this is a classified system, and any of the above values are not zero (0), this is a finding. If this is an unclassified system, review the server documentation to determine whether CEIP participation is authorized. If CEIP participation is not authorized, and any of the above values are one (1), this is a finding.
Fix: F-15241r313862_fix
To disable participation in the CEIP program, change the value of the following registry keys to zero (0). To enable participation in the CEIP program, change the value of the following registry keys to one (1). HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\CustomerFeedback HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\EnableErrorReporting HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\CustomerFeedback HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\EnableErrorReporting
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- SQL6-D0-016100
- Vuln IDs
-
- V-214027
- V-79315
- Rule IDs
-
- SV-214027r961863_rule
- SV-94021
Checks: C-15244r313864_chk
Review the server documentation to determine if auditing of the telemetry data is required. If auditing of telemetry data is not required, this is not a finding. If auditing of telemetry data is required, determine the telemetry service user name by executing the following query: SELECT name FROM sys.server_principals WHERE name LIKE '%SQLTELEMETRY%' Review the values of the following registry key: Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory If the registry key do not exist or the value is blank, this is a finding. Navigate the path defined in the "UserRequestedLocalAuditDirectory" registry key in file explorer. Right-click on the folder and choose "Properties". Open the "Security" tab. Verify the SQLTELEMETRY account has the following permissions: - List folder contents - Read - Write If the permissions are not set properly on the folder, this is a finding. Open services.msc and find the telemetry service. - For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). - For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>). Right-click on the service and choose "Properties". Verify the "Startup type" is "Automatic." If the service is not configured to automatically start, this is a finding. Review the processes and procedures for reviewing the telemetry data. If there is evidence that the telemetry data is periodically reviewed in accordance with the processes and procedures, this is not a finding. If no processes and procedures exist for reviewing telemetry data, this is a finding.
Fix: F-15242r313865_fix
Configure the instance to audit telemetry data. More information about auditing telemetry data can be found at https://msdn.microsoft.com/en-us/library/mt743085.aspx. Create a folder to store the telemetry audit data in. Grant the SQLTELEMETRY service the following permissions on the folder: - List folder contents - Read - Write Create and configure the following registry key: Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory [string] Set the "UserRequestedLocalAuditDirectory" key value to the path of the telemetry audit folder. Set the telemetry service to start automatically. Restart the service. - For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). - For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>).
- RMF Control
- AC-3
- Severity
- High
- CCI
- CCI-000213
- Version
- SQL6-D0-016200
- Vuln IDs
-
- V-214028
- V-79317
- Rule IDs
-
- SV-214028r960792_rule
- SV-94023
Checks: C-15245r822466_chk
Check SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query: USE master; GO SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1; GO Verify that the "name" column contains the current name of the [sa] database server account. If the "is_disabled" column is not set to "1", this is a finding.
Fix: F-15243r313868_fix
Modify the enabled flag of SQL Server's [sa] (system administrator) account by running the following script. USE master; GO ALTER LOGIN [sa] DISABLE; GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-016300
- Vuln IDs
-
- V-214029
- V-79319
- Rule IDs
-
- SV-214029r960963_rule
- SV-94025
Checks: C-15246r313870_chk
Verify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: USE master; GO SELECT * FROM sys.sql_logins WHERE [name] = 'sa' OR [principal_id] = 1; GO If the login account name "SA" or "sa" appears in the query output, this is a finding.
Fix: F-15244r313871_fix
Modify the SQL Server's [sa] (system administrator) account by running the following script: USE master; GO ALTER LOGIN [sa] WITH NAME = <new name> GO
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-002233
- Version
- SQL6-D0-016400
- Vuln IDs
-
- V-214030
- V-79321
- Rule IDs
-
- SV-214030r961359_rule
- SV-94027
Checks: C-15247r313873_chk
Review the system documentation to obtain a listing of documented stored procedures used by SQL Server during start up. Execute the following query: Select [name] as StoredProc From sys.procedures Where OBJECTPROPERTY(OBJECT_ID, 'ExecIsStartup') = 1 If any stored procedures are returned that are not documented, this is a finding.
Fix: F-15245r313874_fix
To disable start up stored procedure(s), run the following in Master for each undocumented procedure: sp_procoption @procname = '<procedure name>', @OptionName = 'Startup', @optionValue = 'Off'
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- SQL6-D0-016500
- Vuln IDs
-
- V-214031
- V-79323
- Rule IDs
-
- SV-214031r961863_rule
- SV-94029
Checks: C-15248r313876_chk
If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding. If Database Mirroring is in use, run the following to check for encrypted transmissions: SELECT name, type_desc, encryption_algorithm_desc FROM sys.database_mirroring_endpoints WHERE encryption_algorithm != 2 If any records are returned, this is a finding.
Fix: F-15246r313877_fix
Run the following to enable encryption on the mirroring endpoint: ALTER ENDPOINT <Endpoint Name> FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED ALGORITHM AES)
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- SQL6-D0-016600
- Vuln IDs
-
- V-214032
- V-79325
- Rule IDs
-
- SV-214032r961863_rule
- SV-94031
Checks: C-15249r313879_chk
If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding. If SQL Service Broker is in use, run the following to check for encrypted transmissions: SELECT name, type_desc, encryption_algorithm_desc FROM sys.service_broker_endpoints WHERE encryption_algorithm != 2 If any records are returned, this is a finding.
Fix: F-15247r313880_fix
Run the following to enable encryption on the Service Broker endpoint: ALTER ENDPOINT <EndpointName> FOR SERVICE_BROKER (ENCRYPTION = REQUIRED ALGORITHM AES)
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-016700
- Vuln IDs
-
- V-214033
- V-79327
- Rule IDs
-
- SV-214033r960963_rule
- SV-94033
Checks: C-15250r313882_chk
To determine if permissions to execute registry extended stored procedures have been revoked from all users (other than dbo), execute the following command: SELECT OBJECT_NAME(major_id) AS [Stored Procedure] ,dpr.NAME AS [Principal] FROM sys.database_permissions AS dp INNER JOIN sys.database_principals AS dpr ON dp.grantee_principal_id = dpr.principal_id WHERE major_id IN ( OBJECT_ID('xp_regaddmultistring') ,OBJECT_ID('xp_regdeletekey') ,OBJECT_ID('xp_regdeletevalue') ,OBJECT_ID('xp_regenumvalues') ,OBJECT_ID('xp_regenumkeys') ,OBJECT_ID('xp_regremovemultistring') ,OBJECT_ID('xp_regwrite') ,OBJECT_ID('xp_instance_regaddmultistring') ,OBJECT_ID('xp_instance_regdeletekey') ,OBJECT_ID('xp_instance_regdeletevalue') ,OBJECT_ID('xp_instance_regenumkeys') ,OBJECT_ID('xp_instance_regenumvalues') ,OBJECT_ID('xp_instance_regremovemultistring') ,OBJECT_ID('xp_instance_regwrite') ) AND dp.[type] = 'EX' ORDER BY dpr.NAME; If any records are returned, review the system documentation to determine whether the accessing of the registry via extended stored procedures are required and authorized. If it is not authorized, this is a finding.
Fix: F-15248r313883_fix
Remove execute permissions to any registry extended stored procedure from all users (other than dbo). USE master GO REVOKE EXECUTE ON [<procedureName>] FROM [<principal>] GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-016800
- Vuln IDs
-
- V-214034
- V-79329
- Rule IDs
-
- SV-214034r960963_rule
- SV-94035
Checks: C-15251r313885_chk
Review the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. If FileStream is not documented as being authorized, execute the following query. EXEC sp_configure 'filestream access level' If "run_value" is greater than "0", this is a finding. This rule checks that Filestream SQL specific option is disabled. SELECT CASE WHEN EXISTS (SELECT * FROM sys.configurations WHERE Name = 'filestream access level' AND Cast(value AS INT) = 0) THEN 'No' ELSE 'Yes' END AS TSQLFileStreamAccess; If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding.
Fix: F-15249r313886_fix
Disable the use of Filestream. 1. Delete all FILESTREAM columns from all tables. ALTER TABLE <name> DROP COLUMN <column name> 2. Disassociate tables from the FILESTREAM filegroups. ALTER TABLE <name> SET (FILESTREAM_ON = 'NULL' 3. Remove all FILESTREAM data containers. ALTER DATABASE <name> REMOVE FILE <file name> 4. Remove all FILESTREAM filegroups. ALTER DATABASE <name> REMOVE FILEGROUP <file name>. 5. Disable FILESTREAM. EXEC sp_configure filestream_access_level, 0 RECONFIGURE 6. Restart the SQL Service
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017000
- Vuln IDs
-
- V-214035
- V-79333
- Rule IDs
-
- SV-214035r960963_rule
- SV-94039
Checks: C-15252r313888_chk
To determine if "Ole Automation Procedures" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'Ole Automation Procedures'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Ole Automation Procedures" is required and authorized. If it is not authorized, this is a finding.
Fix: F-15250r313889_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Ole Automation Procedures" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'Ole Automation Procedures', 0; GO RECONFIGURE; GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017100
- Vuln IDs
-
- V-214036
- V-79335
- Rule IDs
-
- SV-214036r960963_rule
- SV-94041
Checks: C-15253r313891_chk
To determine if "User Options" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'user options'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding.
Fix: F-15251r313892_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "User Options" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'user options', 0; GO RECONFIGURE; GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017200
- Vuln IDs
-
- V-214037
- V-79337
- Rule IDs
-
- SV-214037r960963_rule
- SV-94043
Checks: C-15254r313894_chk
To determine if "Remote Access" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'remote access'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding.
Fix: F-15252r313895_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Remote Access" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'remote access', 0; GO RECONFIGURE; GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017400
- Vuln IDs
-
- V-214038
- V-79341
- Rule IDs
-
- SV-214038r960963_rule
- SV-94047
Checks: C-15255r313897_chk
To determine if "Hadoop Connectivity" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'hadoop connectivity'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding.
Fix: F-15253r313898_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Hadoop Connectivity" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'hadoop connectivity', 0; GO RECONFIGURE; GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017500
- Vuln IDs
-
- V-214039
- V-79343
- Rule IDs
-
- SV-214039r960963_rule
- SV-94049
Checks: C-15256r313900_chk
To determine if "Allow Polybase Export" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'allow polybase export'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding.
Fix: F-15254r313901_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Allow Polybase Export" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'allow polybase export', 0; GO RECONFIGURE; GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017600
- Vuln IDs
-
- V-214040
- V-79345
- Rule IDs
-
- SV-214040r960963_rule
- SV-94051
Checks: C-15257r313903_chk
To determine if "Remote Data Archive" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'remote data archive'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Data Archive" is required and authorized. If it is not authorized, this is a finding.
Fix: F-15255r313904_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Remote Data Archive" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'remote data archive', 0; GO RECONFIGURE; GO
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017700
- Vuln IDs
-
- V-214041
- V-79347
- Rule IDs
-
- SV-214041r960963_rule
- SV-94053
Checks: C-15258r313906_chk
To determine if "External Scripts Enabled" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'external scripts enabled'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "External Scripts Enabled" is required and authorized. If it is not authorized, this is a finding.
Fix: F-15256r313907_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "External Scripts Enabled" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'external scripts enabled', 0; GO RECONFIGURE; GO
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- SQL6-D0-017800
- Vuln IDs
-
- V-214042
- V-79349
- Rule IDs
-
- SV-214042r961863_rule
- SV-94055
Checks: C-15259r313909_chk
If the need for the SQL Server Browser service is documented and authorized, this is not a finding. Open the Services tool. Either navigate, via the Windows Start Menu and/or Control Panel, to "Administrative Tools", and select "Services"; or at a command prompt, type "services.msc" and press the "Enter" key. Scroll to "SQL Server Browser". If its Startup Type is not shown as "Disabled", this is a finding.
Fix: F-15257r313910_fix
If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. Where SQL Server Browser is judged unnecessary, the Service can be disabled. To disable, in the Services tool, double-click "SQL Server Browser". Set "Startup Type" to "Disabled". If "Service Status" is "Running", click on "Stop". Click on "OK".
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- SQL6-D0-017900
- Vuln IDs
-
- V-214043
- V-79351
- Rule IDs
-
- SV-214043r960963_rule
- SV-94057
Checks: C-15260r313912_chk
To determine if the "Replication Xps" option is enabled, execute the following query: EXEC SP_CONFIGURE 'show advanced options', '1'; RECONFIGURE WITH OVERRIDE; EXEC SP_CONFIGURE 'replication xps'; If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Replication Xps" is required and authorized. If it is not authorized, this is a finding.
Fix: F-15258r313913_fix
Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Replication Xps" option, from the query prompt: sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'replication xps', 0; GO RECONFIGURE; GO
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- SQL6-D0-018000
- Vuln IDs
-
- V-214044
- V-79353
- Rule IDs
-
- SV-214044r961863_rule
- SV-94059
Checks: C-15261r754689_chk
If the need for the SQL Server Browser service is documented and authorized, check to make sure the SQL Instances that do not require use of the SQL Browser Service are hidden with the following query: DECLARE @HiddenInstance INT EXEC master.dbo.Xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', N'HideInstance', @HiddenInstance output SELECT CASE WHEN @HiddenInstance = 0 AND Serverproperty('IsClustered') = 0 THEN 'No' ELSE 'Yes' END AS [Hidden] If the value of "Hidden" is "Yes", this is not a finding. If the value of "Hidden" is "No" and the startup type of the "SQL Server Browser" service is not "Disabled", this is a finding.
Fix: F-15259r313916_fix
If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. To hide the SQL instance, in SQL Server Configuration Manager, expand SQL Server Network Configuration, right-click Protocols for <server instance>, select "Properties", on the "Flags" tab, select "Yes" in the "HideInstance" box, then click "OK". The change takes effect immediately for new connections.
- RMF Control
- IA-6
- Severity
- High
- CCI
- CCI-000206
- Version
- SQL6-D0-018100
- Vuln IDs
-
- V-214045
- V-79355
- Rule IDs
-
- SV-214045r961047_rule
- SV-94061
Checks: C-15262r313918_chk
Run this query to determine whether SQL Server authentication is enabled: EXEC master.sys.xp_loginconfig 'login mode'; If the config_value returned is "Windows NT Authentication", this is not a finding. For SQLCMD, which cannot be configured not to accept a plain-text password, and any other essential tool with the same limitation, verify that the system documentation explains the need for the tool, who uses it, and any relevant mitigations; and that AO approval has been obtained; if not, this is a finding. Request evidence that all users of the tool are trained in the importance of not using the plain-text password option and in how to keep the password hidden; and that they adhere to this practice; if not, this is a finding.
Fix: F-15260r313919_fix
Where possible, change the login mode to Windows-only: USE [master] GO EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 1; GO If mixed-mode authentication is necessary, then for SQLCMD, which cannot be configured not to accept a plain-text password when mixed-mode authentication is enabled, and any other essential tool with the same limitation: 1) Document the need for it, who uses it, and any relevant mitigations, and obtain AO approval. 2) Train all users of the tool in the importance of not using the plain-text password option and in how to keep the password hidden.
- RMF Control
- IA-6
- Severity
- High
- CCI
- CCI-000206
- Version
- SQL6-D0-018200
- Vuln IDs
-
- V-214046
- V-79357
- Rule IDs
-
- SV-214046r961047_rule
- SV-94063
Checks: C-15263r313921_chk
Determine whether any applications that access the database allow for entry of the account name and password, or PIN. If any do, determine whether these applications obfuscate authentication data; if they do not, this is a finding.
Fix: F-15261r313922_fix
Configure or modify applications to prohibit display of passwords in clear text.
- RMF Control
- SA-22
- Severity
- High
- CCI
- CCI-003376
- Version
- SQL6-D0-018300
- Vuln IDs
-
- V-265870
- Rule IDs
-
- SV-265870r999516_rule
Checks: C-69789r999514_chk
Review the system documentation and interview the database administrator. Identify all database software components. Review the version and release information. Verify the SQL Server version via one of the following methods: Connect to the server by using Object Explorer in SQL Server Management Studio. After Object Explorer is connected, it will show the version information in parentheses, together with the user name that is used to connect to the specific instance of SQL Server. Or, from SQL Server Management Studio: SELECT @@VERSION; More information for finding the version is available at the following link: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/find-my-sql-version Access the vendor website or use other means to verify the version is still supported. https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016 If the installed version or any of the software components are not supported by the vendor, this is a finding.
Fix: F-69693r999515_fix
Remove or decommission all unsupported software products. Upgrade unsupported DBMS or unsupported components to a supported version of the product.