V-40951 – SQL Server 2012 Database Instance DISA STIGs

If you have any additional questions that aren’t addressed in the blog, feel free to contact me. I’d be more than happy to help you out!

V-40951

Title: “SQL Server must support the organizational requirement to employ automated mechanisms for enforcing access restrictions.”

Severity = Medium

Details = Obtain the SQL Server software library installation directory location.

From a command prompt, type regedit.exe, and press [ENTER].

Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> Instance Names. Each instance installed on the server possesses a key inside a folder under this registry entry.

Analysis Services Instances are registered in the OLAP subfolder.
Reporting Services Instances are registered in the RS subfolder.
Standard SQL Server Instances are registered in the SQL subfolder.

Inside each one of these folders, a single key is used to reference an instance’s specific Windows Registry tree. Each key will have its own registry tree at the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME].

An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders.

To find the installation location of a particular instance, navigate to the following location in the Windows Registry:
HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME] >> Setup. Examine the value of the ‘SqlProgramDir’ key. The value of the ‘SqlProgramDir’ key is the SQL Server installation directory for that SQL Server Instance.

Navigate to that folder location using a command prompt or Windows Explorer. Note any custom subdirectories within the SQL Server software library directory. Only applications that are required for the functioning and administration of SQL Server should be located in the same disk directory as the SQL Server software libraries.

If any directories or files not installed with the SQL Server software exist within the SQL Server software library directory, this is a finding.

FIX: Install SQL Server software using directories separate from the OS and other application software library directories.

Relocate any directories or reinstall other application software that currently shares the DBMS software library directory to separate directories.

Recommend dedicating a separate partition for the SQL software libraries.

This is pretty self explanatory. You should never install your SQL Server on the default “C” drive. Let your SAN team, or Windows Admin team know that you will need separate disk partitions. For example, the installation files can reside on the “E” drive, data file on the “F” drive and the log file on the “G” drive.

MSDN has a great article that addresses security considerations for a SQL Server installation. Read the article here. I also highly recommend buying a great book by Denny Cherry called, “Securing SQL Server.” I did a review of the book that you can read here.

V-40950 – SQL Server 2012 Database Instance DISA STIGs

If you have any additional questions that aren’t addressed in the blog, feel free to contact me. I’d be more than happy to help you out!

V-40950

Title: “SQL Server must support the employment of automated mechanisms supporting the auditing of the enforcement actions.”

Severity = Medium

Details = Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled.

Right click the root folder of the SQL Server installation. Typically, this is at :\Program Files\Microsoft SQL Server\. Select Properties.

Click on the Security tab

Click on the Advanced button

Click on the Auditing tab

If “Everyone” is not listed in the “Name” column, this is a finding.

If “This folder, subfolders and files” is not listed in the “Apply To” column, this is a finding.

When “Everyone” … ” is listed, select the “Everyone” row and click on the Edit button.

If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding:
Traverse folder/execute file
List folder/read data
Read attributes
Read extended attributes
Create files/write data
Create folders/append data
Write attributes
Write extended attributes
Delete
Read permissions

FIX: Navigate to Advanced Security Settings by selecting Properties > Security > Advanced > Auditing > Continue.

Where “Everyone” is missing from the “Name” column, click the Add button; type “Everyone” in the object names box; click the OK button. The Auditing Entry dialog opens.

Where “Everyone” is in the “Name” column, select that row and click on the Edit button. The Auditing Entry dialog opens.

In the Auditing Entry dialog, set “Apply onto” to “This folder, subfolders and files”.

In the Auditing Entry dialog, select both the Successful and the Failed checkbox for each of the following access types, where not already selected:
Traverse folder/execute file
List folder/read data
Read attributes
Read extended attributes
Create files/write data
Create folders/append data
Write attributes
Write extended attributes
Delete
Read permissions

Click OK, OK, OK, OK to save the new settings and exit the dialog boxes.

This is pretty self explanatory. MSDN has a great article that addresses security considerations for a SQL Server installation. Read the article here. I also highly recommend buying a great book by Denny Cherry called, “Securing SQL Server.” I did a review of the book that you can read here.