Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 539Remote AdministrationAdministrators often need to be able to administer multiple servers. Make sure therequirements of your remote administration solution do not compromise security. Ifyou need remote administration capabilities, the following recommendations helpimprove security:● Restrict the number of administration accounts. This includes restricting thenumber of administration accounts as well as restricting which accounts areallowed to logon remotely.● Restrict the tools. The main options include SQL Enterprise Manager andTerminal Services. Both SQL Enterprise Manager and Terminal Services useWindows security. As such, the main considerations here are restricting theWindows accounts and the ports you use.● Restrict the computers that are allowed to administer the server. IPSec can beused to restrict which computers can connect to your SQL Server.Securing Terminal ServicesIt is possible to use Microsoft Terminal Services securely to remotely administer yourdatabase server.Terminal Services is based on Microsoft’s proprietary protocol known as RemoteDesktop Protocol (RDP). RDP uses the TCP 3389 port and supports two concurrentusers. The following sections describe how to install and configure Terminal Servicesfor secure administration:● Install Terminal Services.●Configure Terminal Services.Install Terminal Services To install terminal services, do the following1. Install Terminal Services by using Add/Remove Programs from the Control Panel.Use the Add/Remove Windows Components option. You do not need to installthe Terminal Services Licensing service for remote administration.2. Configure Terminal Services for remote administration mode.3. Remove the TsInternetUser user account from the system, which is created duringTerminal Services installation. This account is used to support anonymous Internetaccess to Terminal Services, which should not be enabled on the server.