Table of Contents
前言:
实现:
原理:
更多:
Home Database Mysql Tutorial Chapter1SecuringYourServerandNetwork(14):限制功能xp_cmds

Chapter1SecuringYourServerandNetwork(14):限制功能xp_cmds

Jun 07, 2016 pm 04:00 PM

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615,专题目录:http://blog.csdn.net/dba_huangzj/article/details/37906349 未经作者同意,任何人不得以原创形式发布,也不得已用于商业用途,本人不负责任何法律责任。 前一篇:http://b

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615,专题目录:http://blog.csdn.net/dba_huangzj/article/details/37906349

未经作者同意,任何人不得以“原创”形式发布,也不得已用于商业用途,本人不负责任何法律责任。

前一篇:http://blog.csdn.net/dba_huangzj/article/details/38489765

前言:

基于安全性原因,某些功能在安装SQL Server时就被禁用,从2008开始,所有敏感选项可以通过一个叫【外围应用配置器】的【方面】进行管理,这个功能在2005的时候以独立工具的形式出现过,在2008又取消了。

实现:

1. 在SQL Server Management Studio(SSMS)中,右键【服务器】节点,选择【方面】:

image

2. 在【查看方面】对话框中,选择【外围应用配置器】:

image

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615

3. 把【AdHocRemoteQueriesEnabled】、【OleAutomationEnabled 】和【XPCmdShellEnabled 】的属性设为False:

image

可以使用下面语句来查询这些【方面】的信息:

SELECT * 
FROM sys.system_components_surface_area_configuration 
WHERE component_name IN 
( 
    'Ole Automation Procedures', 
    'xp_cmdshell' 
); 
Copy after login

除了外围配置管理器,还可以使用【策略管理,PBM】来管理这些,将在第七章介绍。

4. 还可以使用T-SQL检查状态:

EXEC sp_configure 'show advanced options', 1; 
RECONFIGURE; 
EXEC sp_configure 'Ad Hoc Distributed Queries'; 
EXEC sp_configure 'Ole Automation Procedures'; 
EXEC sp_configure 'xp_cmdshell'; 
Copy after login

5. 上面结果中,run_value为1 即启用,0为禁用,如果需要禁用这些,可以使用下面语句,记得使用RECONFIGURE命令让更改生效:

EXEC sp_configure 'Ad Hoc Distributed Queries', 0; 
EXEC sp_configure 'Ole Automation Procedures', 0; 
EXEC sp_configure 'xp_cmdshell', 0; 
RECONFIGURE;
Copy after login

原理:

Ad hoc分布式查询允许在T-SQL语句内使用连接目标数据源的字符串,可以使用OPENROWSET/OPENDATASOURCE关键字,通过OLEDB访问远程数据库,如下:

SELECT a.* 
FROM OPENROWSET('SQLNCLI', 'Server=SERVER2;Trusted_Connection=yes;', 
'SELECT * FROM AdventureWorks.Person.Contact') AS a;
Copy after login

这种写法的权限基于授权类型,如果使用SQL Server身份验证,那么权限是SQL Server服务的帐号权限,如果是Windows 身份验证,权限是Windows帐号的权限。

OLE自动化程序(OLE automation procedures)是系统存储过程,允许T-SQL代码使用OLE 自动化对象,然后在SQL Server上下文外部运行,如sp_OACreate用于实例化对象并操作这个对象。下面代码演示如何使用OLE自动化程序删除文件夹:

EXEC sp_configure 'show advanced options', 1; 
RECONFIGURE; 
EXEC sp_configure 'Role Automation Procedures', 1; 
RECONFIGURE; 
GO 
DECLARE @FSO int, @OLEResult int; 
EXECUTE @OLEResult = sp_OACreate 'Scripting.FileSystemObject', @FSO 
OUTPUT; 
EXECUTE @OLEResult = sp_OAMethod @FSO, 'DeleteFolder', NULL, 'c:\ 
sqldata'; 
SELECT @OLEResult; 
EXECUTE @OLEResult = sp_OADestroy @FSO;
Copy after login

只有sysadmin服务器角色的成员才能使用这些程序。

xp_cmdshell扩展存储过程允许使用T-SQL访问底层操作系统,如:

exec xp_cmdshell 'DIR c\*.*'; 
Copy after login

限制这些程序的权限,可以一定程度上保护服务器的安全。

更多:

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615

为了允许非sysadmin登录使用xp_cmdshell,可以把它封装到存储过程中并用EXECUTE AS 。如果你希望他们运行任意命令,必须定义一个代理帐号:

EXEC sp_xp_cmdshell_proxy_account 'DOMAIN\user','user password';
Copy after login

可用下面语句查询:

SELECT * 
FROM sys.credentials 
WHERE name = '##xp_cmdshell_proxy_account##';
Copy after login

可用下面语句移除:

EXEC sp_xp_cmdshell_proxy_account NULL; 
Copy after login

另外,你不能禁止sysadmin成员使用xp_cmdshell。即使禁用了,sysadmin角色成员还是可以启用。

下一篇:http://blog.csdn.net/dba_huangzj/article/details/38657111

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Explain InnoDB Full-Text Search capabilities. Explain InnoDB Full-Text Search capabilities. Apr 02, 2025 pm 06:09 PM

InnoDB's full-text search capabilities are very powerful, which can significantly improve database query efficiency and ability to process large amounts of text data. 1) InnoDB implements full-text search through inverted indexing, supporting basic and advanced search queries. 2) Use MATCH and AGAINST keywords to search, support Boolean mode and phrase search. 3) Optimization methods include using word segmentation technology, periodic rebuilding of indexes and adjusting cache size to improve performance and accuracy.

How do you alter a table in MySQL using the ALTER TABLE statement? How do you alter a table in MySQL using the ALTER TABLE statement? Mar 19, 2025 pm 03:51 PM

The article discusses using MySQL's ALTER TABLE statement to modify tables, including adding/dropping columns, renaming tables/columns, and changing column data types.

When might a full table scan be faster than using an index in MySQL? When might a full table scan be faster than using an index in MySQL? Apr 09, 2025 am 12:05 AM

Full table scanning may be faster in MySQL than using indexes. Specific cases include: 1) the data volume is small; 2) when the query returns a large amount of data; 3) when the index column is not highly selective; 4) when the complex query. By analyzing query plans, optimizing indexes, avoiding over-index and regularly maintaining tables, you can make the best choices in practical applications.

Can I install mysql on Windows 7 Can I install mysql on Windows 7 Apr 08, 2025 pm 03:21 PM

Yes, MySQL can be installed on Windows 7, and although Microsoft has stopped supporting Windows 7, MySQL is still compatible with it. However, the following points should be noted during the installation process: Download the MySQL installer for Windows. Select the appropriate version of MySQL (community or enterprise). Select the appropriate installation directory and character set during the installation process. Set the root user password and keep it properly. Connect to the database for testing. Note the compatibility and security issues on Windows 7, and it is recommended to upgrade to a supported operating system.

Difference between clustered index and non-clustered index (secondary index) in InnoDB. Difference between clustered index and non-clustered index (secondary index) in InnoDB. Apr 02, 2025 pm 06:25 PM

The difference between clustered index and non-clustered index is: 1. Clustered index stores data rows in the index structure, which is suitable for querying by primary key and range. 2. The non-clustered index stores index key values ​​and pointers to data rows, and is suitable for non-primary key column queries.

What are some popular MySQL GUI tools (e.g., MySQL Workbench, phpMyAdmin)? What are some popular MySQL GUI tools (e.g., MySQL Workbench, phpMyAdmin)? Mar 21, 2025 pm 06:28 PM

Article discusses popular MySQL GUI tools like MySQL Workbench and phpMyAdmin, comparing their features and suitability for beginners and advanced users.[159 characters]

How do you handle large datasets in MySQL? How do you handle large datasets in MySQL? Mar 21, 2025 pm 12:15 PM

Article discusses strategies for handling large datasets in MySQL, including partitioning, sharding, indexing, and query optimization.

How do you drop a table in MySQL using the DROP TABLE statement? How do you drop a table in MySQL using the DROP TABLE statement? Mar 19, 2025 pm 03:52 PM

The article discusses dropping tables in MySQL using the DROP TABLE statement, emphasizing precautions and risks. It highlights that the action is irreversible without backups, detailing recovery methods and potential production environment hazards.

See all articles