Table of Contents
前言:
实现:
原理:
更多:
Home Database Mysql Tutorial Chapter1SecuringYourServerandNetwork(14):限制功能xp_cmds

Chapter1SecuringYourServerandNetwork(14):限制功能xp_cmds

Jun 07, 2016 pm 04:00 PM

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615,专题目录:http://blog.csdn.net/dba_huangzj/article/details/37906349 未经作者同意,任何人不得以原创形式发布,也不得已用于商业用途,本人不负责任何法律责任。 前一篇:http://b

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615,专题目录:http://blog.csdn.net/dba_huangzj/article/details/37906349

未经作者同意,任何人不得以“原创”形式发布,也不得已用于商业用途,本人不负责任何法律责任。

前一篇:http://blog.csdn.net/dba_huangzj/article/details/38489765

前言:

基于安全性原因,某些功能在安装SQL Server时就被禁用,从2008开始,所有敏感选项可以通过一个叫【外围应用配置器】的【方面】进行管理,这个功能在2005的时候以独立工具的形式出现过,在2008又取消了。

实现:

1. 在SQL Server Management Studio(SSMS)中,右键【服务器】节点,选择【方面】:

image

2. 在【查看方面】对话框中,选择【外围应用配置器】:

image

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615

3. 把【AdHocRemoteQueriesEnabled】、【OleAutomationEnabled 】和【XPCmdShellEnabled 】的属性设为False:

image

可以使用下面语句来查询这些【方面】的信息:

SELECT * 
FROM sys.system_components_surface_area_configuration 
WHERE component_name IN 
( 
    'Ole Automation Procedures', 
    'xp_cmdshell' 
); 
Copy after login

除了外围配置管理器,还可以使用【策略管理,PBM】来管理这些,将在第七章介绍。

4. 还可以使用T-SQL检查状态:

EXEC sp_configure 'show advanced options', 1; 
RECONFIGURE; 
EXEC sp_configure 'Ad Hoc Distributed Queries'; 
EXEC sp_configure 'Ole Automation Procedures'; 
EXEC sp_configure 'xp_cmdshell'; 
Copy after login

5. 上面结果中,run_value为1 即启用,0为禁用,如果需要禁用这些,可以使用下面语句,记得使用RECONFIGURE命令让更改生效:

EXEC sp_configure 'Ad Hoc Distributed Queries', 0; 
EXEC sp_configure 'Ole Automation Procedures', 0; 
EXEC sp_configure 'xp_cmdshell', 0; 
RECONFIGURE;
Copy after login

原理:

Ad hoc分布式查询允许在T-SQL语句内使用连接目标数据源的字符串,可以使用OPENROWSET/OPENDATASOURCE关键字,通过OLEDB访问远程数据库,如下:

SELECT a.* 
FROM OPENROWSET('SQLNCLI', 'Server=SERVER2;Trusted_Connection=yes;', 
'SELECT * FROM AdventureWorks.Person.Contact') AS a;
Copy after login

这种写法的权限基于授权类型,如果使用SQL Server身份验证,那么权限是SQL Server服务的帐号权限,如果是Windows 身份验证,权限是Windows帐号的权限。

OLE自动化程序(OLE automation procedures)是系统存储过程,允许T-SQL代码使用OLE 自动化对象,然后在SQL Server上下文外部运行,如sp_OACreate用于实例化对象并操作这个对象。下面代码演示如何使用OLE自动化程序删除文件夹:

EXEC sp_configure 'show advanced options', 1; 
RECONFIGURE; 
EXEC sp_configure 'Role Automation Procedures', 1; 
RECONFIGURE; 
GO 
DECLARE @FSO int, @OLEResult int; 
EXECUTE @OLEResult = sp_OACreate 'Scripting.FileSystemObject', @FSO 
OUTPUT; 
EXECUTE @OLEResult = sp_OAMethod @FSO, 'DeleteFolder', NULL, 'c:\ 
sqldata'; 
SELECT @OLEResult; 
EXECUTE @OLEResult = sp_OADestroy @FSO;
Copy after login

只有sysadmin服务器角色的成员才能使用这些程序。

xp_cmdshell扩展存储过程允许使用T-SQL访问底层操作系统,如:

exec xp_cmdshell 'DIR c\*.*'; 
Copy after login

限制这些程序的权限,可以一定程度上保护服务器的安全。

更多:

原文出处:http://blog.csdn.net/dba_huangzj/article/details/38656615

为了允许非sysadmin登录使用xp_cmdshell,可以把它封装到存储过程中并用EXECUTE AS 。如果你希望他们运行任意命令,必须定义一个代理帐号:

EXEC sp_xp_cmdshell_proxy_account 'DOMAIN\user','user password';
Copy after login

可用下面语句查询:

SELECT * 
FROM sys.credentials 
WHERE name = '##xp_cmdshell_proxy_account##';
Copy after login

可用下面语句移除:

EXEC sp_xp_cmdshell_proxy_account NULL; 
Copy after login

另外,你不能禁止sysadmin成员使用xp_cmdshell。即使禁用了,sysadmin角色成员还是可以启用。

下一篇:http://blog.csdn.net/dba_huangzj/article/details/38657111

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

When might a full table scan be faster than using an index in MySQL? When might a full table scan be faster than using an index in MySQL? Apr 09, 2025 am 12:05 AM

Full table scanning may be faster in MySQL than using indexes. Specific cases include: 1) the data volume is small; 2) when the query returns a large amount of data; 3) when the index column is not highly selective; 4) when the complex query. By analyzing query plans, optimizing indexes, avoiding over-index and regularly maintaining tables, you can make the best choices in practical applications.

Can I install mysql on Windows 7 Can I install mysql on Windows 7 Apr 08, 2025 pm 03:21 PM

Yes, MySQL can be installed on Windows 7, and although Microsoft has stopped supporting Windows 7, MySQL is still compatible with it. However, the following points should be noted during the installation process: Download the MySQL installer for Windows. Select the appropriate version of MySQL (community or enterprise). Select the appropriate installation directory and character set during the installation process. Set the root user password and keep it properly. Connect to the database for testing. Note the compatibility and security issues on Windows 7, and it is recommended to upgrade to a supported operating system.

Explain InnoDB Full-Text Search capabilities. Explain InnoDB Full-Text Search capabilities. Apr 02, 2025 pm 06:09 PM

InnoDB's full-text search capabilities are very powerful, which can significantly improve database query efficiency and ability to process large amounts of text data. 1) InnoDB implements full-text search through inverted indexing, supporting basic and advanced search queries. 2) Use MATCH and AGAINST keywords to search, support Boolean mode and phrase search. 3) Optimization methods include using word segmentation technology, periodic rebuilding of indexes and adjusting cache size to improve performance and accuracy.

Difference between clustered index and non-clustered index (secondary index) in InnoDB. Difference between clustered index and non-clustered index (secondary index) in InnoDB. Apr 02, 2025 pm 06:25 PM

The difference between clustered index and non-clustered index is: 1. Clustered index stores data rows in the index structure, which is suitable for querying by primary key and range. 2. The non-clustered index stores index key values ​​and pointers to data rows, and is suitable for non-primary key column queries.

MySQL: Simple Concepts for Easy Learning MySQL: Simple Concepts for Easy Learning Apr 10, 2025 am 09:29 AM

MySQL is an open source relational database management system. 1) Create database and tables: Use the CREATEDATABASE and CREATETABLE commands. 2) Basic operations: INSERT, UPDATE, DELETE and SELECT. 3) Advanced operations: JOIN, subquery and transaction processing. 4) Debugging skills: Check syntax, data type and permissions. 5) Optimization suggestions: Use indexes, avoid SELECT* and use transactions.

The relationship between mysql user and database The relationship between mysql user and database Apr 08, 2025 pm 07:15 PM

In MySQL database, the relationship between the user and the database is defined by permissions and tables. The user has a username and password to access the database. Permissions are granted through the GRANT command, while the table is created by the CREATE TABLE command. To establish a relationship between a user and a database, you need to create a database, create a user, and then grant permissions.

Explain different types of MySQL indexes (B-Tree, Hash, Full-text, Spatial). Explain different types of MySQL indexes (B-Tree, Hash, Full-text, Spatial). Apr 02, 2025 pm 07:05 PM

MySQL supports four index types: B-Tree, Hash, Full-text, and Spatial. 1.B-Tree index is suitable for equal value search, range query and sorting. 2. Hash index is suitable for equal value searches, but does not support range query and sorting. 3. Full-text index is used for full-text search and is suitable for processing large amounts of text data. 4. Spatial index is used for geospatial data query and is suitable for GIS applications.

Can mysql and mariadb coexist Can mysql and mariadb coexist Apr 08, 2025 pm 02:27 PM

MySQL and MariaDB can coexist, but need to be configured with caution. The key is to allocate different port numbers and data directories to each database, and adjust parameters such as memory allocation and cache size. Connection pooling, application configuration, and version differences also need to be considered and need to be carefully tested and planned to avoid pitfalls. Running two databases simultaneously can cause performance problems in situations where resources are limited.

See all articles