is sql server on workstation a security risk

We have 5 sql server 2000 server boxes. We also have several people who have
sql server 2000 on their workstations. I work on keeping the servers secure
but I have no idea what people do on their workstations. I'm wondering if
there is a security risk to having an unsecure sql server workstation. If
someone can get on one of the workstations (say sa doesn't have a password)
does that it make it any easier to possibly get to one of the servers?
Thanks,
--
Dan D.Dan,
SQL Server on a workstation still is rights constrained. So it is all about
the rights the person has either through his own login or through other
logins to which he knows the passwords.
If a person is running a desktop SQL Server with the same service account as
your production SQL Server, then you have a security problem. (But the real
problem may be the he has that information.)
If a person is running his desktop SQL Server as himself _and_ he has no
extraordinary rights to the production SQL Server, then there should be no
added exposure.
Getting into the workstation as 'sa' does not map to 'sa' on another machine
through a linked server unless the passwords are identical. (I believe that
is the exposure.) But I trust that your production SQL Server does not have
a blank or easily guessed password.
However, if a person has rights to data he could insert it into his desktop
database, which might be a security breach. Of course, he could insert it
into an Access MDB, and Excel spreadsheet, and so forth.
It is important to control rights carefully _and_ to have clear policies on
what is allowed and not allowed with the company data and for whom it is
allowed.
RLF
"Dan D." <DanD@.discussions.microsoft.com> wrote in message
news:97601E73-7DF0-4B12-9CA8-2ED2158A0456@.microsoft.com...
> We have 5 sql server 2000 server boxes. We also have several people who
> have
> sql server 2000 on their workstations. I work on keeping the servers
> secure
> but I have no idea what people do on their workstations. I'm wondering if
> there is a security risk to having an unsecure sql server workstation. If
> someone can get on one of the workstations (say sa doesn't have a
> password)
> does that it make it any easier to possibly get to one of the servers?
> Thanks,
> --
> Dan D.|||That's what I thought. I just wanted to be sure that I wasn't missing
something. Thanks Russell.
--
Dan D.
"Russell Fields" wrote:

> Dan,
> SQL Server on a workstation still is rights constrained. So it is all abo
ut
> the rights the person has either through his own login or through other
> logins to which he knows the passwords.
> If a person is running a desktop SQL Server with the same service account
as
> your production SQL Server, then you have a security problem. (But the re
al
> problem may be the he has that information.)
> If a person is running his desktop SQL Server as himself _and_ he has no
> extraordinary rights to the production SQL Server, then there should be no
> added exposure.
> Getting into the workstation as 'sa' does not map to 'sa' on another machi
ne
> through a linked server unless the passwords are identical. (I believe tha
t
> is the exposure.) But I trust that your production SQL Server does not ha
ve
> a blank or easily guessed password.
> However, if a person has rights to data he could insert it into his deskto
p
> database, which might be a security breach. Of course, he could insert it
> into an Access MDB, and Excel spreadsheet, and so forth.
> It is important to control rights carefully _and_ to have clear policies o
n
> what is allowed and not allowed with the company data and for whom it is
> allowed.
> RLF
> "Dan D." <DanD@.discussions.microsoft.com> wrote in message
> news:97601E73-7DF0-4B12-9CA8-2ED2158A0456@.microsoft.com...
>
>

Is SQL 7.0 obsolete yet?

Does anyone know what Microsoft plans are for SQL 7.0.
When will they stop selling it?
When will the Service Packs stop?
When will security upgrades stop?
When will they stop supporting it?
I need to justify the upgrade to SQL 2000 and need facts to support my
argument.
Thanks
http://support.microsoft.com/default.aspx?scid=fh;[ln];lifecycle
David Portas
SQL Server MVP
|||On Mon, 13 Sep 2004 06:41:15 -0700, David Portas
<REMOVE_BEFORE_REPLYING_dportas@.acm.org> wrote:

>http://support.microsoft.com/default.aspx?scid=fh;[ln];lifecycle
>
Product Name - General Availability Date - Mainstream Support
Retired - Extended Support Retired
SQL Server 7.0 01-Mar-1999 31-Dec-2005 Review note 3 below
SQL Server 7.0 EE 01-Mar-1999 31-Dec-2005 Review note3 below
3. Extended support will end December 31, 2010 or two years after the
next version of this product is launched, whichever length of time is
longer.

is my SQL2000 32-bit or 64-bit?

Hi, how can I tell if my SQL2000 server is 32-bit or 64-
bit? I am trying to install the latest security patch and
I noticed that there are two different versions (one for
32-bit and one for 64-bit). thanks
christos
ps. I am running SQL2000 SP3 on Win2k ServerChristos,
You should be able to tell by running a SELECT @.@.version against your SQL
Server.
On 32-bit, you will see the following:
Microsoft SQL Server 2000 - 8.00.818 (Intel X86)
May 31 2003 16:08:15
......
On 64-bit, the architecture should be Intel IA-64
Microsoft SQL Server 2000 - 8.00.818 (Intel IA-64)
......
--
Dinesh.
SQL Server FAQ at
http://www.tkdinesh.com
"Christos Kritikos" <christos@.alphadetail.com> wrote in message
news:036901c35617$3a1691a0$a601280a@.phx.gbl...
> Hi, how can I tell if my SQL2000 server is 32-bit or 64-
> bit? I am trying to install the latest security patch and
> I noticed that there are two different versions (one for
> 32-bit and one for 64-bit). thanks
> christos
> ps. I am running SQL2000 SP3 on Win2k Server|||When you run SELECT @.@.VERSION, there will be a string like Intel IA-64 in
the result for 64-bit hardware.
And as Vyas points out, you'd probably remember buying 64-bit hardware (or
just ask your finance department). :-)
"Christos Kritikos" <christos@.alphadetail.com> wrote in message
news:036901c35617$3a1691a0$a601280a@.phx.gbl...
> Hi, how can I tell if my SQL2000 server is 32-bit or 64-
> bit? I am trying to install the latest security patch and
> I noticed that there are two different versions (one for
> 32-bit and one for 64-bit). thanks
> christos
> ps. I am running SQL2000 SP3 on Win2k Server