Step 5. Files and Directories

In addition to securing operating system files using ACLs, harden NTFS permissions to restrict access to SQL Server program files, data files, and log files together with system level tools. Additionally, the SQL Server service account should have access only to what it needs.

In this step, you:

• Verify permissions on SQL Server install directories .

• Verify Everyone group does not have permissions to SQL Server files .

• Secure setup log files .

• Secure or remove tools, utilities, and SDKs .

Verify Permissions on SQL Server Install Directories

Verify the permissions listed in Table 18.4 to the account the SQL Server service is running under. The location specified in parentheses is the default install location. This may vary for your installation.

Table 18.4: NTFS Permissions for SQL Server Service Account

Location	Permissions for SQL Service Account
Install location(\Program Files\Microsoft SQL Server\MSSQL\)	Read and Execute List Folder Contents Read
Database file directory (.mdf, .ndf, .ldf files)(\Program Files\Microsoft SQL Server\MSSQL\Data)	Full Control
Error log file directory(\Program Files\Microsoft SQL Server\MSSQL\LOG)	Full Control
Backup file directory(\Program Files\Microsoft SQL Server\MSSQL\Backup)	Full Control
Job temporary file output directory(\Program Files\Microsoft SQL Server\MSSQL\Jobs)	Full Control

If you use Enterprise Manager to set the SQL Server service account, it gives the account Full Control permissions on the SQL Server installation directory and all subfolders (\Program Files\Microsoft SQL Server\MSSQL\*).

By removing write permissions on this folder and all subfolders, and then selectively granting full control to the data, error log, backup and job file directories, the new account cannot overwrite SQL Server binaries.

Verify Everyone Group Does Not Have Permissions for SQL Server Files

The Everyone group should not have access to the SQL Server file location (by default, \Program Files\Microsoft SQL Server\MSSQL) This is achieved by verifying the Everyone group is not granted access via an ACL and giving explicit full control to only the SQL Service account, the Administrators group, and the local system account.

Secure Setup Log Files

After installing SQL Server 2000 Service Pack 1 or 2, the system administrator or service account password may be left in the SQL installation directory. Use the Killpwd.exe utility to remove instances of passwords from the log files.

For information about obtaining and using this utility, see Microsoft Knowledge Base article 263968, "FIX: Service Pack Installation May Save Standard Security Password in File."

Secure or Remove Tools, Utilities, and SDKs

SDKs and resource kits should not be installed on a production database server. Remove them if they are. In addition:

• Ensure that access to powerful system tools and utilities, such as those contained in the \Program Files directory, is restricted.

• Debugging tools should not be available on the database server. If production debugging is necessary, you should create a CD that contains the necessary debugging tools.

Additional Considerations

To further improve your database server security:

• Remove unused applications that may be installed on the server . If you have applications on the server that you do not use, then remove them.

• Encrypt your data files using Encrypting File System (EFS) . You can use EFS to protect your data files. If your data files are stolen, encrypted files are more difficult to read. The use of EFS for SQL Server data files is supported.

  When using EFS, you should be aware of the following:

  • Encrypt the database files (.MDF) and not the log files (.LDF). If you encrypt the log files, then SQL Server cannot open your database.

  • Encrypt at the file level, not the directory level. While it is often a best practice to encrypt at the directory level when using EFS so that when new files are added they are automatically encrypted, you should encrypt your SQL Server data files at the file level only. This avoids encrypting your log files.

  • Evaluate the performance cost. The use of EFS incurs a performance penalty. Test EFS before using it in your scenario to determine the actual performance impact. Usually the performance penalty is negligible because the data file is decrypted by SQL Server when the process starts.

To implement EFS, right-click the directory, click Advanced , and then click Encrypt contents to be secure . For more information about EFS, see the following resources:

• Microsoft Knowledge Base article 23050, "How To: Encrypt Data Using EFS in Windows 2000."

• TechNet article, "Step-by-Step Guide to Encrypting File System (EFS)" at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/deploy/walkthru/efsguide.asp .