mister.magoo (4/8/2013)
patrickmcginnis59 10839 (4/8/2013)
opc.three (4/7/2013)
Jeff Moden (4/6/2013)
Shifting gears a bit, you've been stressing the auditing aspect of things. What type of system auditing do you currently have setup on your machines?
I do not know. That is not my area of responsibility and I am not privy to what is being done from an auditing standpoint. I am pretty sure that is actually by design. It reduces the possibility that any one person can defeat the system if everyone is forced to operate on the network as themselves and there are distinct separations of responsibility. I think all of this points to the concept of layering security within an environment.
Does anybody know how to fully deny sa enabling xp_cmdshell without leaving a trail? Obviously disabling the agent would be an undesireable option. Also I want to assume the rogue sa has complete knowlege of all aspects of SQL server, ie., security through obscurity is not what I'm asking here.
Can I log this somehow without the rogue sa discovering where the log is at and modifying it accordingly? I will look some also but I'm just wondering what the folks who don't want xp_cmdshell running do to ensure it doesn't get enabled without a clear audit trail as it sounds like some folks deny xp_cmdshell and I was wondering whats the bulletproof method of doing so.
What is there to say that you are not the "rogue sa" who is trying to find a way round already existing security? 😎
I could absolutely be that rogue sa as you say. However, if you examine the question, I'm NOT asking how to circumvent security, but how to implement it. In this case, your answer COULD indicate that you do not believe a rogue sa could be guarded against, ie., that the solution I'm asking for does not exist, that its impossible to completely track sa's use [edit: unauditable enabling] of xp_cmdshell.
If providing security information instructs the intruder and can only cost the victim, perhaps we're not truly discussing a securable system. Perhaps opc.three's posts have all been a moot point and Jeff is unqualifiably correct. Remember, I'm not asking for security through obscurity.