DB, APP, and NAS. Following a Server Security Trail?

Question

DB, APP, and NAS. Following a Server Security Trail?

Brandie Tarvin

SSC Guru

Points: 173108
More actions
April 17, 2015 at 12:42 pm

#398344

We have a database server and an application server. On the db server is a sql job calling up an SSIS package that resides in the file store of the app server. Both servers use the same windows account for the SQL Server Agent Service.
We have a file that is being accessed from a NAS share by the SSIS package.
When I activate the job on the db server to run the package on the app server (which touches the file), does the file think it's being accessed from the app server or the db server?
The security account itself is not in question because we know it's the same one on both servers. The question is figuring out which server (for firewall / whitelisting purposes) is controlling the file on the NAS shares.
Thoughts? Or links.
Brandie Tarvin, MCITP Database AdministratorLiveJournal Blog: http://brandietarvin.livejournal.com/[/url]On LinkedIn!, Google+, and Twitter.Freelance Writer: ShadowrunLatchkeys: Nevermore, Latchkeys: The Bootleg War, and Latchkeys: Roscoes in the Night are now available on Nook and Kindle.

Viewing 3 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply

Eirikur Eiriksson SSC Guru Points: 182948 More actions · Answer 1

Brandie Tarvin (4/17/2015)
We have a database server and an application server. On the db server is a sql job calling up an SSIS package that resides in the file store of the app server. Both servers use the same windows account for the SQL Server Agent Service.
We have a file that is being accessed from a NAS share by the SSIS package.
When I activate the job on the db server to run the package on the app server (which touches the file), does the file think it's being accessed from the app server or the db server?
The security account itself is not in question because we know it's the same one on both servers. The question is figuring out which server (for firewall / whitelisting purposes) is controlling the file on the NAS shares.
Thoughts? Or links.

If I understand this correctly it would be the db_server's credentials.

😎

+--[db_server]--+ +--[app_server]-------+

| | | |

| +--[ssis]---+ | | +--[file system]-+ |

| | package | | | | | |

| | execution-------[db server credentials]-------->Package file | |

| +----|------+ | Read access to SSIS | | | |

| | | Package file | +----------------+ |

+------|--------+ +---------------------+

|

| +---[nas]---+

| | |

'-------------[db server credentials]----->Files |

Read access to data | |

files. | |

+-----------+

Brandie Tarvin SSC Guru Points: 173108 More actions · Answer 2

Thanks, Eirikur.

Brandie Tarvin, MCITP Database AdministratorLiveJournal Blog: http://brandietarvin.livejournal.com/[/url]On LinkedIn!, Google+, and Twitter.Freelance Writer: ShadowrunLatchkeys: Nevermore, Latchkeys: The Bootleg War, and Latchkeys: Roscoes in the Night are now available on Nook and Kindle.