Search sqlserver-dba.com

Follow sqlserver-dba.com

*Use the Comments section for questions

SQLServer-DBA.com Links

Find Weak passwords in SQL Server

12 June,2013 by Tom Collins

How can I find weak passwords in SQL Server logins?

Identifying weak passwords is an important part of Security Risk Analysis. Setting up a procedure to check for weak passwords should be part of the DBA daily healthcheck. It is straightforward to check for a weak password using a SELECT statement and the PWDCOMPARE function.

The PWDCOMPARE function accepts 2 arguments – the first is the text password and the varbin value of the SQL password hash

--find SQL login with blank passwords
select name,type_desc,create_date from sys.sql_logins where pwdcompare('', password_hash) = 1

--find SQL login with password same as name

select name,type_desc,create_date from sys.sql_logins where pwdcompare(name, password_hash) = 1

Read More on auditing SQL Server

Powershell sql server security audit - SQL Server DBA

How to create a SQL Server Security Audit - SQL Server DBA

Database Server Security Audit Process - SQL Server DBA

Find who made a database security change - SQL Server DBA

Author: Tom Collins (http://www.sqlserver-dba.com)

Share:

Posted by Tom Collins at 9:19 AM in Security Management | Permalink | Comments (2) | TrackBack (0)

Searches: information security risk, risk and security, risk management, risk security management, security management, weak password, weak passwords

As a security auditor, this is great information. Thanks because I think the basics of INFO SEC 101 are still the most important. You would be amazed at the number of default user accounts and associated IDs I run into. ADMIN ADMIN anyone. I would also like to add that provisioning and hardening is without question one of the most important measures for helping ensure the safety and security of critical information systems. After all, how good is anyone’s security posture if no initiatives have been undertaken for locking down and hardening firewalls, routers, servers, applications and other critical hardware and software solutions? As a security auditor, I find that many companies – regardless of industry or size – have little or no documentation for such practices, which is not good at all, and it’s time this changes. After all, there are untold numbers of free and very cost-effective hardening checklists online that can be easily download and used immediately.

Posted by: Jack Brickman | Dec 12, 2014 11:42:58 AM

Hi Jack,Agreed ,certification process is critical. Also,creating procedures for regular checks on security violations.
http://www.sqlserver-dba.com/2010/07/sql-server-security-policy-1.html

Posted by: Jack Vamvas | Dec 14, 2014 10:56:13 PM

Verify your Comment

Previewing your Comment

Posted by: |

This is only a preview. Your comment has not yet been posted.

Your comment could not be posted. Error type:

Your comment has been posted. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.