4 ms·

I'm genuinely curious - What are the reasons for exposing an SQL server directly to the internet? Obviously there's a bunch of people who have mis-configured a

by malux85 12y ago

I'm genuinely curious - What are the reasons for exposing an SQL server directly to the internet? Obviously there's a bunch of people who have mis-configured and have accidently exposed their systems, but are there real-world reasons to expose a SQL server directly to the net? I would think most people who are sharing datasets would do so with some sort of API - and there'd need to be room for rate limiting / blacklisting IPs and so on. I would never expose a SQL server directly to the net, and I'm really curious if there are reasons to do so?

callumjones 12y ago
In the case of hosted SQL solutions (Heroku, AWS, Azure) it makes sense if you don't want to have to place your servers inside the same network/provider or if you want developers to have access to the DB directly from their machines. But regardless you should be locking down access to the SQL host by network ranges, but I'm not sure if all providers have that ability.
Someone1234 12y ago
In a word "laziness." It is just easier to log in and manage an SQL server if it is available on the internet. I know I'm certainly guilty of doing so for short periods when I'm off-site with no VPN and need to manage a server. Some sysadmins just get lazy and leave it available on the internet with strong passwords 24/7, just so once in a blue moon they can log in and manage it. Or are doing some kind of site to site data migration and are tired of the VPN connection dropping. I've done a site to site SQL migration across two Azure zones because doing it the "right" way was too complicated/time consuming/expensive. However once the data was copied across I changed the End Point config to protect the SQL server again. I won't make excuses, it is just laziness/expedient. But that is human nature for you...
- ams6110 12y ago
  It really is simple to use ssh to tunnel a port; that is always how I access SQL Server remotely. Laziness indeed.
  - WatchDog 12y ago
    If they are using MS SQL, chances are SSH isn't even in their toolset.
  - Someone1234 12y ago
    You use SSH port tunnelling on a Windows Server to access MS SQL? I'd be surprised if that was "simple." But go ahead and explain it.
    - glenk 12y ago
      We do here where I work. We're running Bitvise SSH server on Server R2/2012 and you can use bitvise tunnelier or putty as the client(maybe others, just have used those two myself) and then connect via management studio once the SSH tunnel is connected. We also require both key and password auth. We also do RDP over the SSH connection as you can't remote to those machines directly.
      - Someone1234 12y ago
        I'm not sure if $200 in third party software counts as easy. In particular when you could be using RRAS instead, which is built in.
        glenk 12y ago
        Bitvise server is $100, but now you want both simple and free? It's well worth the $100 IMO as it's pretty easy to setup and manage accounts and keys. You only said "simple" before, and I consider it pretty simple to get up and running. I didn't pay for it, but $100 one time is pretty negligible for what we use it for.
- fat0wl 12y ago
  i did this with an AWS system because we never configured security keys properly -- basically got tired of whitelisting 1 IP at a time for development tasks, especially since I had issues accessing from behind corp firewalls. client told me they got a big IO bill from AWS & i was deathly afraid it was from bots just probing the SQL server ports. thankfully it wasn't (it was from s3, they are a media heavy site with many users) but it reminded me not to just leave things accessible via internet, cuz even though it seems irrational to think someone would just probe you over & over, the fact is you have to pay an AWS bill, & attackers are just operating from their laptop.... if the amplification is right they can cost you looooots of $$ with no cost to them.
jessaustin 12y ago
Obviously there's a bunch of people... I guess 700k is a bunch... https://www.shodan.io/search?query=port%3A%221434%22 https://www.shodan.io/search?query=port%3A%221434%22 Since we can't expect those jokers to fix anything, it's probably best to drop traffic on that port.

by malux85 12y ago

callumjones 12y ago

In the case of hosted SQL solutions (Heroku, AWS, Azure) it makes sense if you don't want to have to place your servers inside the same network/provider or if you want developers to have access to the DB directly from their machines. But regardless you should be locking down access to the SQL host by network ranges, but I'm not sure if all providers have that ability.

Someone1234 12y ago

In a word "laziness." It is just easier to log in and manage an SQL server if it is available on the internet. I know I'm certainly guilty of doing so for short periods when I'm off-site with no VPN and need to manage a server. Some sysadmins just get lazy and leave it available on the internet with strong passwords 24/7, just so once in a blue moon they can log in and manage it. Or are doing some kind of site to site data migration and are tired of the VPN connection dropping. I've done a site to site SQL migration across two Azure zones because doing it the "right" way was too complicated/time consuming/expensive. However once the data was copied across I changed the End Point config to protect the SQL server again. I won't make excuses, it is just laziness/expedient. But that is human nature for you...

ams6110 12y ago
It really is simple to use ssh to tunnel a port; that is always how I access SQL Server remotely. Laziness indeed.
- WatchDog 12y ago
  If they are using MS SQL, chances are SSH isn't even in their toolset.
- Someone1234 12y ago
  You use SSH port tunnelling on a Windows Server to access MS SQL? I'd be surprised if that was "simple." But go ahead and explain it.
  - glenk 12y ago
    We do here where I work. We're running Bitvise SSH server on Server R2/2012 and you can use bitvise tunnelier or putty as the client(maybe others, just have used those two myself) and then connect via management studio once the SSH tunnel is connected. We also require both key and password auth. We also do RDP over the SSH connection as you can't remote to those machines directly.
    - Someone1234 12y ago
      I'm not sure if $200 in third party software counts as easy. In particular when you could be using RRAS instead, which is built in.
      - glenk 12y ago
        Bitvise server is $100, but now you want both simple and free? It's well worth the $100 IMO as it's pretty easy to setup and manage accounts and keys. You only said "simple" before, and I consider it pretty simple to get up and running. I didn't pay for it, but $100 one time is pretty negligible for what we use it for.
fat0wl 12y ago
i did this with an AWS system because we never configured security keys properly -- basically got tired of whitelisting 1 IP at a time for development tasks, especially since I had issues accessing from behind corp firewalls. client told me they got a big IO bill from AWS & i was deathly afraid it was from bots just probing the SQL server ports. thankfully it wasn't (it was from s3, they are a media heavy site with many users) but it reminded me not to just leave things accessible via internet, cuz even though it seems irrational to think someone would just probe you over & over, the fact is you have to pay an AWS bill, & attackers are just operating from their laptop.... if the amplification is right they can cost you looooots of $$ with no cost to them.

jessaustin 12y ago

Obviously there's a bunch of people... I guess 700k is a bunch... https://www.shodan.io/search?query=port%3A%221434%22 https://www.shodan.io/search?query=port%3A%221434%22 Since we can't expect those jokers to fix anything, it's probably best to drop traffic on that port.