Quick Start Guide: Non-Domain Joined MS SQL Database Scanning (GUI)
Overview
This guide will walk through scanning a non-domain joined Microsoft SQL Database using CIS-CAT Pro Assessor v4. If the Database is domain joined, please see the this guide: Quick Start Guide: MSSQL Database Scanning w/ Integrated Security (GUI)
Requirements
Enable SQL Server and Windows Authentication mode
Use a SQL sysadmin account for the assessment (Minimum login permissions for SQL assessment )
Implementation Steps
Change Server Authentication Mode in SSM
In SQL Server Management Studio Object Explorer, right-click the server, and then click Properties.
On the Security page, under Server authentication, select the SQL Server and Windows Authentication mode, and then click OK.
In the SQL Server Management Studio dialog box, click OK to acknowledge the requirement to restart SQL Server.
In Object Explorer, right-click your server, and then click Restart. If SQL Server Agent is running, it must also be restarted.
Ā
2. For a local assessment, use the following JDBC string format (Using a SQL admin account):
jdbc:sqlserver://hostname;user=MyUserName;password=******;
For a remote assessment, use the following JDBC string format (Using a SQL admin account):
jdbc:sqlserver://CIS-SERVER:1433;databaseName=TestDB;user=db_user;password=db_pass;instanceName=TestInstance;
3. Run the assessment using the GUI or CLI. See this section of the documentation for Workflow steps
Troubleshooting Steps
If the scan is unsuccessful, check the SQL logs for a āLogin failed for user' message that matches the username in your JDBC string. Hereās a way to get SQL logs: https://docs.microsoft.com/en-us/sql/relational-databases/performance/view-the-sql-server-error-log-sql-server-management-studio?view=sql-server-ver15
See the this section of the documentation for more information on JDBC string structure:
https://ciscat-assessor.docs.cisecurity.org/en/latest/Configuration%20Guide/#database-assessment
Ā
Copyright Ā© 2022 Center for Internet SecurityĀ® Privacy Policy
Ā