STIGQter STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

DISA Rule

SV-213929r617437_rule

Vulnerability Number

V-213929

Group Title

SRG-APP-000001-DB-000031

Rule Version

SQL6-D0-003600

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users.

CREATE TRIGGER SQL_STIG_Connection_Limit
ON ALL SERVER WITH EXECUTE AS 'sa' --Make sure to use the renamed SA account here.
FOR LOGON
AS
BEGIN
IF (SELECT COUNT(1)
FROM sys.dm_exec_sessions
WHERE is_user_process = 1
And original_login_name = ORIGINAL_LOGIN()
) > 1000 --Organizationally defined number
BEGIN
PRINT 'The login [' + ORIGINAL_LOGIN() + '] has exceeded the concurrent session limit.'
ROLLBACK;
END
END;

Reference: https://msdn.microsoft.com/en-us/library/ms189799.aspx

Check Contents

Review the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users.

If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding.

Otherwise, determine if a logon trigger exists:

In SQL Server Management Studio's Object Explorer tree:
Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers

OR

Run the query:
SELECT name FROM master.sys.server_triggers;

If no triggers are listed, this is a finding.

If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding.

Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding.

Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.

Vulnerability Number

V-213929

Documentable

False

Rule Version

SQL6-D0-003600

Severity Override Guidance

Review the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users.

If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding.

Otherwise, determine if a logon trigger exists:

In SQL Server Management Studio's Object Explorer tree:
Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers

OR

Run the query:
SELECT name FROM master.sys.server_triggers;

If no triggers are listed, this is a finding.

If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding.

Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding.

Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.

Check Content Reference

M

Target Key

3993

Comments