STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

Access to linked servers must be disabled or restricted, unless specifically required and approved.

DISA Rule

SV-213960r617437_rule

Vulnerability Number

V-213960

Group Title

SRG-APP-000141-DB-000093

Rule Version

SQL6-D0-007500

Severity

CAT II

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

Disable use of or remove any linked servers that are not authorized.

To remove a linked server and all associated logins run the following:

sp_dropserver 'LinkedServerName', 'droplogins';

To remove a login from a linked server run the following:

EXEC sp_droplinkedsrvlogin 'LoginName', NULL;

Check Contents

A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.

To obtain a list of linked servers, execute the following command:

EXEC sp_linkedservers;

Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding.

Run the following to get a linked server login mapping:

SELECT s.name, p.principal_id, l.remote_name
FROM sys.servers s
JOIN sys.linked_logins l ON s.server_id = l.server_id
LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id
WHERE s.is_linked = 1

Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.

Vulnerability Number

V-213960

Documentable

False

Rule Version

SQL6-D0-007500

Severity Override Guidance

A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.

To obtain a list of linked servers, execute the following command:

EXEC sp_linkedservers;

Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding.

Run the following to get a linked server login mapping:

SELECT s.name, p.principal_id, l.remote_name
FROM sys.servers s
JOIN sys.linked_logins l ON s.server_id = l.server_id
LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id
WHERE s.is_linked = 1

Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.

Check Content Reference

M

Target Key

3993

Comments