STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.

DISA Rule

SV-213966r667311_rule

Vulnerability Number

V-213966

Group Title

SRG-APP-000172-DB-000075

Rule Version

SQL6-D0-008200

Severity

CAT I

CCI(s)

• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Weight

10

Fix Recommendation

Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography.

Deploy encryption to the SQL Server Network Connections.

From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER".

Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties".

In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service.

For clustered instances install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manger.

1. Navigate to the certificate store where the FQDN certificate is stored, by typing "certlm.msc" and pressing "ENTER".

2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window.

3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad.

4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate

5. If the SQL virtual server is currently on this node, failover to another node in your cluster, and then reboot the node where the registry change occurred.

6. Repeat this procedure on all the nodes.

Check Contents

From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER".

Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols, where there is a placeholder for the SQL Server instance name, and click on “Properties”.

On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding.

On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab.

If it is not a DoD approved certificate, or if no certificate is listed, this is a finding.

For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager.

1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "ENTER".

2. In the left side of the window, expand the "Personal" folder, and click "Certificates"

3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint.

4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate".

5. This check needs to be run on each node of the cluster.

If any nodes have a certificate in use by SQL that is not issued or approved by DoD, this is a finding.

Vulnerability Number

V-213966

Documentable

False

Rule Version

SQL6-D0-008200

Severity Override Guidance

From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER".

Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols, where there is a placeholder for the SQL Server instance name, and click on “Properties”.

On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding.

On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab.

If it is not a DoD approved certificate, or if no certificate is listed, this is a finding.

For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager.

1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "ENTER".

2. In the left side of the window, expand the "Personal" folder, and click "Certificates"

3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint.

4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate".

5. This check needs to be run on each node of the cluster.

If any nodes have a certificate in use by SQL that is not issued or approved by DoD, this is a finding.

Check Content Reference

M

Target Key

3993

Comments