Tài liệu hạn chế xem trước, để xem đầy đủ mời bạn chọn Tải xuống
1
/ 50 trang
THÔNG TIN TÀI LIỆU
Thông tin cơ bản
Định dạng
Số trang
50
Dung lượng
1,26 MB
Nội dung
CHAPTER 17 • AUTOMATING ADMINISTRATION
670
FIGURE 17.13
You can change any of
the aspects of your
plan by bringing up its
properties in Enterprise
Manager.
To view the history of the plan, right-click it and select Maintenance Plan History.
This will display everything the plan has accomplished recently.
2627ch17.qxd 8/22/00 11:00 AM Page 670
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
671
As you can see, maintenance plans are very helpful in keeping your database run-
ning smoothly and efficiently. Now you don’t have to worry about staying late to run
maintenance jobs or which task should be completed first. The plan does it all for you.
However, there are even more automation features that you can take advantage of; for
instance, SQL Mail can e-mail you the results of a query. Let’s see how that works.
Working with SQL Mail
Earlier in this chapter, you learned that by configuring a mail profile and creating an
alert, you can have SQLServer mail you when an error occurs on your server. How-
ever, there will be cases when you need to see more than just an error message. For
example, if there is a query that you run on a regular basis, it may be helpful to create
a job that can run the query and e-mail you the result set. You may want to send SQL
Server an ad hoc query, but you don’t have the tools on the machine on which you
are working currently, so you need to e-mail the query to SQL Server. All of these
things can be accomplished with SQL Mail.
SQL Mail turns the MSSQLServer service into a MAPI (Messaging Application Pro-
gramming Interface) client that is capable of receiving and sending e-mail. This client
can receive queries via e-mail, process those queries, and return the result set back to
the sender of the message. SQL Mail also enables you to send e-mail from a stored
procedure. To make this work, you need to follow the steps from an early section of
this chapter under “Configuring Mail Support.” Once that is done, follow the steps
below:
1. Open Enterprise Manager by selecting it from the SQLServer 2000 group under
Programs on the Start menu.
2. Expand your server, then Support Services.
3. Right-click SQL Mail and select Properties.
4. Select a Profile Name (in this case, it should be SQLService) and click the Test
button.
5. Check the Autostart SQL Mail when SQLServer Starts checkbox so that the SQL
Mail service will be started when the server starts up.
USING THE DATABASE MAINTENANCE PLAN WIZARD
Admninistering SQL
Server
PART
IV
2627ch17.qxd 8/22/00 11:00 AM Page 671
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 17 • AUTOMATING ADMINISTRATION
672
6. Click OK to apply the changes.
Now that SQL Mail is configured, you are ready to use it. To make SQLServer read
the mail that it has received, you need to run the sp_processmail system stored proce-
dure. This procedure will read the mail in the inbox and process any queries it finds,
after which it will return the mail to the originator of the message. Let’s give that a try
here (in this example, we assume that you have only one machine, so you will be log-
ging in as yourself with the SQLService user account):
1. Open your mail program and create a new message.
2. In the To box, enter the e-mail address of the SQLServer service.
3. Type whatever you like in the subject of the message.
4. In the text of the message, type the following query:
USE Pubs
SELECT * FROM AUTHORS
5. Click the Send button to send the message to SQL Server.
6. If you have a single machine, you may need to log off and log back on as the
SQLService account to receive the mail.
7. After you have received the mail in the SQLService inbox, open Query Analyzer,
and enter and execute the following code:
sp_processmail
8. Once that is complete, check the e-mail box from which you sent the original
query; you should see the result set from the query you e-mailed.
This tool can prove very powerful when necessary, so consider using it whenever
you have a client that requires reports at regular intervals. You could consider using
this for automated billing of clientele or status reports on the state of the databases.
Whatever the case may be, this feature will definitely help you in your quest for
automation.
2627ch17.qxd 8/22/00 11:00 AM Page 672
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
673
Summary
That was a lot of ground to cover, but it is going to save you a lot of time and effort in
server administration and reporting. There were a number of topics discussed in this
chapter, including:
Automation basics: In this section, you learned that there are three main
components to automation: operators, jobs, and alerts. Operators are the indi-
viduals who are notified when there is a problem that needs attention, and
they can be notified via e-mail, pager, or Net Send messages. Jobs are a series of
tasks and schedules that can be automated to activate at any time, and they
can be comprised of Transact-SQL code, command executive code, or scripting
language code.
Configuring mail support: To configure mail support, you learned that
you need a mailbox somewhere (either with an ISP or on a MAPI-compliant
server such as Exchange). Next you need to install Outlook, and then log in as
the SQLService account and create a mail profile. Once that is done, you need
to right-click the SQLServerAgent in Enterprise Manager under Management
and configure the agent to use the newly created profile. Once that is done,
you will be able to send e-mail to operators.
Creating operators: In this section, you learned how to create operators
and configure them to receive e-mail, pager, or Net Send messages. You can also
configure them to be available only at certain times of the day by setting their
availability.
Creating jobs: In this section, you learned how to create local server jobs
and then multiserver jobs.
• Local server jobs run only on the local system, and they can be configured
to run any type of code at any time. They can be configured to inform an
operator when they complete, when they succeed, or when they fail.
• Multiserver jobs are created on a central machine (called the MSX or mas-
ter) and then distributed to multiple remote machines (called targets),
where they are executed. These jobs come in very handy in a multiple-
server environment.
Creating alerts: Alerts are used to notify an operator when an error has
occurred. Not all errors will fire an event, though—only those that are written
to the Windows NT event log and have an alert configured will fire an alert
that notifies someone. In this section, you learned how to create alerts that are
based on the standard error messages that come with SQLServer as well as how
to create your own custom error messages that can be used for any purpose.
WORKING WITH SQL MAIL
Admninistering SQL
Server
PART
IV
2627ch17.qxd 8/22/00 11:00 AM Page 673
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 17 • AUTOMATING ADMINISTRATION
674
You then learned how to create and use performance alerts to stop problems
before they start.
Using the Database Maintenance Plan Wizard: Many tasks need to be
performed on your server to keep it running smoothly and efficiently. You need
to back up databases and transaction logs, reorganize index and data pages
inside the database files, and check for database integrity regularly. Rather than
trying to remember to do all of that and the order to do it in, use the Database
Maintenance Plan Wizard to automate these processes for you.
Working with SQL Mail: Finally you learned that if you want to e-mail a
query to SQLServer and get a result set back, or have SQLServer e-mail you
from a procedure other than an alert, you need to configure SQL Mail.
Now that you know how to automate the tasks on your system, you need to know
how to secure your system as well. Let’s peer into the depths of SQLServer security in
our next chapter.
2627ch17.qxd 8/22/00 11:00 AM Page 674
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 18
Security and SQL
Server 2000
FEATURING:
Understanding Security Modes 676
SQL Server Logins 680
Fixed Server Roles 688
Creating Database User Accounts 691
Understanding Permissions 693
Database Roles 698
N-Tier Security 710
Monitoring SQLServer Logins with
SQL Profiler 712
Creating a Security Plan 717
Summary 719
2627ch18.qxd 8/22/00 11:08 AM Page 675
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
P
rotecting information—guarding access to an organization’s data—is much
like protecting a physical structure. For example, imagine that you own a
business and the building that houses it. You do not want the general pub-
lic to gain access to your building—only your employees should have
access. However, you also need restrictions on the areas to which your employees
have access. Because only accountants should have access to the accounting depart-
ment, and almost no one should have access to your office, you must put various
security systems in place.
Protecting SQLServer (your “building”) holds true to this concept: No one gets in
unless they’re granted access, and once users are inside, various security systems keep
prying eyes out of sensitive areas. In this chapter, we will discuss the methods used to
apply security to SQL Server.
Understanding Security Modes
To continue our analogy, for your employees to gain access to the building, they will
need some sort of key, whether a metal key or an electronic access card. For your users
to gain access to SQL Server, you will need to give them a key as well. The type of key
you give them largely depends on the type of lock—authentication mode—you use.
An authentication mode is how SQLServer processes usernames and passwords.
There are two such modes in SQLServer 2000: Windows NT/2000 Authentication
mode and Mixed mode.
Windows NT/2000 Authentication Mode
With this mode, a user can simply sit down at their computer, log on to the Win-
dows NT/2000 domain, and gain access to SQL Server. The process is a little bit dif-
ferent between Windows NT 4 and Windows 2000, though; here is how it works on
Windows NT 4:
1. The user logs on to a Windows NT domain; the username and password are ver-
ified by Windows NT.
2. The user then opens a trusted connection (see Figure 18.1) with SQL Server. This
means that SQLServer trusts Windows NT/2000 to verify the user’s password.
3. SQLServer will then try to match the username or group membership to an
entry in the Syslogins table.
4. Because this is a trusted connection, SQLServer does not need to verify the user
password; that is, SQLServer trusts Windows NT/2000 to perform that function.
2627ch18.qxd 8/22/00 11:08 AM Page 676
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
677
FIGURE 18.1
Using a trusted
connection, SQL
Server trusts
Windows NT/2000
to verify user
passwords.
In a domain that uses Windows 2000, the users can connect to SQLServer using the
Kerberos security protocol. Although an in-depth discussion of Kerberos is beyond the
scope of this book, here is a brief overview of how this security protocol works:
1. When the user logs on, Windows 2000 performs a DNS lookup to locate a Key
Distribution Center (KDC).
2. Once the KDC is located, the user’s machine logs on to the domain.
3. After the user’s machine successfully logs on, the KDC issues a special security
token called a Ticket Granting Ticket (TGT) to the user.
4. To access the SQL Server, the user’s machine presents the TGT to the SQL Server;
if the ticket is accepted, the user is allowed access.
It may be easier to think of Kerberos security as a trip to the carnival. If you have
ever been to a carnival and seen all of the rides, you probably know that to get on one
of those rides, you need a ticket. To get that ticket, you must buy them from a counter
at the gate of the carnival. Once you have those tickets in hand, you can give them to
the ride operator and enjoy yourself on the ride.
In Kerberos security, the services, such as SQL Server, would be considered the rides
that you want to access, but to use the services, you need to present a ticket. The
ticket you present is the Ticket Granting Ticket that you received from the KDC at
logon time, so you can think of the KDC as the counter at the carnival that sells the
tickets. Once you have this TGT, you can access any services to which you have been
given permission, including SQLServer 2000.
The main advantage to Windows NT/2000 Authentication mode is that users do not
have to remember multiple usernames and passwords. That will vastly increase secu-
rity, because there is less danger of users writing their passwords down and storing
SQL Server
Windows
Trusted connection
to SQLpassword
verified by Windows
Password
UNDERSTANDING SECURITY MODES
Administering SQL
Server
PART
IV
2627ch18.qxd 8/22/00 11:08 AM Page 677
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 18 • SECURITY AND SQLSERVER 2000
678
them in an unsafe place (such as a sticky note on their monitor). This mode also gives
you tighter reign over security, because you can apply Windows NT/2000 password
policies, which will do such things as expire passwords, require a minimum length for
passwords, keep a history of passwords, and so on.
One of the disadvantages is that only users with the proper net-library (Named
Pipes, TCP/IP, or Multi-Protocol) can open a trusted connection to SQL Server. This
means that someone like a Novell client running the IPX net-library cannot use Win-
dows NT/2000 Authentication mode. If it turns out that you have such clients, you
will need to implement Mixed mode.
Mixed Mode
Mixed mode allows both Windows NT/2000 Authentication and SQLServer Authenti-
cation. In SQLServer Authentication:
1. The user logs on to their network, Windows NT/2000 or otherwise.
2. The user opens a nontrusted (see Figure 18.2) connection to SQLServer using a
username and password other than those used to gain network access. It is
called a nontrusted connection because SQLServer does not trust the operating
system to verify the user’s password.
3. SQLServer matches the username and password entered by the user to an entry
in the Syslogins table
FIGURE 18.2
With a nontrusted
connection, SQL
Server verifies user
passwords itself.
SQL Server
Windows
Trusted connection
to SQLpassword
verified by Windows
Password
2627ch18.qxd 8/22/00 11:08 AM Page 678
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
679
The primary advantage here is that anyone can gain access to SQLServer using
Mixed mode, regardless of the net-library used. This means that Mac users, Novell
users, Banyan Vines users, and the like can gain access. You could also consider this to
be a second layer of security, because if someone hacks into the network in Mixed
mode, it does not mean that they have automatically hacked into SQLServer at the
same time.
Ironically, multiple passwords can be a problem as well as an advantage. Consider
that users will have one username and password to log on to the network and a com-
pletely separate username and password to gain access to SQL Server. When users
have multiple sets of credentials, they tend to write them down and thus breach the
security system you have worked so hard to set up.
Setting the Authentication Mode
As an administrator, you will probably set the authentication mode no more than
once, at installation time. The only other time you might need to change the authen-
tication mode would be if changes were made to your network. For example, if you
had set your SQLServer to Windows NT/2000 Authentication mode and needed to
include Macintosh clients, you would need to change to Mixed mode.
It is interesting to note that although most things in SQLServer can be done
through either Enterprise Manager or Transact-SQL (T-SQL), setting the authentica-
tion mode is one of the rare things that can be done only through Enterprise Man-
ager. The next series of steps takes you through setting the authentication mode.
1. Open Enterprise Manager by selecting it from the SQLServer 2000 group under
programs on the Start menu, then right-click your server and select Properties.
2. Select the Security tab.
3. In the Authentication section, select SQLServer and Windows NT/2000. This
will set you to Mixed mode for the rest of the exercises.
UNDERSTANDING SECURITY MODES
Administering SQL
Server
PART
IV
2627ch18.qxd 8/22/00 11:08 AM Page 679
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
[...]... sysadmin role have the authority to perform any task in SQLServer Be careful whom you assign to this role, because people who are unfamiliar with SQLServer can accidentally create serious problems This role is only for the database administrators (DBAs) Serveradmin: These users can set serverwide configuration options, such as how much memory SQLServer can use or how much information to send over the... on www.verypdf.com to remove this watermark 8/22/00 11:08 AM Page 681 SQLSERVER LOGINS (such as filing cabinets) inside In the same way, a SQLServer key—a login—will give your users access to SQLServer as a whole, but not to the resources (such as databases) inside If you are a member of the sysadmin or securityadmin fixed server roles (discussed later in this chapter), you will be able to create... them to a server role This will limit them to being just normal users TI P Builtin\Administrators is automatically made a member of the sysadmin server role, giving SQLServer administrative rights to all of your Windows NT/2000 administrators Because not all of your Windows NT/2000 administrators should have these rights, you may want to create a SQLAdmins group in Windows, add your SQLServer administrators... PA R T IV Administering SQLServer 2627ch18.qxd 2627ch18.qxd 682 8/22/00 11:08 AM Page 682 CHAPTER 18 • SECURITY AND SQL SERVER 2000 8 Click OK 9 In the Confirm New Password textbox, type password 10 Click OK and notice your new Standard type login in the contents pane Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 8/22/00 11:08 AM Page 683 SQLSERVER LOGINS 11 Choose... accountants require access You could create a separate login for each of them, which would require you to manage 50 SQLServer logins On the other hand, if you create a Windows NT/2000 group for these 50 accountants and map your SQLServer login to this group, you will have only 1 SQLServer login to manage The first step in creating Windows NT/2000 logins is to create user accounts in the operating... 8/22/00 11:08 AM Page 680 CHAPTER 18 • SECURITY AND SQL SERVER 2000 4 Click OK to close the Properties dialog box Now that you have set the proper authentication mode, it is time to move forward and give your users a key to your building with SQLServer logins NOTE On Windows 9x you will not be able to change the authentication type from the default SQLServer Logins Once you have decided what type of... Programs on the Start menu, expand Security, and select Server Roles 2 Double-click System Administrators to open the Sysadmin Server Role Properties Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 689 PA R T IV Administering SQLServer 2627ch18.qxd 2627ch18.qxd 690 8/22/00 11:08 AM Page 690 CHAPTER 18 • SECURITY AND SQL SERVER 2000 3 Click Add, select MorrisL, and click OK... be able to use them If you try, SQLServer will ignore you and use your Windows NT/2000 credentials instead 1 Open Enterprise Manager and expand your server by clicking the + sign next to the icon named after your server 2 Expand Security and click the Logins icon 3 Choose Action ➢ New Login 4 In the Name box, type SmithB 5 In the Authentication section, select SQLServer Authentication 6 In the Password... purchase PDF Split-Merge on www.verypdf.com to remove this watermark IV Administering SQLServer TI P 2627ch18.qxd 692 8/22/00 11:08 AM Page 692 CHAPTER 18 • SECURITY AND SQL SERVER 2000 8 In the Login Name box, leave Sqldomain\Accounting and click OK to create the user account 9 Click OK You now have a new user named Sqldomain\Accounting 10 Repeat steps 5 through 9 for Sales, ThompsonA, MorrisL, GibsonH,... files and other such resources inside Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 693 PA R T IV Administering SQLServer 2627ch18.qxd 2627ch18.qxd 694 8/22/00 11:08 AM Page 694 CHAPTER 18 • SECURITY AND SQL SERVER 2000 In SQL Server, this constraint would be akin to granting the contractors statement permissions Statement permissions have nothing to do with the actual . connection (see Figure 18.1) with SQL Server. This
means that SQL Server trusts Windows NT/2000 to verify the user’s password.
3. SQL Server will then try to match. with SQL Server as well as how
to create your own custom error messages that can be used for any purpose.
WORKING WITH SQL MAIL
Admninistering SQL
Server
PART
IV
2627ch17.qxd