Detections
Analytics

SQLI-22-008200 - If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The DOD standard for authentication is DOD-approved PKI certificates.

Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires authorizing official (AO) approval.

In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission.

DBMS passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure SQL Server to encrypt authentication data for remote connections using DOD-approved cryptography.

Deploy encryption to the SQL Server Network Connections.

From the search bar, open SQL Server Configuration Manager by typing "SQL Server 2022 Configuration Manager" and pressing "ENTER".

Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on "Protocols for", where there is a placeholder for the SQL Server instance name, and click on "Properties".

In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then restart the SQL Server service.

For clustered instances install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manager.

1. Navigate to the certificate store where the FQDN certificate is stored, by typing "Manage computer certificates" in the search bar and pressing "ENTER".
2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window.
3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad.
4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\<instance>\\MSSQLServer\\SuperSocketNetLib\\Certificate.
5. If the SQL virtual server is currently on this node, failover to another node in the cluster, and then reboot the node where the registry change occurred.
6. Repeat this procedure on all the nodes. Configure SQL Server to encrypt authentication data for remote connections using DOD-approved cryptography.

Deploy encryption to the SQL Server Network Connections.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/U_MS_SQL_Server_2022_Y25M06_STIG.zip

Item Details

References: CAT|I, CCI|CCI-000197, Rule-ID|SV-271309r1109243_rule, STIG-ID|SQLI-22-008200, Vuln-ID|V-271309

Plugin: MS_SQLDB

Control ID: bae1c63c3d3c55b0c6f845b0799c78ec73d8c8bae0f735c12114b990d47098ac