Please start any new threads on our new
site at https://forums.sqlteam.com. We've got lots of great SQL Server
experts to answer whatever question you can come up with.
| Author |
Topic |
|
WJHamel
Aged Yak Warrior
651 Posts |
 Posted - 2013-11-18 : 09:17:41
|
| help?I need to be able to verify that SSMS recognizes ONLY system generated session identifiers.Where in the configuration of the DBMS can i see evidence of this setting, and / or change it if necessary?thanksjames |
|
|
James K
Master Smack Fu Yak Hacker
3873 Posts |
Posted - 2013-11-18 : 09:44:37
|
| I am not 100% clear on exactly what you are looking for, but try the is_user_process column in sys.dm_exec_sessions |
 |
|
|
WJHamel
Aged Yak Warrior
651 Posts |
Posted - 2013-11-18 : 09:51:04
|
| i'm tasked with verifying that our SQL servers are compliant with certain regulations. One of those regulations state "This requirement focuses on communications protection at the application session, versus network packet level. The intent of this control is to establish grounds for confidence at each end of a communications session in the ongoing identity of the other party and in the validity of the information being transmitted. Unique session IDs are the opposite of sequentially generated session IDs which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of said identifiers. Unique session IDs address man-in-the-middle attacks including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.The DBMS must only recognize only system generated session identifiers. If an attacker was able to generate a session with a non-system generated session identifier and have it be recognized by the system, the attacker could potentially gain access to the system without passing through access controls designed to limit database sessions to authorized users."So in a nutshell, THAT is what i'm looking for. |
|
|
|
WJHamel
Aged Yak Warrior
651 Posts |
Posted - 2013-11-18 : 10:16:54
|
| From what i can find, any value in that column which is greater than 50 would indicate a session id that is not system generated. So running a select for values greater than 50 should cover what i need, i think. |
|
|
|
|
|
|
System generated session identifiers