Please start any new threads on our new
site at https://forums.sqlteam.com. We've got lots of great SQL Server
experts to answer whatever question you can come up with.
| Author |
Topic |
|
ehorn
Master Smack Fu Yak Hacker
1632 Posts |
 Posted - 2003-12-05 : 14:32:29
|
| I understand the security risks associated with exposing this xp but the usefullness of the command has me searching for an alternate method of allowing exposure to this proc while limiting/minimizing the risks.My first thought/question is would it be possible to assign xp_cmdshell permissions to a domain user account, then control what access to commands/folders/etc.. the user has access to via xp_cmdshell through the domain account?Any thoughts, practices would be greatly appreciated.. |
|
|
tkizer
Almighty SQL Goddess
38200 Posts |
Posted - 2003-12-05 : 14:35:18
|
| When you grant permissions to xp_cmdshell, that user has the same permissions as the account that the MSSQLSERVER service uses. This is most likely a local admin account.Tara |
 |
|
|
ehorn
Master Smack Fu Yak Hacker
1632 Posts |
Posted - 2003-12-05 : 15:40:00
|
| That is correct Tara, but I was thinking more along the lines of users who are not members of the sysadmin role running in the context of the SQLAgentCmdExec user account. |
|
|
|
tkizer
Almighty SQL Goddess
38200 Posts |
Posted - 2003-12-05 : 15:43:35
|
| Yes I realize that. It still will use the same permissions as the account that the MSSQLSERVER service uses.From BOL (from xp_cmdshell page):When you grant execute permissions to users, the users can execute any operating-system command at the Microsoft Windows NT® command shell that the account running Microsoft SQL Server™ has the needed privileges to execute.Tara |
|
|
|
scottpt
Posting Yak Master
186 Posts |
Posted - 2003-12-09 : 14:39:48
|
| What version? |
|
|
|
denisemc
Starting Member
26 Posts |
Posted - 2003-12-09 : 14:52:38
|
quote:
I was thinking more along the lines of users who are not members of the sysadmin role running in the context of the SQLAgentCmdExec user account.
I think SQLAgentCmdExec was a 7.0 thing. In 2K, you need to configure a proxy account for non-sysadmin users; from BOL:"When the user is not a member of the sysadmin group, xp_cmdshell will impersonate the SQL Server Agent proxy account, which is specified using xp_sqlagent_proxy_account. If the proxy account is not available, xp_cmdshell will fail." |
|
|
|
|
|
|
xp_cmdshell and permissions