SQL Server Windows Authentication (MIX Mode Authenticatio)

SSPI (Security Support Provider Interface)

SSPI allows an application to use various security models available on a computer or network without changing the interface to the security system.

What is Kerberos?

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. A free implementation of this protocol is available from the Massachusetts Institute of Technology. Kerberos is available in many commercial products as well.

The Internet is an insecure place. Many of the protocols used in the Internet do not provide any security. Tools to "sniff" passwords off of the network are in common use by malicious hackers. Thus, applications which send an unencrypted password over the network are extremely vulnerable. Worse yet, other client/server applications rely on the client program to be "honest" about the identity of the user who is using it. Other applications rely on the client to restrict its activities to those which it is allowed to do, with no other enforcement by the server.

Some sites attempt to use firewalls to solve their network security problems. Unfortunately, firewalls assume that "the bad guys" are on the outside, which is often a very bad assumption. Most of the really damaging incidents of computer crime are carried out by insiders. Firewalls also have a significant disadvantage in that they restrict how your users can use the Internet. (After all, firewalls are simply a less extreme example of the dictum that there is nothing more secure then a computer which is not connected to the network --- and powered off!) In many places, these restrictions are simply unrealistic and unacceptable.

Kerberos was created by MIT as a solution to these network security problems. The Kerberos protocol uses strong cryptography so that a client can prove its identity to a server (and vice versa) across an insecure network connection. After a client and server has used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business.

Kerberos is freely available from MIT, under copyright permissions very similar those used for the BSD operating system and the X Window System. MIT provides Kerberos in source form so that anyone who wishes to use it may look over the code for themselves and assure themselves that the code is trustworthy. In addition, for those who prefer to rely on a professionally supported product, Kerberos is available as a product from many different vendors.

In summary, Kerberos is a solution to your network security problems. It provides the tools of authentication and strong cryptography over the network to help you secure your information systems across your entire enterprise. We hope you find Kerberos as useful as it has been to us. At MIT, Kerberos has been invaluable to our Information/Technology architecture.

NTLM (NT LAN Manager)

NTLM is a suite of authentication and session security protocols used in various Microsoft network protocol implementations and supported by the NTLM Security Support Provider ("NTLMSSP"). Originally used for authentication and negotiation of secure DCE/RPC, NTLM is also used throughout Microsoft's systems as an integrated single sign-on mechanism. It is probably best recognized as part of the "Integrated Windows Authentication" stack for HTTP authentication; however, it is also used in Microsoft implementations of SMTP, POP3, IMAP (all part of Exchange), CIFS/SMB, Telnet, SIP, and possibly others.

The NTLM Security Support Provider provides authentication, integrity, and confidentiality services within the Window Security Support Provider Interface (SSPI) framework. SSPI specifies a core set of security functionality that is implemented by supporting providers; the NTLMSSP is such a provider. The SSPI specifies, and the NTLMSSP implements, the following core operations:

1. Authentication -- NTLM provides a challenge-response authentication mechanism, in which clients are able to prove their identities without sending a password to the server.

2. Signing -- The NTLMSSP provides a means of applying a digital "signature" to a message. This ensures that the signed message has not been modified (either accidentally or intentionally) and that that signing party has knowledge of a shared secret. NTLM implements a symmetric signature scheme (Message Authentication Code, or MAC); that is, a valid signature can only be generated and verified by parties that possess the common shared key.

3. Sealing -- The NTLMSSP implements a symmetric-key encryption mechanism, which provides message confidentiality. In the case of NTLM, sealing also implies signing (a signed message is not necessarily sealed, but all sealed messages are signed).

NTLM has been largely supplanted by Kerberos as the authentication protocol of choice for domain-based scenarios. However, Kerberos is a trusted-third-party scheme, and cannot be used in situations where no trusted third party exists; for example, member servers (servers that are not part of a domain), local accounts, and authentication to resources in an untrusted domain. In such scenarios, NTLM continues to be the primary authentication mechanism (and likely will be for a long time).

How to make sure that you are using Kerberos authentication

SQL Server 2005 supports Kerberos authentication indirectly through the Windows Security Support Provider Interface (SSPI) when you are using Windows integrated authentication instead of SQL authentication. However, SQL Server will only use Kerberos authentication under certain circumstances when SQL Server can use SSPI to negotiate the authentication protocol to use. If SQL Server cannot use Kerberos authentication, Windows will use NTLM authentication. For security reasons, we recommend that you use Kerberos authentication instead of NTLM authentication. Administrators and users should know how to make sure that they are using Kerberos authentication for remote connections.

To use Kerberos authentication, you must make sure that all the following conditions are true:

• Both the server and the client computers must be members of the same Windows domain or members of trusted domains.

• The server's service principal name (SPN) must be registered in the Active Directory service.

• The instance of SQL Server 2005 must enable the TCP/IP protocol.

• The client must connect to the instance of SQL Server 2005 by using the TCP/IP protocol. For example, you can put the TCP/IP protocol at the top of the client's protocol order. Or you can add the prefix "tcp:" in the connection string to specify that the connection will use the TCP/IP protocol.

After you connected to an instance of SQL Server 2005, run the following Transact-SQL statement in SQL Server Management Studio:

select auth_scheme from sys.dm_exec_connections where session_id=@@spid 

If SQL Server is using Kerberos authentication, a character string that is listed as "KERBEROS" appears in the auth_scheme column in the result window.

The Basics of Hyper-Threading: What is it?

The Basics of Hyper-Threading: What is it?

Modern processors can only handle one instruction from one program at any given point in time. Each instruction that is sent to the processor is called a thread. What I mean is that even though it looks like you're multitasking with your computer (running more then one program at a time) you're really not.

The CPU will divide it's time and power evenly between all the programs by switching back and forth. This little charade of switching back and forth tricks the end user (you and me) and gives us the sense of multitasking.

Dual CPU based systems can work on two independent threads of information from the software but each processor is still limited at working on one thread at any given moment though. The software must be able to dish out two separate pieces of information like Win2000 or Adobe Photoshop for a dual processor system to be really used, by the way.

So what's new with the Pentium4 3.06GHz processor?

The Pentium 4 3.06 GHz processor is the first Intel desktop processor in history that can process two independent threads at the same time. With a SMT (Simultaneous Multi-Thread) enabled OS like Win2000/XP, Linux, etc. the operation system will identify the P4 3.06 GHz CPU as two logical processors that share the single physical CPU's resources. A physical processor can be thought of as the chip itself, whereas a logical processor is what the computer sees - with Hyper-Threading enabled the computer can have one physical processor installed in the motherboard, but the computer will see two logical processors, and treat the system as if there were actually two processors.

Even when we put a regular processor under 100% load, we're never fully utilizing 100% of the execution units. With a HyperThreading enabled processor those spare execution units can used towards computing other things now.

In the last HyperThreading enabled processor, both threads are simultaneously being computed, and the CPU's efficiency has increased from around 50% to over 90%!

The last example is of dual HyperThreading enabled processors which can work on four independent threads at the same time. Again CPU efficiency is around 90% (and in this case there would be four logical processors, and two physical processors).

While this all sounds very good in the above example, it's also about the most ideal situation ever - so let's get back to the real world.

If you were to run two pieces of software that are completely different, and use different execution units, your system performance should get a noticeable boost however!

The operating system will also play a key role in how well HyperThreading works. The OS assigns operations to the independent logical processors, and so if it's determined that one of the logical CPU's is to remain idle, the OS will issue a HALT command to the free logical processor thus devoting all of the other system resources to the working logical processor.

As you can see, HyperThreading has the potential to significantly boost system performance under certain circumstances. From Xeon/HyperThreading test results over at Anandtech you get a feel that HyperThreading Technology is still in it's infancy in terms of real added value across the board. As it stands now, the performance that HT brings to the table is still very application specific. Some programs will notice a performance boost, and in some cases, other programs will see a performance hit with HT enabled.

As more and more software is written specifically for HyperThreading, the performance differences will grow larger. It didn't take long for software developers to adopt SSE2, hopefully they'll jump on the HyperThreading bandwagon quickly and the consumer will see the benefit of this this ingenuous technology quickly

Networking Terms

Networking Terms

VIP

A virtual IP address (VIP or VIPA) is an IP address that is not connected to a specific computer or network interface card (NIC) on a computer. Incoming packets are sent to the VIP address, but all packets travel through real network interfaces.

VIPs are mostly used for connection redundancy; a VIP address may still be available if a computer or NIC fails because an alternative computer or NIC replies to connections

We can also use VIP for load balancing and Automatic Failover

Port Number

Definition: A port number represents an endpoint or "channel" for network communications. Port numbers allow different applications on the same computer to utilize network resources without interfering with each other.

Port numbers most commonly appear in network programming, particularly socket programming. Sometimes, though, port numbers are made visible to the casual user. For example, some Web sites a person visits on the Internet use a URL like the following:

In this example, the number 8080 refers to the port number used by the Web browser to connect to the Web server. Normally, a Web site uses port number 80 and this number need not be included with the URL (although it can be).

In IP networking, port numbers can theoretically range from 0 to 65535. Most popular network applications, though, use port numbers at the low end of the range (such as 80 for HTTP). The port number is included as a field within the header of each IP packet.

Note: The term port also refers to several other aspects of network technology. A port can refer to a physical connection point for peripheral devices such as serial, parallel, and USB ports. The term port also refers to certain Ethernet connection points, such as those on a hub, switch, or router.

You can find the list of port number at below URL

http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

UDP (User Datagram Protocol)

Definition: UDP is a lightweight transport built on top of IP. UDP squeezes extra performance from IP by not implementing some of the features a more heavyweight protocol like TCP offers. Specifically, UDP allows individual packets to be dropped (with no retries) and UDP packets to be received in a different order than they were sent.

UDP is often used in videoconferencing applications or games where optimal performance is preferred over guaranteed message delivery. UDP is one of the oldest network protocols, introduced in 1980 in RFC document 768.

DNS Server (Domain Name System)

Definition: The DNS translates Internet domain and host names to IP Addresses. DNS automatically converts the names we type in our Web browser address bar to the IP addresses of Web servers hosting those sites.

DNS implements a distributed database to store this name and address information for all public hosts on the Internet. DNS assumes IP addresses do not change (are statically assigned rather than dynamically assigned).

The DNS database resides on a hierarchy of special database servers. When clients like Web browsers issue requests involving Internet host names, a piece of software called the DNS resolver (usually built into the network operating system) first contacts a DNS server to determine the server's IP address. If the DNS server does not contain the needed mapping, it will in turn forward the request to a different DNS server at the next higher level in the hierarchy. After potentially several forwarding and delegation messages are sent within the DNS hierarchy, the IP address for the given host eventually arrives at the resolver, that in turn completes the request over Internet Protocol.

DNS additionally includes support for caching requests and for redundancy. Most network operating systems support configuration of primary, secondary, and tertiary DNS servers, each of which can service initial requests from clients. ISPs maintain their own DNS servers and use DHCP to automatically configure clients, relieving most home users of the burden of DNS configuration.

Also Known As: Domain Name System, Domain Name Service, Domain Name Server

Dynamic Host Configuration Protocol Definition: DHCP allows a computer to join an IP-based network without having a pre-configured IP address. DHCP is a protocol that assigns unique IP addresses to devices, then releases and renews these addresses as devices leave and re-join the network.

Internet Service Providers (ISPs) usually use DHCP to allow customers to join the Internet with minimum effort. Likewise, home network equipment like broadband routers offers DHCP support for added convenience in joining home computers to the LAN.

DHCP environments require a DHCP server set up with the appropriate configuration parameters for the given network. Key DHCP parameters include the range or "pool" of available IP addresses, the correct subnet masks, plus gateway and name server addresses.

Devices running DHCP client software can then automatically retrieve these settings from DHCP servers as needed. Using DHCP on a network means system administrators do not need to configure these parameters individually for each client device.

NetBIOS Definition: NetBIOS is a software protocol for providing computer communication services on local networks. Microsoft Windows uses NetBIOS on Ethernet or Token Ring networks.

Software applications on a NetBIOS network locate each other via their NetBIOS names. A NetBIOS name is up to 16 characters long and in Windows, separate from the computer name. Applications on other computers access NetBIOS names over UDP port 137. It provides name resolution services for NetBIOS.

Two applications start a NetBIOS session when one (the client) sends a command to "Call" another (the server) over TCP port 139 on a remote computer. Both sides issue "Send" and "Receive" commands to deliver messages in both directions. The "Hang-Up" command terminates a NetBIOS session.

NetBIOS also supports connectionless communications via UDP datagrams. Applications listen on UDP port 138 to receive NetBIOS datagrams.

NetBIOS and NetBEUI are separate but related technologies. NetBEUI extends NetBIOS with additional networking capabilities.

Also Known As: Network Basic Input/Output System

WINS Definition: The Windows Internet Naming Service (WINS) supports name resolution, the automated conversion of computer names to network addresses, for Windows networks. Specifically, WINS converts NETBIOS names to IP addresses on a LAN or WAN.

Like DNS, the Windows Internet Naming Service employs a distributed client/server system to maintain the mapping of computer names to addresses. Windows clients can be configured to use primary and secondary WINS servers that dynamically update name/address pairings as computers join and leave the network. The dynamic behavior of WINS means that it also supports networks using

Can not open user default database; login failed

Troubleshooting Authentication Issues

Problem:

Can not open user default database; login failed

Scenario:

I have windows DBA group which has default database DB1 and has SYSADMIN rights on SQL Server, by some reasons the DB1 database is corrupted and user is unable to login.

Solution:

Step 1:

Connect SQL Server using SQLCMD/OSQL as below and give the default database name as MASTER

sqlcmd -E -d master

Step 2: Now issue ALTER LOGIN statement and change the default database

Use SP_DefaultDB procedure to change the default database

sp_defaultdb (SQL Server 2000)

Changes the default database for a login

Syntax

EXEC sp_defaultdb 'Victoria', 'pubs'

(SQL Server 2005)

ALTER LOGIN LOGINNAME WITH DEFAULT_DATABASE = MASTER

Index Covering

What is Index Covering?

Index covering means to add a non-clustered index on every column  which are used in Query. Easy solution to improve query performance

 

Scenario: Speed Up a Query for a Table with a Clustered Index

Consider a very typical scenario: you have a table EmployeeSalary table with a clustered index on Employee_ID column. You need to speed up a select query quickly:

SELECT Salary_DATE, SUM(AMOUNT) FROM EmployeeSalary GROUP BY Salary_DATE

 

The query's execution plan is quite simple: the database engine scans the whole clustered index, and then it sorts the intermediate result set to satisfy the GROUP BY clause.

 

Can a non-clustered index speed up the query? Definitely. Just create a non-clustered index that contains all the columns used in the query:

CREATE  INDEX sal_amt ON dbo.EmployeeDetail(Salary_DATE, AMOUNT)

 

Re-execute the query it will run faster than the previous query.  If you, look at the execution plan: the query accesses only the index salary_amt; it doesn't touch the table at all. In fact, there is no need to access the table because all the columns necessary to satisfy the query are already stored in the index. This is called index covering.

How to change SQL Server Instance Name?

First collect the output of the current instance configuration. You can get the instance name stored in the SQL Server metadata.

Make sure you have backup of all the database if you are changing the production server instance name.
[sourcecode language="sql"]
sp_helpserver
select @@servername
[/sourcecode]
You can change the instance name using below query.
Default Instance
[sourcecode language="sql"]
sp_dropserver 'old_name'
go
sp_addserver 'new_name','local'
go
[/sourcecode]

Named Instance
[sourcecode language="sql"]
sp_dropserver 'Server Name\old_Instance_name'
go
sp_addserver 'ServerName\New Instance Name','local'
go
[/sourcecode]

Verify sql server instance configuration by running below queries
[sourcecode language="sql"]
sp_helpserver
select @@servername
[/sourcecode]

Restart the SQL Server Services.
[sourcecode language="sql"]
net stop MSSQLServer
net start MSSQLServer
[/sourcecode]

Exception Handling using Try-Catch in SQL Server 2005

/*
Error Handling using Try Catch Block
*/

CREATE PROCEDURE usp_GetErrorInfo
AS
BEGIN
SET NOCOUNT ON
SELECT
ERROR_NUMBER() AS ErrorNumber,
ERROR_SEVERITY() AS ErrorSeverity,
ERROR_STATE() AS ErrorState,
ERROR_PROCEDURE() AS ErrorProcedure,
ERROR_LINE() AS ErrorLine,
ERROR_MESSAGE() AS ErrorMessage
END
GO

/*
TRY - CATCH in user defined stored procedure
*/

ALTER PROCEDURE TEST
AS
BEGIN
BEGIN TRY
-- Generate divide-by-zero error.
SELECT 1/0;
END TRY
BEGIN CATCH
-- Execute error retrieval routine.
EXECUTE usp_GetErrorInfo;
END CATCH
END
GO

EXECUTE TEST
GO;

Replication Agents

Replication Agents

Replication uses a number of standalone programs, called agents, to carry out the tasks associated with tracking changes and distributing data. By default, replication agents run as jobs scheduled under SQL Server Agent, and SQL Server Agent must be running for the jobs to run. Replication agents can also be run from the command line and by applications that use Replication Management Objects (RMO). Replication agents can be administered from SQL Server Replication Monitor and SQL Server Management Studio.

Snapshot Agent The Snapshot Agent is typically used with all types of replication. It prepares schema and initial data files of published tables and other objects, stores the snapshot files, and records information about synchronization in the distribution database. The Snapshot Agent runs at the Distributor.

Replication in SQL Server 2005

Replication in SQL Server 2005

Replication is a set of technologies for copying and distributing data and database objects from one database to another and then synchronizing between databases to maintain consistency. Using replication, you can distribute data to different locations and to remote or mobile users over local and wide area networks, dial-up connections, wireless connections, and the Internet.

Replication Types

• Snapshot Replication


• Transactional Replication


• Merge Replication