TMA-MSSQL2022-2.13
Ensure the 'sa' Login Account is set to 'Disabled'
AltaNivel 1Automatizadamssql
Descripción
The sa account is a widely known and often widely used SQL Server account with sysadmin privileges. This is the original login created during installation and always has the principal_id=1 and sid=0x01. Enforcing this control reduces the probability of an attacker executing brute force attacks against a well-known principal.
Cómo se verifica
Método de auditoría: Consulta SQL
sql_query
sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; SELECT COUNT(*) FROM sys.server_principals WHERE sid = 0x01 AND is_disabled = 0;"- Salida esperada
0
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Execute the following T-SQL query: USE [master] GO DECLARE @tsql nvarchar(max) SET @tsql = 'ALTER LOGIN ' + SUSER_NAME(0x01) + ' DISABLE' EXEC (@tsql) GO
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- loggingmssqlsqlserver-2022
- Referencia
- CIS Microsoft SQL Server 2022 Benchmark v1.3.0 - 2.13 Ensure the 'sa' Login Account is set to 'Disabled'
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target mssql