Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0'

中级别 1自动化mssql

说明

The cross db ownership chaining option controls cross-database ownership chaining across all databases at the instance (or server) level. When enabled, this option allows a member of the db_owner role in a database to gain access to objects owned by a login in any other database, causing an unnecessary information disclosure. When required, cross-database ownership chaining should only be enabled for the specific databases requiring it instead of at the instance level for all databases by using the ALTER DATABASE<database_name>SET DB_CHAINING ON command. This database option may not be changed on the master, model, or tempdb system databases.

检查方式

审计方法: SQL 查询

sql_query

sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; SELECT CASE WHEN CAST(value AS int) = 0 AND CAST(value_in_use AS int) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM sys.configurations WHERE name = 'cross db ownership chaining';"

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

For AWS RDS Instances, please refer to the documentation for using Parameter Groups here: Working with parameter groups Run the following T-SQL command: EXECUTE sp_configure 'cross db ownership chaining', 0; RECONFIGURE; GO

属性

操作系统: 任意
标签: mssqlsqlserver-2022
参考: CIS Microsoft SQL Server 2022 Benchmark v1.3.0 - 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0'

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target mssql