MS SQL

This chapter contains an example of a basic Fudo PAM configuration, to monitor MS SQL connections to a remote MS SQL database server.

In this scenario, the user connects to a MS SQL database using individual login and password using SQL Server Management Studio. When establishing the connection with the remote server, Fudo PAM substitutes the login and the password with the previously defined values: fudo/password (authorization modes are described in the User authorization modes section).

../../_images/quickstart_overview_mssql.png

Prerequisites

The following description assumes that the system has been already initiated. For more information on the initiation procedure refer to the System initiation topic.

Note

Make sure that the SQL Server has the SQL Server and Windows Authentication mode enabled.

../../_images/server_auth_mode.png

Configuration

../../_images/data_modeling1.png

Adding a server

Server is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.


  1. Select Management > Servers.
  2. Click Add and select Static server.
  1. Provide essential configuration parameters:
Parameter Value
General  
Name mssql_server
Description fail
Blocked fail
Protocol MS SQL (TDS)
Bind address Any
   
Permissions  
Granted users fail
   
Server addresses  
IP address 10.0.150.154
Port 1433
  1. Click Save.

Adding a user

User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.


  1. Select Management > Users.
  2. Click Add.
  3. Provide essential user information:
Parameter Value
General  
Login john_smith
Fudo domain fail
Blocked fail
Account validity Indefinite
Role user
Preferred language English
Safes fail
Full name John Smith
Email john@smith.com
Organization fail
Phone fail
AD Domain fail
LDAP Base fail
   
Permissions  
Granted users fail
   
Authentication  
Authentication failures fail
Enforce static password complexity fail
Type Password
Password john
Repeat password john
  1. Click Save.

Adding a listener

Listener determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.


  1. Select Management > Listeners.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
General  
Name MSSQL_proxy
Blocked fail
Protocol MS SQL (TDS)
   
Permissions  
Granted users fail
   
Connection  
Mode proxy
Local address 10.0.150.150
Port 1433
  1. Click Save.

Adding an account

Account defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.


  1. Select Management > Accounts.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
General  
Name admin_mssql_server
Blocked fail
Type regular
Session recording all
Notes fail
   
Data retention  
Override global retention settings fail
Delete session data after 61 days
   
Permissions  
Granted users fail
   
Server  
Server mssql_server
   
Credentials  
Domain fail
Login fudo
Replace secret with with password
Password password
Repeat password password
Password change policy Static, without restrictions
  1. Click Save.

Defining a safe

Safe directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.


  1. Select Management > Safes.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
General  
Name mssql_safe
Blocked fail
Notifications fail
Login reason fail
Require approval fail
Policies fail
Note access No access
   
Protocol functionality  
RDP fail
SSH fail
VNC fail
  1. Select Users tab.
  2. Click Add user.
  3. Find John and click ..
  4. Click OK.
  5. Select Accounts tab.
  6. Click Add account.
  7. Find the admin_mssql_server object and click ..
  8. Click OK.
  9. Click in the Listeners column.
  10. Find the MSSQL_proxy object and click ..
  11. Click OK.
  12. Click Save.

Establishing connection with a MS SQL database

  1. Start SQL Server Management Studio.
  2. Enter previously configured proxy address (10.0.150.150).
  3. From the Authentication drop-down list, select SQL Server Authentication.
  4. Enter user login and password.
  5. Click Connect.
../../_images/sql_management_studio.png ../../_images/mssql_connected.png

Viewing user session

  1. Open a web browser and go to the Fudo PAM administration page.
  2. Enter user login and password to log in to Fudo PAM administration panel.
  1. Select Management > Sessions.
  2. Find John Smith’s session and click i.

Note

Due to the fact that MS SQL Studio may create multiple connections for sending internal queries, the sessions, connected via the TDS layer protocol using MS SQL Studio are getting aggregated by Fudo PAM.


Fudo PAM follows an algorithm that verifies if there is an already connected session on a current node. If the algorithm identifies that the main connection objects (listener, account, server address (server), user, and safe) of the new session are correlating with already existing session, both sessions are aggregated into one.

If the main connection objects of the new session are not correlating with any of already existing sessions, a new session is created.


This makes multiple queries to be grouped within one session. Every query has a unique tag that allows filtering important connections with users’ queries in the Fudo PAM player.

../../_images/5-1-mssql-std-connect1.png

Related topics: