Security in SQL Server on Linux Microsoft Engineering Town Hall

On April 20, 2017 10:00-11:00 AM Pacific Time (UTC-7) Microsoft will host a Security in SQL Server on Linux Microsoft Engineering Town Hall


Here is what will be covered

Learn about recent developments and get answers to your questions at twice-monthly virtual town halls, where Microsoft connects you with the team behind SQL Server on Linux. Each session will begin with a new topic, but all questions about SQL on Linux are welcome. At this event, you’ll:

• Engage with—and ask questions of—the SQL Server on Linux engineering team.
• Learn about how SQL Server in Linux supports the same enterprise-grade security capabilities that customers rely on with SQL Server on Windows. Get an overview of how to secure SQL Server on Linux, with demos of popular scenarios.

You can register here: https://info.microsoft.com/sql-server-on-linux-town-hall-security-register.html

Changing the SQL Server port on Linux

Today, I decided to see how I can change the port SQL Server is listening on



To see what port SQL Server is listening on, you can use the netstat command, here is what the output looks like when I run netstat -tulpn | grep sqlservr

I used grep to limit the output to lines that contain sqlservr only

Next, to change the port that SQL Server is listening on to 3000, I ran the following command

sudo /opt/mssql/bin/mssql-conf set tcpport 3000

I restarted SQL Server bu running the command systemctl restart mssql-server

Then I ran  netstat -tulpn | grep sqlservr again and as you can see the output now has 3000 as the port number

Now I tried using sqlcmd, I ran the following sqlcmd -S localhost -U SA

I got an timeout error

Finally I ran the sqlcmd command again but I added port number 3000, like this
sqlcmd -S localhost,3000 -U SA

As you can see, this worked and I could connect to SQL Server listening on port 3000 when supplying that to the sqlcmd command

How do we reset SQL Server back to the default port?
To reset SQL Server back to use the default port, run the command below

/opt/mssql/bin/mssql-conf unset tcpport

Here is a screenshot of running netstat, resetting the port, restarting SQL Server and running netstat again

You want to learn a little more?

We used tulpn as options in our netstat command. So what do all these options do?

[-t] 

tcp

[-u] 

udp

[-l]

Show only listening sockets

[-p]

Show the PID (process identifier) and name of the program to which each socket belongs.

[-n] 

Show numerical addresses instead of trying to determine symbolic host, port or user names.

On a Linux system to get help for a command, use man, this will bring up the user manual for that command

So if you run man netstat, you will see the following (I only pasted 1 page here, there are more)

man netstat

--------------------------

NETSTAT(8)                 Linux Programmer's Manual                NETSTAT(8)

NAME

       netstat  - Print network connections, routing tables, interface statis‐

       tics, masquerade connections, and multicast memberships

SYNOPSIS

       netstat  [address_family_options]  [--tcp|-t]   [--udp|-u]   [--raw|-w]

       [--listening|-l]     [--all|-a]     [--numeric|-n]    [--numeric-hosts]

       [--numeric-ports]           [--numeric-users]           [--symbolic|-N]

       [--extend|-e[--extend|-e]]  [--timers|-o] [--program|-p] [--verbose|-v]

       [--continuous|-c]

       netstat              {--route|-r}              [address_family_options]

       [--extend|-e[--extend|-e]]         [--verbose|-v]        [--numeric|-n]

       [--numeric-hosts] [--numeric-ports] [--numeric-users] [--continuous|-c]

       netstat {--interfaces|-i} [--all|-a] [--extend|-e[--extend|-e]] [--ver‐

       bose|-v]  [--program|-p]  [--numeric|-n]  [--numeric-hosts] [--numeric-

       ports] [--numeric-users] [--continuous|-c]

       netstat      {--groups|-g}       [--numeric|-n]       [--numeric-hosts]

       [--numeric-ports] [--numeric-users] [--continuous|-c]

 Manual page netstat(8) line 1/348 15% (press h for help or q to quit)


To see all my SQL Server on Linux posts, click here: SQL Server on Linux

Installing SQL Server on Linux, connecting and running queries from Linux

I decided to play around with installing SQL Server vNext on Linux today. I decided to pick the Ubuntu distribution. I created a VM in VirtualBox and then installed Ubuntu 16.04.   After that was done, it was time to install SQL Server.

All this stuff on this page runs on Linux, there are no windows components, if you have just a Linux desktop/server, you are all set


Here are the steps


Import the public repository GPG keys:

curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -


Register the Microsoft SQL Server Ubuntu repository:

curl https://packages.microsoft.com/config/ubuntu/16.04/mssql-server.list | sudo tee /etc/apt/sources.list.d/mssql-server.list


Run the following commands to install SQL Server:

sudo apt-get update
sudo apt-get install -y mssql-server



After the package installation finishes, run the configuration script and follow the prompts.


sudo /opt/mssql/bin/sqlservr-setup


Once the configuration is done, verify that the service is running:

systemctl status mssql-server

I myself like to run ps and then grep for mssql

ps -ef | grep  mssql

Ok so SQL Server is installed. In order to be able to run queries against SQL Server, we need to install the SQL Server tools

Open a new terminal window

Import the public repository GPG keys:


curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -


Register the Microsoft Ubuntu repository:

curl https://packages.microsoft.com/config/ubuntu/16.04/prod.list | sudo tee /etc/apt/sources.list.d/msprod.list


Update the sources list and run the installation command:


sudo apt-get update 
sudo apt-get install mssql-tools


You will get a bunch of prompts, just follow it, say YES or y and you are set

Now let's run a command

Run this from a terminal window

sqlcmd -S localhost -U SA
Enter you password
Enter a simple query like SELECT @@version
Type GO, hit enter and voila, you should get results

Here is what it looks like

Here is also a video of the whole process, all of this was done in less than 5 minutes


Here is also a link to the official documentation

Install SQL Server: https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-ubuntu
Install the tools: https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-tools#ubuntu

Visual Studio Code

Now unless you want to spend the rest of your life in a command window, I suggest you install VS Code

Visit this page https://code.visualstudio.com/#alt-downloads

Now for me .deb didn't work, so I got the tarball (.tar.gz) and manually extracted it

Then I ran the Code application inside the VSCode-linux-x64 folder

The first thing we have to do is install the mssql extension

Click on View-->Extensions, type in mssql, click on the install button

Now open a new file and save it with a .sql extension

Click on View-->Command Palette

Type sqlman

Add the server localhost), db name, username (probably sa) and add the password, save this with a name so you will know what it is

Type some valid SQL, hit CTRL + SHIFT + E or right click and select execute query

You should see something like this

There you have it, SQL Server running on Ubuntu, VS Code running on Ubuntu returning data from the SQL Server instance


I did hit an issue with trying to run xp_readerrorlog, you can read about that here:
How to read the errorlog on SQL Server installed on Linux

If you want to install SQL Server on Docker on a Mac, take a look at Aaron Bertrand's post
VS Code on Mac meets SQL Server on Linux (in Docker)

To see all my SQL Server on Linux posts, click here: SQL Server on Linux

How to read the errorlog on SQL Server installed on Linux

I finally installed SQL Server on Linux, while I was messing around with some queries, I noticed the following command fails with an error

exec xp_readerrorlog

The error is

Started executing query at Line 1
Msg 22004, Level 16, State 1, Line 0 Failed to open loopback connection. Please see event log for more information.
Msg 22004, Level 16, State 1, Line 0 Error log location not found.
Total execution time: 00:01:01.34


So how do you then look at the log on Linux? I don't have SSMS installed on the host machine where the Linux Virtual Machine lives. SQLCMD gives the same error. I don't know if it even works from SSMS from a windows box.

Edit: so it looks like it works from SSMS

@DenisGobo SSMS reading SQL logs works. Also quick tested xp_readerrorlog 0, 1 - works fine as well.

— Andy Yun (@SQLBek) November 20, 2016

To answer this question, the errorlog is stored in this location  /var/opt/mssql/log. You need to be a superuser to access this location

So in my case, I can just execute the following from a terminal in Ubuntu

sudo cat /var/opt/mssql/log/errorlog

And it looks like this

There you have it, this is how you can look at the error log

To see all my SQL Server on Linux posts, click here: SQL Server on Linux