Security issues with database servers & the Internet

[priele]

What would be the implications, particularly the security implications, of having a server with SQL Server on it sitting out on the Internet?

 

[chiph]

Aside from the licensing costs, you'd want to look very carefully at the default users that are defined to it (like "sa" for MS-SQL Server). By default, sa has no password, which is obviously a big hole. There are a few other users created at installation (sorry, don't recall their names), and you'd want to make sure they have strong passwords as well.

There may also be a way to restrict a user so that he can only log in from the local IP address range -- Although I may be getting this last confused with another database vendor....

Chip H.