marrowyung
asked on
SQL server proxy
Dear all,
our company use SQL server proxy and another separate account to do a backup and put the file in another file directory.
any benefit to use SQL server proxy for this purpose ?
our company use SQL server proxy and another separate account to do a backup and put the file in another file directory.
any benefit to use SQL server proxy for this purpose ?
What do you mean with "SQL server proxy"?
ASKER
ste5an,
as I am on new job now and right now I am porking around everything and the DBA in US just told me that.
this is from him:
"create two domain accounts.
One called xxx
For now the xxx will need read/write rights to the \\yyy directory and subdirectories.
And another called
yyy
I will get back with you on the yyy rights.
we will want to create a proxy on this server and ultimately use that for restores on that taskAgent job.
So do what you can until we get the proxies complete.
"
this is what I got, and he also said:
"The restore job will use the proxy so that a service Account does not have to be linked to it."
so please tell me why he'd like to do it (he is a very experience US DBA), and as Brian said,
as I am on new job now and right now I am porking around everything and the DBA in US just told me that.
this is from him:
"create two domain accounts.
One called xxx
For now the xxx will need read/write rights to the \\yyy directory and subdirectories.
And another called
yyy
I will get back with you on the yyy rights.
we will want to create a proxy on this server and ultimately use that for restores on that taskAgent job.
So do what you can until we get the proxies complete.
"
this is what I got, and he also said:
"The restore job will use the proxy so that a service Account does not have to be linked to it."
so please tell me why he'd like to do it (he is a very experience US DBA), and as Brian said,
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
"Your second post sounds like you're talking about SQL Server Agent Proxy. "
after his second email then I also think it is SQL server agent proxy, any use of it and what if we don't use it ? what will be the problem ?
this one, http://sqlmag.com/blog/sql-server-dba-tip-credentials-and-proxies, is about create the account but any more complete document on how to manage it:
1) monitor the use of it
2) change it (i.e. setup account and path)
3) backup the proxy
after his second email then I also think it is SQL server agent proxy, any use of it and what if we don't use it ? what will be the problem ?
this one, http://sqlmag.com/blog/sql-server-dba-tip-credentials-and-proxies, is about create the account but any more complete document on how to manage it:
1) monitor the use of it
2) change it (i.e. setup account and path)
3) backup the proxy
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
excellent, but I just tried to learn something new.
ASKER
I read the article:
https://www.experts-exchange.com/questions/28723699/SQL-server-proxy.html
"Of course, assuming they did take over your job step and now have carte blanche with the Proxy you've given them… the idea is that they shouldn't be able to do very much at ALL with this proxy—because you explicitly created the proxy against a least-privilege account which can't do much more than what you created it to do "
so the actually permission is controlled by the "Active to the following subsystems:" item in the list ? or the permission of the account setup in the security node?
again, just want to see how the permission is handle by using proxy and what the logic behind this.
https://www.experts-exchange.com/questions/28723699/SQL-server-proxy.html
"Of course, assuming they did take over your job step and now have carte blanche with the Proxy you've given them… the idea is that they shouldn't be able to do very much at ALL with this proxy—because you explicitly created the proxy against a least-privilege account which can't do much more than what you created it to do "
so the actually permission is controlled by the "Active to the following subsystems:" item in the list ? or the permission of the account setup in the security node?
again, just want to see how the permission is handle by using proxy and what the logic behind this.
http://sqlmag.com/blog/sql-server-dba-tip-credentials-and-proxies