patternsqlMinor
Query to retrieve SQL Server login password length
Viewed 0 times
sqllengthqueryloginpasswordretrieveserver
Problem
I've been asked by corporate security to review our Azure SQL Databases and find out if there are any SQL Logins which have "short" passwords. I am not aware of a way to achieve this - I know I could alter the login and force them to use the windows password policy - but wouldn't this have the side effect of disabling the logins and making our applications fail ?
Does anyone have a suggestion - TSQL or Powershell preferably
Does anyone have a suggestion - TSQL or Powershell preferably
Solution
I think, your corporate security meant by week passwords. One way of doing that (without any third-party tools) with help of in-built function PWDCOMPARE, but for this you need to have real week-passwords list available perhaps in database table from where every password looked-up and compared with SQL Login hashes one-by-one. following is the example:
Declare @pwText nvarchar(128);
Declare @WeekPassword_List table (pw nvarchar(128));
Declare @WeekPasswords_Active table (login_name sysname, pw nvarchar(128));
insert into @WeekPassword_List
values
('password'),
('passwordpassword'),
('password123'),
('P@ssw0rd'),
('Pa55word'),
('Pa55w0rd'),
('Temp@password'),
('Temp123'),
('temp123'),
('temp@123'),
('Temp@123'),
('123'),
('1234'),
('123456'),
('12345678'),
('');
while exists (select 1 from @WeekPassword_List)
begin
SET @pwText = (select top 1 pw from @WeekPassword_List);
INSERT INTO @WeekPasswords_Active
SELECT name, @pwText
FROM sys.sql_logins
WHERE Pwdcompare(@pwText, password_hash) = 1;
DELETE FROM @WeekPassword_List where pw = @pwText;
end
select * from @WeekPasswords_Active;Code Snippets
Declare @pwText nvarchar(128);
Declare @WeekPassword_List table (pw nvarchar(128));
Declare @WeekPasswords_Active table (login_name sysname, pw nvarchar(128));
insert into @WeekPassword_List
values
('password'),
('passwordpassword'),
('password123'),
('P@ssw0rd'),
('Pa55word'),
('Pa55w0rd'),
('Temp@password'),
('Temp123'),
('temp123'),
('temp@123'),
('Temp@123'),
('123'),
('1234'),
('123456'),
('12345678'),
('');
while exists (select 1 from @WeekPassword_List)
begin
SET @pwText = (select top 1 pw from @WeekPassword_List);
INSERT INTO @WeekPasswords_Active
SELECT name, @pwText
FROM sys.sql_logins
WHERE Pwdcompare(@pwText, password_hash) = 1;
DELETE FROM @WeekPassword_List where pw = @pwText;
end
select * from @WeekPasswords_Active;Context
StackExchange Database Administrators Q#279227, answer score: 4
Revisions (0)
No revisions yet.