Security Risk: Using SQL Authentication for Direct Mailer Global Resource

  • Article

If you configure the Direct Mailer global resource to use SQL authentication, passwords are stored in clear text when the Direct Mailer service is invoked.

For example, you perform the following steps:

  1. Configure the Direct Mailer global resource to use SQL authentication.
  2. Create a direct mailer campaign using Business Desk.
  3. On the Test section of the Campaign Definition page, click Send Test Mail. This invokes the Direct Mailer service.
  4. Check the lm_master_operations database table, and you will see an entry similar to the following, with the password stored as clear text.
Op_id Op_desc Op_list_destination

0B150E06-529D-4A39-97A3-B90DC9150E70 Exporting the list 'TEST1' to the SQL 
table 'ML__0E388EAC_A155_459A_A94A_0FCCAE4B97F5_' 
Provider=SQLOLEDB.1;Persist Security Info=True; 
Integrated Security='SSPI';Initial Catalog=DirectMailer;Data Source=TESTSERVER;Network 
Library=dbmssocn;Use Procedure for Prepare=1;Auto Translate=True;Packet 
Size=4096;Workstation ID=TESTSERVER;Use . . . 

0DA26B3B-9163-4BFE-BD4F-F0AF872DFE30 Exporting the list 'mailingListTEST1' 
to the SQL table 'ML__803B4C6E_4EC2_490F_B30C_8771E5AFCC10_'  
Provider=SQLOLEDB.1;Integrated Security='SSPI';Persist 
Security Info=True; Integrated Security='SSPI';Initial Catalog=DirectMailer;Data 
Source=TESTSERVER;Network Library=dbmssocn;Use Procedure for 
Prepare=1;Auto Translate=True;Packet Size=4096;Workstation . . .

The connection string of the Direct Mailer global resource is saved in the database in clear text.

Using Windows Integrated Security for the Direct Mailer global resource

If you use Windows Integrated Security for the Direct Mailer global resource, the password is not saved in the database.

However, when you switch from SQL authentication to Windows Integrated Security, and you do not erase the password although it is disabled on the Direct Mailer properties dialog box, the password remains in the connection string, and goes into the database as clear text.

You must restart the Direct Mailer service to clear the password from the database. You can do this through the Services panel, or from the command line by typing net stop dmlservice, net start dmlservice.

Running the IISReset command does not clear the password from the database.

For detailed instructions for configuring the Direct Mailer service to use Windows Integrated Security, see Configuring Direct Mailer and Windows Authentication.

Copyright © 2005 Microsoft Corporation.
All rights reserved.