Microsoft SQL Server located in a WAN/DMZ area and running on its default port 1433 is vulnerable to attacks. In this article the port of SQL Server 2019, installed on Linux Ubuntu, is modified with the utility mssql-conf. The (automated) deployment of SQL Server aliases on client hosts when changing the server port drastically reduces negative impacts.

Modifying the port of SQL Server installed on a WAN/DMZ area is not enough from a security point of view, it decreases potential attacks but does not prevent some sniffer tools from reading TCP packets. How to encrypt the packets with SSL / TLS 1.2 for SQL Server on Linux ? Steps are easy with openssl and mssql-conf utility. The encryption is initiated and forced by the SQL Server engine using a self-signed certificate.

And the SQL Server Agent on Linux? Yes, BUT… If the configuration and activation of the SQL Server Agent are very simple with mssql-conf, controlling it is much less. On Linux, the SQL Server Agent is not associated with a dedicated service like on Windows with significant consequences.

In the default architecture, SQL Server 2019 runs with the account mssql. When trying to stop/start/restart the service mssql-server with systemctl, the password is prompted. We may want to allow mssql to manage its own service without password prompts. 2 solutions are available : defining mssql-server as a user service with the account mssql or granting rights with no password on the system service mssql-server to the user mssql through sudo.

ALWAYS start the SQL Server engine on Linux with the mssql account. NEVER run the sqlservr binary directly as root. Indeed, the engine can not then be restarted normally with the account mssql. The diagnosis is not as simple as usual in this kind of problem, permissions are altered for hidden binary system files of SQL Server (security.hiv…).

Who would have believe it in 2009, 10 years ago, Microsoft SQL Server 2019 on Linux platforms ! On Ubuntu 18.04, a SQL Server 2019 instance is installed and configured with mssql-conf. Since the majority of companies implement firewalls to prevent servers from communicating with the outside world, installations are performed in offline mode with the *.deb packages provided by Microsoft. Database files are not created in the default directory. After the installation, 2 tests are first carried out: restoration on SQL Server 2019/Linux of a database from its SQL Server 2016/Windows backup and a table export/import using bcp in native mode from SQL Server 2016/Windows to SQL Server 2019/Linux. These 2 tests will show whether or not it is easy, in this cross-platform context, to migrate databases from SQL Server 2016 on Windows to SQL Server 2019 on Linux.