EXECUTE xp_cmdshell AS context of a sysadmin requires ##xp_cmdshell_proxy_account## credential to exist?

Question

Hi,
I am unable to use a stored procedure to allow a non-sysadmin to execute in the context of a sysadmin and call xp_cmdshell unless the ##xp_cmdshell_proxy_account## actually exists.
My understanding is that a sysadmin does not require the use of a proxy in order to execute xp_cmdshell.  However without one set up I receive the following error:
Msg 15153, Level 16, State 1, Procedure xp_cmdshell, Line 1
The xp_cmdshell proxy account information cannot be retrieved or is invalid. Verify that the '##xp_cmdshell_proxy_account##' credential exists and contains valid information.
A little confused as to why the ##xp_cmdshell_proxy_account## needs to be set up and if/how/when the credential identity's details are actually used?
Regards
Dan

Answer 1

I am unable to use a stored procedure to allow a non-sysadmin to execute in the context of a sysadmin and call xp_cmdshell unless the ##xp_cmdshell_proxy_account## actually exists.
When you use EXECUTE AS in the procedure header, you impersonate a database user, but you don't get any permissions on server level, unless the database is marked as trustworthy. But don't make the database trustworthy, as it can can open a security
hole.
Instead a better solution is to create a certificate in the master database, and create a login from that certificate. That is not a login that can acutlly login, but only serves as a placeholder for permissions. In this case, you add the login to the sysadmin
role. Then you export the certificate to the user database and you sign the procedure with the certificate. Below are the steps to take as a script. For more details on the technique, see this article on my web site:
http://www.sommarskog.se/grantperm.html
I also discuss the dangers with trustworthy in more detail in this article.
USE master
go
-- Create certificate in master.
CREATE CERTIFICATE xp_cmdshell_cert
   ENCRYPTION BY PASSWORD = 'All you need is love'
   WITH SUBJECT = 'For xp_cmdshell privileges',
   START_DATE = '20020101', EXPIRY_DATE = '20200101'
go
-- Create a login for the certificate.
CREATE LOGIN xp_cmdshell_cert_login FROM CERTIFICATE xp_cmdshell_cert
go
-- Grant rights for the certificate login.
EXEC sp_addsrvrolemember xp_cmdshell_cert_login, sysadmin
go
-- Save the certificate to disk.
BACKUP CERTIFICATE xp_cmdshell_cert TO FILE = 'C:\temp\cert.cer'
WITH PRIVATE KEY (FILE = 'C:\temp\cert.pvk' ,
                  ENCRYPTION BY PASSWORD = 'Tomorrow never knows',
                  DECRYPTION BY PASSWORD = 'All you need is love')
go
-- Move to test database.
USE somedatabase
go
-- You procedure here.
CREATE PROCEDURE run_xp_cmdshell AS
EXEC xp_cmdshell 'DIR'
go
-- Give test user right to execute the procedure.
GRANT EXECUTE ON run_xp_cmdshell TO someuser
go
-- Import the certificate we created in master into the test database.
CREATE CERTIFICATE xp_cmdshell_cert FROM FILE = 'C:\temp\cert.cer'
WITH PRIVATE KEY (FILE = 'C:\temp\cert.pvk',
                  DECRYPTION BY PASSWORD = 'Tomorrow never knows',
                  ENCRYPTION BY PASSWORD = 'A day in life')
go
-- Delete the files.
EXEC master..xp_cmdshell 'DEL C:\temp\cert.*', 'no_output'
go
-- Sign the test procedures.
ADD SIGNATURE TO run_xp_cmdshell BY CERTIFICATE xp_cmdshell_cert
    WITH PASSWORD = 'A day in life'
go
Erland Sommarskog, SQL Server MVP, [email protected]