Restrict SQL Server access on IP and/or Hostname base

Question

I need to implement a security policy for machine-2-machine accounts that requires to limit their access to database, only if it is from the IP (or hostname) of the application server that hosts the application. It has been decided because is a native feature
provided on Oracle, I can't find anything similar on SQL Server, please can you help me to address this requirement according Microsoft best practices?
Thank you
Andrea

Answer 1

regarding firewall solution, if I must reach a DB from my workstation with AD integrated authentication but not with a standard login, normally used by a Java application on ux environment application server, how can I manage it with a fw rule? (I use mixed
authentication on SQL Server because I have mixed platforms)
If you want rules like: account X but account Y may access the server from machine A, a firewall solution becomes difficult, since the firewall don't know what is in the packets they block.
However, it is still doable, provided that the server has multiple NIC. Each NIC will be an endpoint in SQL Server. You use the firewall to configure which machines that can access the IP address at all. But you only grant CONNECT permission on the endpoint
for accounts that should be permitted to use that IP address.
I noticed on various forums possible custom solutions based on logon triggers, I think it can be havy in terms of performance in cases (like mine) when there are tens of databases and hundreds of logins to manage in logon phase, checking whitelist tables
on every logon, moreover I monitored the actual situation with server side traces on login event and I captured many records where hostname field is NULL and it seems it can be managed from the application code side, so this check can be bypassed.
Yes, looking at the hostname is out of the question. You will need to look at the IP address, as I mentioned.
I am not going deny that a logon trigger is a heavier solution than a firewall. There is also the risk that if you mess it up, you lock yourself out. This can be sorted out by using the DAC, but it can cause some panic...
Erland Sommarskog, SQL Server MVP, [email protected]