Sa password is blank?

Question

Folks,
Why does callmanager does not change the password of sa after the install? It asks for SQL password and still the sa passwors is blank and any odbc source can connect to the callmanager database when connecting to it??
why such a big security hole? any reason behind it? what can we do to secure callmanager database?

Answer 1

Starting with 4.0, the database gets installed using NT authentication instead of the SQL sa authentication, unless you do a co-resident install with IPCC and then I am pretty sure it changes it to mixed mode. I am surprised you actually get into the database with blank sa password:
Introduction
In order to make administration of Cisco CallManager 4.0 easier, authentication has changed from 'SQL Server and Windows' to a 'Windows Only' authentication. In the past, a separate account and password was required in order to access the SQL database on the Cisco CallManager server after the initial Windows logon to the server. In Cisco CallManager 4.0, you only need to logon to Windows in order to gain access to the SQL database. This was done so users would not have to remember their SQL Server system administrator (SA) passwords after their initial install. For additional information refer to the Cisco CallManager Installation Documentation
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00801f9f33.shtml
Mary Beth