SQL Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213990	SQL6-D0-011900	SV-213990r879756_rule		Medium

Description
Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.

STIG	Date
MS SQL Server 2016 Instance Security Technical Implementation Guide	2023-06-01

Details

Check Text ( C-15207r313753_chk )
SQL Server must only use approved network communication libraries, ports, and protocols. Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. Verify that the protocols are enabled for the instance. If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding.

Fix Text (F-15205r313754_fix)
Assign the approved TCP/IP port number to the SQL Server Database Engine. 1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for , and then double-click "TCP/IP". 2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure. 3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0". 4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK". 5. In the console pane, click "SQL Server Services". 6. In the details pane, right-click "SQL Server ()" and then click "Restart", to stop and restart SQL Server. To disable a server network protocol for an instance: 1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. 2. In the console pane, click "Protocols" for . 3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable". 4. In the console pane, click "SQL Server Services". 5. In the details pane, right-click "SQL Server ()", and then click "Restart", to stop and restart the SQL Server service.

Fix Text (F-15205r313754_fix)

Assign the approved TCP/IP port number to the SQL Server Database Engine.
1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for , and then double-click "TCP/IP".
2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure.
3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0".
4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK".
5. In the console pane, click "SQL Server Services".
6. In the details pane, right-click "SQL Server ()" and then click "Restart", to stop and restart SQL Server.

To disable a server network protocol for an instance:
1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration.
2. In the console pane, click "Protocols" for .
3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable".
4. In the console pane, click "SQL Server Services".
5. In the details pane, right-click "SQL Server ()", and then click "Restart", to stop and restart the SQL Server service.