SQL Server 2005'in birden çok örneði üzerinde SQL Server 2005 Service Broker uzak güvenlik sertifikalarý nasýl kullanýlýr

• Dört sertifikalarý ve özel anahtar dosyalarý dört (makecert.exe) <a0>sertifika oluþturma aracýný kullanarak oluþturduðunuz. Bu örnekte, bu dosyalarý her iki C:\Certificates klasörüne kopyalandýktan ve dosyalarý aþaðýdaki adlandýrýldýðý varsayýlmaktadýr:
  • SourceServer.cer
  • SourceServer.pvk
  • TargetServer.cer
  • TargetServer.pvk
  • DlgSourceServer.cer
  • DlgSourceServer.pvk
  • DlgTargetServer.cer
  • DlgTargetServer.pvk
  Sýnama sertifikasý oluþturma hakkýnda daha fazla bilgi için aþaðýdaki Microsoft Developer Network (MSDN) Web sitesini ziyaret edin:
  http://msdn2.microsoft.com/en-us/library/bfsktky3(vs.71).aspx (http://msdn2.microsoft.com/en-us/library/bfsktky3(vs.71).aspx)
• SQL Server 2005'in iki örneði, ayný aðdaki farklý sunucularda yüklü. Bu örnekte, ilk sunucunun ServerSrc olarak adlandýrýlýr ve ikinci sunucu ServerTag adlý varsayar.
• Iki örnekleri için SQL Server sysadmin sabit sunucu rolü olan oturumlarýn kullanarak baðlanýn.
• TCP baðlantý noktasý 4022 kullanýlabilir olup olmadýðýný yaptýnýz. Bu örnekte, baðlantý noktasýný birbirine baðlanmak için iki örnekleri tarafýndan kullanýlýr.

Üste

ServerSrc sunucudaki SQL Server örneði için SQL Server 2005 Service Broker'ý yapýlandýrma

1. Örnek ServerSrc sunucudaki SQL Server Management Studio'yu kullanarak baðlanýn.
2. Sorgu düzenleyicisinde aþaðýdaki Transact-SQL deyimlerini çalýþtýrýn: <a1>

   --Configure the transport security.
   USE MASTER
   go
   
   --Create a master key in the master database.
   CREATE MASTER KEY ENCRYPTION BY password = 'MasterKeyPassword'
   Go
   
   --Create a certificate for transport security.
   CREATE CERTIFICATE ctfSourceServerMaster
   FROM FILE = 'C:\Certificates\SourceServer.cer'
   WITH PRIVATE KEY ( FILE = 'C:\Certificates\SourceServer.pvk' , DECRYPTION BY PASSWORD = 'PrivateKeyPassword' )
   ACTIVE FOR BEGIN_DIALOG = ON
   GO
   
   --Create the login and the user to own a certificate.
   CREATE LOGIN remcert WITH PASSWORD = 'LoginPassword'
   GO
   CREATE USER remcert FOR LOGIN remcert
   GO
   CREATE CERTIFICATE ctftTargetServerMaster
   AUTHORIZATION remcert
   FROM FILE = 'C:\Certificates\TargetServer.cer'
   ACTIVE FOR BEGIN_DIALOG = ON
   GO
   
   --Create a new endpoint for SQL Server 2005 Service Broker, and set the AUTHENTICATION option to use the ctfSourceServerMaster certificate.
   CREATE ENDPOINT BrokerEndpoint
   	STATE = STARTED
   	AS TCP
   	(
   		LISTENER_PORT = 4022
   	)
   	FOR SERVICE_BROKER (AUTHENTICATION = CERTIFICATE ctfSourceServerMaster)
   GO
   
   --Grant the required permissions to the remcert login.
   GRANT CONNECT TO remcert
   GRANT CONNECT ON ENDPOINT::BrokerEndpoint to remcert
   GO
   
   --Create a new database for testing.
   CREATE DATABASE SourceDB
   GO
   USE SourceDB
   GO
   
   --Configure the dialog security.
   
   --Create a master key in the SourceDB database.
   CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'MasterKeyPassword'
   
   --Create a certificate for the SourceDB database.
   CREATE CERTIFICATE ctfDlgSourceServer
   FROM FILE = 'C:\certificates\DlgSourceServer.cer'
   WITH PRIVATE KEY 
   (FILE='C:\certificates\DlgSourceServer.pvk',decryption by password='PrivateKeyPassword')
   ACTIVE FOR BEGIN_DIALOG = ON
   GO
   
   --Create a user for the remcert login that owns a certificate for the dialog security.
   CREATE USER remcert for LOGIN remcert
   GO
   CREATE CERTIFICATE ctfDlgTargetServer
   AUTHORIZATION remcert
   FROM FILE = 'C:\certificates\DlgTargetServer.cer'
   ACTIVE FOR BEGIN_DIALOG = ON
   
   --Create a message type, a contract, a queue, and a service.
   
   CREATE MESSAGE TYPE [mymsg] VALIDATION = NONE 
   CREATE CONTRACT [mycon] ([mymsg] SENT BY ANY)
   CREATE QUEUE [myQueue]
   CREATE SERVICE [SourceService] ON QUEUE [myQueue]([mycon])
   GO
   
   --Grant the send permission to the user.
   GRANT SEND ON SERVICE::[SourceService] TO remcert
   
   --Create a remote service binding for the target service. 
   CREATE REMOTE SERVICE BINDING [Certificate_Binding_on_server]
      TO SERVICE 'TargetService'
      WITH  USER = remcert,
      ANONYMOUS=Off  
   
   --Create a route for the target service.
   CREATE ROUTE [myRoute]
       WITH 
       SERVICE_NAME = 'TargetService',
       address = 'TCP://ServerTag:4022';
   
   

   NotMasterKeyPassword parolasýný için veritabanýný belirtmelisiniz ana anahtar için bir yer tutucudur. PrivateKeyPassword bir parola .pvk özel anahtar dosyasý için belirttiðiniz özel anahtarýnýn sertifika oluþturma aracýný kullanarak yertutucusudur. LoginPassword, yeni oluþturulan oturum açma parolasýný için yer tutucudur.

Üste

ServerTag sunucudaki SQL Server örneði için SQL Server 2005 Service Broker'ý yapýlandýrma

1. Örnek ServerTag sunucudaki SQL Server Management Studio'yu kullanarak baðlanýn.
2. Sorgu düzenleyicisinde aþaðýdaki Transact-SQL deyimlerini çalýþtýrýn: <a1>

   --Configure the transport security.
   USE MASTER
   go
   
   --Create a master key in the master database.
   CREATE MASTER KEY ENCRYPTION BY password = 'MasterKeyPassword'
   Go
   
   --Create a certificate for transport security.
   CREATE CERTIFICATE ctfTargetServerMaster
   FROM FILE = 'c:\certificates\TargetServer.cer'
   WITH PRIVATE KEY (FILE='c:\certificates\TargetServer.pvk',decryption by password='PrivateKeyPassword')
   ACTIVE FOR BEGIN_DIALOG = ON
   GO
   
   --Create the login and the user to own a certificate.
   CREATE LOGIN remcert WITH PASSWORD = 'LoginPassword'
   GO
   CREATE USER remcert FOR LOGIN remcert
   GO
   CREATE CERTIFICATE ctfSourceServerMaster
   AUTHORIZATION remcert
   FROM FILE = 'c:\certificates\SourceServer.cer'
   ACTIVE FOR BEGIN_DIALOG = ON
   GO
   
   --Create a new endpoint for SQL Server 2005 Service Broker, and set the AUTHENTICATION option to use the ctfSourceServerMaster certificate.
   CREATE ENDPOINT BrokerEndpoint
   	STATE = STARTED
   	AS TCP
   	(
   		LISTENER_PORT = 4022
   	)
   	FOR SERVICE_BROKER (AUTHENTICATION = CERTIFICATE ctfTargetServerMaster)
   GO
   
   --Grant the required permissions to the remcert login.
   GRANT CONNECT TO remcert
   GRANT CONNECT ON ENDPOINT::BrokerEndpoint to remcert
   GO
   
   --Create a new database for testing.
   CREATE DATABASE TargetDB
   GO
   USE TargetDB
   GO
   
   --Configure the dialog security.
   
   --Create a master key in the TargetDB database.
   CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'MasterKeyPassword'
   
   --Create a certificate for the TargetDB database.
   CREATE CERTIFICATE ctfDlgTargetServer
   FROM FILE = 'c:\certificates\DlgTargetServer.cer'
   WITH PRIVATE KEY 
   (FILE='c:\certificates\DlgTargetServer.pvk',decryption by password='PrivateKeyPassword')
   ACTIVE FOR BEGIN_DIALOG = ON
   GO
   
   --Create a user for the remcert login that owns a certificate for the dialog security.
   CREATE USER remcert for LOGIN remcert
   GO
   CREATE CERTIFICATE ctfDlgSourceServer
   AUTHORIZATION remcert
   FROM FILE = 'C:\certificates\DlgSourceServer.cer'
   ACTIVE FOR BEGIN_DIALOG = ON
   
   --Create a message type, a contract, a queue, and a service.
   CREATE MESSAGE TYPE [mymsg] VALIDATION = NONE 
   CREATE CONTRACT [mycon] ([mymsg] SENT BY ANY)
   CREATE QUEUE [myQueue]
   CREATE SERVICE [TargetService] ON QUEUE [myQueue]([mycon])
   GO
   
   --Grant the send permission to the user.
   GRANT SEND ON SERVICE::[TargetService] TO remcert
   GO
   
   --Create a remote service binding for the target service. 
   CREATE REMOTE SERVICE BINDING [Certificate_Binding_on_server]
      TO SERVICE 'SourceService'
      WITH  USER = remcert,
      ANONYMOUS=Off  
   --Create a route for the target service.
   CREATE ROUTE [myRoute]
       WITH 
       SERVICE_NAME = 'SourceService',
       address = 'TCP://ServerSrc:4022';

Üste

SQL Server 2005 Service Broker uzak güvenlik sýnama

USE SourceDB
SET NOCOUNT ON
DECLARE @conversationHandle uniqueidentifier
BEGIN TRANSACTION
	-- Start dialog.
	BEGIN DIALOG  @conversationHandle
	FROM SERVICE    [SourceService]
	TO SERVICE      'TargetService'
	ON CONTRACT     [mycon]
	WITH ENCRYPTION = ON, LIFETIME = 600;

	-- Send message.
	SEND ON CONVERSATION @conversationHandle 
	MESSAGE TYPE [mymsg] (N'Hi, from '+@@ServerName)
COMMIT

SELECT CONVERT(NVARCHAR(MAX),message_body) FROM myQueue
GO

Hi, from ServerSrc

Üste

• <a1>Güvenlik</a1> (Service Broker) yönetme
• Að ve uzak güvenlik
• Service Broker iletiþim güvenliði
• Iletiþim güvenliði türü belirleme
• Uzak hizmet baðlantýlarý

Üste