Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


CYaBro

3343 posts

Uber Geek

Subscriber

#45923 5-Nov-2009 00:05
Send private message

Hey, not sure if this should be in any other forum so putting it here.

I have a question regarding some software and wether it is legal or not and could be breaching the Fair Trading Act.

This software installs and runs its own instance of an SQL database. When you first run the software it creates a random sa password for the database and normally this isn't a problem.

The problem arises when you want to use something like ShadowProtect to take a system backup image at regular intervals. Because you don't know the sa password and all other system and administrator accounts are removed from this SQL instance, the backup software is unable to take a snapshot of the database.

This is where I think something is wrong as I spoke to the software supplier and you have to buy another piece of software that will reveal the sa password! The price of this software is about $1500! This is more than the database software itself!

This might be ok practice in other countries but here in NZ I'm sure this can't be legal?

Anyone have any thoughts about this?

The way I see it is that it would be like HP or Acer or whoever putting an administrator password on all their new computers and then charging you to tell you what it is when you suddenly find you need it for something.

Create new topic
freitasm
BDFL - Memuneh
68843 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  #270172 5-Nov-2009 00:16
Send private message

It is not even the case of being legal or not. This company is holding your business - what if they go bust tomorrow? You won't be able to do anything with this software then?

They shouldn't run a database on your system without giving you the password. I would dump this supplier and find something else.






 

 

These links are referral codes

 

Geekzone broadband switch | Eletricity comparison and switch | Hatch investment (NZ$ 10 bonus if NZ$100 deposited within 30 days) | Sharesies | Mighty Ape | Backblaze | Coinbase | TheMarket | My technology disclosure


Regs
4062 posts

Uber Geek

Trusted
Snowflake

  #270173 5-Nov-2009 00:30
Send private message

if the software you bought still works for its intended purpose, then i see no reason why it would be "illegal". its not much different from copy protection on CD's or DVD's etc.

All said, you should still be able to back up your server with this software on it. If a 'live' backup does not work, then schedule the sql instance to be shut down, database files backed up, and subsequently restarted.

if the actual data in the database tables is not encrypted, then you'll probably find that taking the MDF and LDF files (while sql instance shut down) and attaching them to another SQL instance is all you need to gain access to the database




 
 
 
 


nate
6407 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #270176 5-Nov-2009 01:02
Send private message

CYaBro: This software installs and runs its own instance of an SQL database. When you first run the software it creates a random sa password for the database and normally this isn't a problem.


The software you are talking about isn't ACT by any chance?

I remember running into this issue when trying to hook a online mail marketing system into the ACT program my Dad was running.  We ended up giving up as I couldn't get access to the data, and it was too hard to use ACT itself.

I think it is legal, most other software doesn't allow you free reign to its data stores, and in locking down the database ACT guarantees you can't break it by messing with the database.  This is still very annoying.

Could you possibly get around this by stopping the SQL Server service, and backing up the MDF file?

CYaBro

3343 posts

Uber Geek

Subscriber

  #270189 5-Nov-2009 06:54
Send private message

Yes it is Act! It's not us that is using the software, some of our clients are.
Changing the software is not really an option as they have all invested too much time and money on Act! to change.

We can still do a backup of the database but only once a day using the built in backup that comes with Act! kind of defeats the purpose of using ShadowProtect which is taking an image of the system every 15 minutes.

They obviuosly aren't too worried about access to the database if they are willing to sell you the software to get the sa password.
I think they do it so anyone wanting to create an addon for Act! has to pay for the privilage or you buy one of their addons.

tchart
1697 posts

Uber Geek

Trusted
Subscriber

  #270195 5-Nov-2009 07:46
Send private message

There are many options to reset the SA password, just Google "SQL Server forgot SA password" (without the quotes).

I guess the bigger problem is that their software probably has the password hard coded somewhere. First thing I would do it check all text type files for possible passwords. I that didnt find it, check the registry and then go through the executables with the hex editor.

Just some options but becareful as if you change the SA password and cant find the one Act thinks it needs to use you will be stuffed.

nate
6407 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #270366 5-Nov-2009 15:05
Send private message

CYaBro: They obviuosly aren't too worried about access to the database if they are willing to sell you the software to get the sa password.


That's what I thought when I enquired about getting the sa password. Ridiculous really.

Mark
1550 posts

Uber Geek


  #270402 5-Nov-2009 16:44
Send private message

Doesn;t sound illegal but it's certainly hideous customer gouging!

With Act can you not set it up to do a database backup to a flat file ?  Think there is something in the scheduler .. then scoop that file up with your backup system
Cludgy but better than nothing.

Mark


 
 
 
 


Regs
4062 posts

Uber Geek

Trusted
Snowflake

  #270423 5-Nov-2009 17:53
Send private message

regardless of all the above, doesnt ShadowProtect do VSS snapshots of your server anyway? shouldnt that be sufficient to get a point-in-time backup of your server, including the SQL Server databases that are running at the time of the snapshot? I didnt think this required the SQL SA or Admin password as long as you had access to the VSS service? Is there an actual error occuring?




CYaBro

3343 posts

Uber Geek

Subscriber

  #270433 5-Nov-2009 18:13
Send private message

Regs: regardless of all the above, doesnt ShadowProtect do VSS snapshots of your server anyway? shouldnt that be sufficient to get a point-in-time backup of your server, including the SQL Server databases that are running at the time of the snapshot? I didnt think this required the SQL SA or Admin password as long as you had access to the VSS service? Is there an actual error occuring?


The SQL VSS writer needs admin access to the SQL database to be able to take a snapshot :(
On the systems I have installed ShadowProtect on that also have Act! the Application Event Log is full of VSS errors as it can't get access!

buzzy
217 posts

Master Geek


  #270671 6-Nov-2009 15:35
Send private message

CYaBro: The SQL VSS writer needs admin access to the SQL database to be able to take a snapshot :( On the systems I have installed ShadowProtect on that also have Act! the Application Event Log is full of VSS errors as it can't get access!



The SQL Writer account needs to included in the 'sa' role for the database instance, but given that the SQL Writer runs as LocalSystem by default, it should have that level of access already. Are the daily backups performed by ACT! being done as a database dump rather than a VSS snapshot?


Can you post the exact errors that are being generated when the VSS snap is being attempted? It could be to do with the stable timeout (or whatever it's called in VSS terminology) that requires a certain length of time without disk I/O before the snapshot can be taken, as opposed to being a permissions error.  


http://msdn.microsoft.com/en-us/library/cc966520.aspx says:

SQL Writer Service Account
During installation, the SQL writer account will be installed to use the Local System account. Since the SQL writer needs to talk to SQL Server using exclusive VDI APIs, the SQL writer account must have sufficient access rights for both SQL Server and VSS.  Configuring the service as a Local System account provides sufficient rights for the service to run correctly.
Note   To have the SQL writer service work correctly, it is important to make sure that the Local System account is not removed from the SQL Server instance’s ‘sa’ role.

 

 


CYaBro

3343 posts

Uber Geek

Subscriber

  #272209 11-Nov-2009 23:48
Send private message

Note   To have the SQL writer service work correctly, it is important to make sure that the Local System account is not removed from the SQL Server instance’s ‘sa’ role.


And that's the problem. Act removes all access to the SQL database instance except for sa so without the password you are screwed.
Doing some searching and people have found ways of getting in and adding another user but act seems to check this and removes it again next time it is run.

nate
6407 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

#272231 12-Nov-2009 02:51
Send private message

The sa password for ACT isn't halfway down this page is it?

CYaBro

3343 posts

Uber Geek

Subscriber

  #272236 12-Nov-2009 06:27
Send private message

Yea saw that but the problem is that the first time you run Act! it changes the password to something random and the only way to find out what this is is by buying their sa password software.
Under NZ law this just seems completely wrong that they can pretty much hold you to ransom like this. You either use their very basic built in backup or pay to access your own data with a third party backup solution.
They also sell Act! addons that will also do more with Act! for you or you can buy a SDK which allows you to create your own addons and also gives you the sa password.

I don't know of any other software that does this and when I have come across some software that does something like this, a quick call to their helpdesk and they have been happy to give any admin password that was required.

buzzy
217 posts

Master Geek


  #272272 12-Nov-2009 09:18
Send private message

I don't think they're doing anything wrong under the law. They provide some software, it stores data you put in there, and there are methods to access and manipulate that data. That's no different than Microsoft Word: it stores data in Word documents. You access that information through the methods that Microsoft provide. They don't provide any open access to the information stored in those Word documents.

There's nothing under law that says a software provider must provide open access to data that you put into their software.

geekiegeek
2509 posts

Uber Geek

Trusted
Subscriber

  #272283 12-Nov-2009 09:28
Send private message

I have also been down this road - basically there justification is that if users dont have access to the database then they cant stuff it up. There is a backup solution within ACT from memory so in the end we went with just running that before the general system backup so that the ACT backup files are backed up.




Delete Social Media

 


My thoughts are my own and are in no way representative of my employer.


Create new topic





News »

Nanoleaf enhances lighting line with launch of Triangles and Mini Triangles
Posted 17-Oct-2020 20:18


Synology unveils DS16211+
Posted 17-Oct-2020 20:12


Ingram Micro introduces FootfallCam to New Zealand channel
Posted 17-Oct-2020 20:06


Dropbox adopts Virtual First working policy
Posted 17-Oct-2020 19:47


OPPO announces Reno4 Series 5G line-up in NZ
Posted 16-Oct-2020 08:52


Microsoft Highway to a Hundred expands to Asia Pacific
Posted 14-Oct-2020 09:34


Spark turns on 5G in Auckland
Posted 14-Oct-2020 09:29


AMD Launches AMD Ryzen 5000 Series Desktop Processors
Posted 9-Oct-2020 10:13


Teletrac Navman launches integrated multi-camera solution for transport and logistics industry
Posted 8-Oct-2020 10:57


Farmside hits 10,000 RBI customers
Posted 7-Oct-2020 15:32


NordVPN starts deploying colocated servers
Posted 7-Oct-2020 09:00


Google introduces Nest Wifi routers in New Zealand
Posted 7-Oct-2020 05:00


Orcon to bundle Google Nest Wifi router with new accounts
Posted 7-Oct-2020 05:00


Epay and Centrapay partner to create digital gift cards
Posted 2-Oct-2020 17:34


Inseego launches 5G MiFi M2000 mobile hotspot
Posted 2-Oct-2020 14:53









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.