Software - Is this legal?

Forums › IT Pro and developers › Software - Is this legal?

CYaBro

3201 posts

Uber Geek

Subscriber

# 45923 5-Nov-2009 00:05

Hey, not sure if this should be in any other forum so putting it here.

I have a question regarding some software and wether it is legal or not and could be breaching the Fair Trading Act.

This software installs and runs its own instance of an SQL database. When you first run the software it creates a random sa password for the database and normally this isn't a problem.

The problem arises when you want to use something like ShadowProtect to take a system backup image at regular intervals. Because you don't know the sa password and all other system and administrator accounts are removed from this SQL instance, the backup software is unable to take a snapshot of the database.

This is where I think something is wrong as I spoke to the software supplier and you have to buy another piece of software that will reveal the sa password! The price of this software is about $1500! This is more than the database software itself!

This might be ok practice in other countries but here in NZ I'm sure this can't be legal?

Anyone have any thoughts about this?

The way I see it is that it would be like HP or Acer or whoever putting an administrator password on all their new computers and then charging you to tell you what it is when you suddenly find you need it for something.

freitasm

BDFL - Memuneh
64989 posts

Uber Geek

Administrator

Trusted

Geekzone

Lifetime subscriber

# 270172 5-Nov-2009 00:16

It is not even the case of being legal or not. This company is holding your business - what if they go bust tomorrow? You won't be able to do anything with this software then?

They shouldn't run a database on your system without giving you the password. I would dump this supplier and find something else.

Regs

Cloud Guru
4060 posts

Uber Geek

Trusted

Snowflake

Subscriber

# 270173 5-Nov-2009 00:30

if the software you bought still works for its intended purpose, then i see no reason why it would be "illegal". its not much different from copy protection on CD's or DVD's etc.

All said, you should still be able to back up your server with this software on it. If a 'live' backup does not work, then schedule the sql instance to be shut down, database files backed up, and subsequently restarted.

if the actual data in the database tables is not encrypted, then you'll probably find that taking the MDF and LDF files (while sql instance shut down) and attaching them to another SQL instance is all you need to gain access to the database

Sales Engineer
Snowflake
www.snowflake.com

about.me/nzregs
Twitter: @nzregs

nate

6359 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 270176 5-Nov-2009 01:02

CYaBro: This software installs and runs its own instance of an SQL database. When you first run the software it creates a random sa password for the database and normally this isn't a problem.

The software you are talking about isn't ACT by any chance?

I remember running into this issue when trying to hook a online mail marketing system into the ACT program my Dad was running. We ended up giving up as I couldn't get access to the data, and it was too hard to use ACT itself.

I think it is legal, most other software doesn't allow you free reign to its data stores, and in locking down the database ACT guarantees you can't break it by messing with the database. This is still very annoying.

Could you possibly get around this by stopping the SQL Server service, and backing up the MDF file?

CYaBro

3201 posts

Uber Geek

Subscriber

# 270189 5-Nov-2009 06:54

Yes it is Act! It's not us that is using the software, some of our clients are.
Changing the software is not really an option as they have all invested too much time and money on Act! to change.

We can still do a backup of the database but only once a day using the built in backup that comes with Act! kind of defeats the purpose of using ShadowProtect which is taking an image of the system every 15 minutes.

They obviuosly aren't too worried about access to the database if they are willing to sell you the software to get the sa password.
I think they do it so anyone wanting to create an addon for Act! has to pay for the privilage or you buy one of their addons.

tchart

1549 posts

Uber Geek

Trusted

# 270195 5-Nov-2009 07:46

There are many options to reset the SA password, just Google "SQL Server forgot SA password" (without the quotes).

I guess the bigger problem is that their software probably has the password hard coded somewhere. First thing I would do it check all text type files for possible passwords. I that didnt find it, check the registry and then go through the executables with the hex editor.

Just some options but becareful as if you change the SA password and cant find the one Act thinks it needs to use you will be stuffed.

nate

6359 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 270366 5-Nov-2009 15:05

CYaBro: They obviuosly aren't too worried about access to the database if they are willing to sell you the software to get the sa password.

That's what I thought when I enquired about getting the sa password. Ridiculous really.

Mark

1493 posts

Uber Geek

# 270402 5-Nov-2009 16:44

Doesn;t sound illegal but it's certainly hideous customer gouging!

With Act can you not set it up to do a database backup to a flat file ? Think there is something in the scheduler .. then scoop that file up with your backup system
Cludgy but better than nothing.

Mark

Regs

Cloud Guru
4060 posts

Uber Geek

Trusted

Snowflake

Subscriber

# 270423 5-Nov-2009 17:53

regardless of all the above, doesnt ShadowProtect do VSS snapshots of your server anyway? shouldnt that be sufficient to get a point-in-time backup of your server, including the SQL Server databases that are running at the time of the snapshot? I didnt think this required the SQL SA or Admin password as long as you had access to the VSS service? Is there an actual error occuring?

Sales Engineer
Snowflake
www.snowflake.com

about.me/nzregs
Twitter: @nzregs

CYaBro

3201 posts

Uber Geek

Subscriber

# 270433 5-Nov-2009 18:13

Regs: regardless of all the above, doesnt ShadowProtect do VSS snapshots of your server anyway? shouldnt that be sufficient to get a point-in-time backup of your server, including the SQL Server databases that are running at the time of the snapshot? I didnt think this required the SQL SA or Admin password as long as you had access to the VSS service? Is there an actual error occuring?

The SQL VSS writer needs admin access to the SQL database to be able to take a snapshot :(
On the systems I have installed ShadowProtect on that also have Act! the Application Event Log is full of VSS errors as it can't get access!

buzzy

217 posts

Master Geek

# 270671 6-Nov-2009 15:35

CYaBro: The SQL VSS writer needs admin access to the SQL database to be able to take a snapshot :( On the systems I have installed ShadowProtect on that also have Act! the Application Event Log is full of VSS errors as it can't get access!

The SQL Writer account needs to included in the 'sa' role for the database instance, but given that the SQL Writer runs as LocalSystem by default, it should have that level of access already. Are the daily backups performed by ACT! being done as a database dump rather than a VSS snapshot?

Can you post the exact errors that are being generated when the VSS snap is being attempted? It could be to do with the stable timeout (or whatever it's called in VSS terminology) that requires a certain length of time without disk I/O before the snapshot can be taken, as opposed to being a permissions error.

http://msdn.microsoft.com/en-us/library/cc966520.aspx says:

SQL Writer Service Account
During installation, the SQL writer account will be installed to use the Local System account. Since the SQL writer needs to talk to SQL Server using exclusive VDI APIs, the SQL writer account must have sufficient access rights for both SQL Server and VSS. Configuring the service as a Local System account provides sufficient rights for the service to run correctly.
Note To have the SQL writer service work correctly, it is important to make sure that the Local System account is not removed from the SQL Server instance’s ‘sa’ role.

CYaBro

3201 posts

Uber Geek

Subscriber

# 272209 11-Nov-2009 23:48

Note To have the SQL writer service work correctly, it is important to make sure that the Local System account is not removed from the SQL Server instance’s ‘sa’ role.

And that's the problem. Act removes all access to the SQL database instance except for sa so without the password you are screwed.
Doing some searching and people have found ways of getting in and adding another user but act seems to check this and removes it again next time it is run.

nate

6359 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 272231 12-Nov-2009 02:51

The sa password for ACT isn't halfway down this page is it?

CYaBro

3201 posts

Uber Geek

Subscriber

# 272236 12-Nov-2009 06:27

Yea saw that but the problem is that the first time you run Act! it changes the password to something random and the only way to find out what this is is by buying their sa password software.
Under NZ law this just seems completely wrong that they can pretty much hold you to ransom like this. You either use their very basic built in backup or pay to access your own data with a third party backup solution.
They also sell Act! addons that will also do more with Act! for you or you can buy a SDK which allows you to create your own addons and also gives you the sa password.

I don't know of any other software that does this and when I have come across some software that does something like this, a quick call to their helpdesk and they have been happy to give any admin password that was required.

buzzy

217 posts

Master Geek

# 272272 12-Nov-2009 09:18

I don't think they're doing anything wrong under the law. They provide some software, it stores data you put in there, and there are methods to access and manipulate that data. That's no different than Microsoft Word: it stores data in Word documents. You access that information through the methods that Microsoft provide. They don't provide any open access to the information stored in those Word documents.

There's nothing under law that says a software provider must provide open access to data that you put into their software.

geekiegeek

2258 posts

Uber Geek

Trusted

Subscriber

# 272283 12-Nov-2009 09:28

I have also been down this road - basically there justification is that if users dont have access to the database then they cant stuff it up. There is a backup solution within ACT from memory so in the end we went with just running that before the general system backup so that the ACT backup files are backed up.

Delete Social Media

My thoughts are my own and are in no way representative of my employer.