lowlydba.sqlserver.sa module – Configure the sa login for security best practices

Note

This module is part of the lowlydba.sqlserver collection (version 2.7.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install lowlydba.sqlserver. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: lowlydba.sqlserver.sa.

New in lowlydba.sqlserver 0.3.0

Synopsis

  • Rename, disable, and reset the password for the sa login on a SQL Server instance per best practices.

Requirements

The below requirements are needed on the host that executes this module.

Parameters

Parameter

Comments

enabled

boolean

added in lowlydba.sqlserver 0.4.0

Whether the login is enabled or disabled.

Choices:

  • false

  • true ← (default)

new_name

string

The new name to rename the sa login to.

password

string

Password for the login.

password_expiration_enabled

boolean

Enforces password expiration policy. Requires password_policy_enforced=true.

Choices:

  • false

  • true

password_must_change

boolean

Enforces user must change password at next login.

When specified, will enforce password_expiration_enabled and password_policy_enforced as they are required.

Choices:

  • false

  • true

password_policy_enforced

boolean

Enforces password complexity policy.

Choices:

  • false

  • true

sql_instance

string / required

The SQL Server instance to modify.

sql_password

string

Password for SQL Authentication.

sql_username

string

Username for SQL Authentication.

Attributes

Attribute

Support

Description

check_mode

Support: full

Can run in check_mode and return changed status prediction without modifying target.

platform

Platforms: all

Target OS/families that can be operated against.

Examples

- name: Disable sa login
  lowlydba.sqlserver.sa:
    sql_instance: sql-01.myco.io
    enabled: false

- name: Rename sa login
  lowlydba.sqlserver.sa:
    sql_instance: sql-01.myco.io
    new_name: 'notthesayourelookingfor'

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

data

dictionary

Output from the Set-DbaLogin function.

Returned: success, but not in check_mode.

Authors

  • John McCall (@lowlydba)