Acabei de descobrir sqsh que parece resolver o problema:
$ sqsh -S server:1433 -U sa
sqsh-2.1 Copyright (C) 1995-2001 Scott C. Gray
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
Password:
1> select * from sys.databases where name = 'master'
2> go -m vert
name: master
database_id: 1
source_database_id: NULL
owner_sid: 0x01
...
(1 row affected)