Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

1
vote
1answer
35 views

Wildcard subnet mask for IPv6

To allow any host to connect to PostgreSQL we can use the IPv4 wildcard subnet mask: 0.0.0.0/0 I need this to setup my PostgreSQL's pg_hba.conf file correctly. What is the IPv6 equivalent?
0
votes
1answer
15 views

Setup mySQL in a chroot in Debian Wheezy

Sounds like a simple question, but the documentation is rare about what mySQL needs to run inside a chroot. I think I'm almost there, but I'm running into a permission problem that I can't solve, and ...
0
votes
1answer
28 views

SQL Server xp_cmdshell: account's access changed - how to avoid restarting the service?

A T-SQL script is running an xp_cmdshell call to stop a local service through Powershell's Stop-Service, say, like this: exec xp_cmdshell 'powershell Stop-Service -InputObject (get-Service -Include ...
1
vote
0answers
26 views

SQL Server Logs > Windows NT > Security

I don't know how to trace down what is happening on one of our SQL Servers. If I look in the Windows NT > Security section of the SQL Server Logs I see the same three entries repeated every minute. ...
0
votes
1answer
21 views

Audit DML operations on MySQL Tables

We have several MySQL 5.0 databases. We've been having security problems, like records being modified without authorization. We need to implement some kind of audit on DML operations identifying ...
2
votes
1answer
39 views

What does role db_owner allow

I have been trying to troubleshoot a login that is not able to view certain tables in a SQL Server 2012 database. In doing so I find I don't quite understand what membership in the db_owner role ...
3
votes
1answer
37 views

SQL Agent Permissions - Job Level

We currently have an SQL Job that runs an SSIS package. The output of the package is required for a report. As a result, the application that can create the report on demand first tries to run the ...
1
vote
3answers
74 views

Block user access to certain tables

DBMS allows the admin to grant table access to a user using something like: GRANT ALL ON mydb.mytbl1, mydb.mytbl2 TO 'someuser'@'somehost'; However, is it possible to grant all tables to a user and ...
3
votes
1answer
50 views

Row Level security or Multiple Tables

Im looking for documentation on best practices for the following scenario. A hosted application contains some "global" data and some "Per-tenant" data. A "Tenant" should have no access to another ...
1
vote
1answer
42 views

Map a Login to a User that was Created Without Mapping to a Login

This question has been asked before, but I didn't see any answer (http://stackoverflow.com/questions/6468813/assign-a-login-to-a-user-created-without-login-sql-server) How does one map a login to a ...
2
votes
0answers
62 views

Database Design - Multiple Dbs or Single - Security & Data

I've hit a brick wall with this and just cannot make a decision so want to throw this out there and see if there are any issues I have'n't considered. Basic Topography I have a system that currently ...
0
votes
0answers
13 views

Application Role and access second database

I have written a script to create an audit trails to my database in a second one db. So far I had no problems during tests on my dev machine from SQL Server Management Studio. Problems started to ...
1
vote
2answers
78 views

SQL Server Login to access tables of three different database from single database

I have created a login in SQL Server 2008 R2 and given access to run stored procedures in that database only. But this stored procedure is actually accessing data from other two databases to which ...
2
votes
0answers
25 views

User can create in SSRS, but can't manage objects

We have a user who can create, but is unable to manage objects in SSRS, even though he has content manager permissions and another user who has same permissions who is able to. It is SSRS 2008 R2, ...
2
votes
2answers
93 views

How do I map a SQL Server login to a user that already exists in a read-only database?

One of our database users complains that they can't select from one of the databases in this particualr instance while they have no problems in accessing others in this very same instance. The one ...
1
vote
0answers
7 views

How do mySQL and web-interface deal with hashed data

I've recently been given access to a mySQL database which will sit behind a website designed to allow people to register their interest in a given subject and provide further information about ...
0
votes
2answers
43 views

oracle database login information

In a database there is a username called u1, someone tried to access u1 but due to wrong password it got locked. How to find who did this suspicious activity.
3
votes
1answer
48 views

What is an effective way to wipe sensitive data on a data pages after dropping a table's column?

After dropping a column with sensitive data from a SQL Server table, the data still exists on the data and index pages. To ensure the protection of this data, it needs to be removed from the pages as ...
2
votes
1answer
37 views

Is MySQL secured?

When I go to directory of MySQL C:\ProgramData\MySQL\MySQL Server 5.1\data all database can see as folder. When I go into those folders I can see 3 file under one table. When I see those one by one ...
3
votes
1answer
136 views

CREATE DATABASE permission denied for sysadmin

I'm attempting to create a stored procedure that can be used as a proxy for creating databases where users do not have rights for creating databases. See Restricting Database Access/Functions to User ...
2
votes
2answers
69 views

Restricting Database Access/Functions to User Groups?

We've been having issues with Databases being DROPed or RESTOREd WITH REPLACE with the incorrect backup etc... I'm developing a plan right now on how to restrict access and I have some questions. ...
0
votes
0answers
41 views

Login failed for a user in a Domain Local Group

I have recently been considering moving from using SQL Logins in my applications, to a model using Windows Authentication using Active Directory groups My intention is to allow users access to ...
5
votes
3answers
281 views

What are some important security-related error codes / events to monitor?

I am setting up alerts in SQL Server and am interested in what events I should be raising alerts for. In particular, I am looking for any events related to security. I am already monitoring error ...
0
votes
1answer
24 views

MySQL Identifying Connection Attempt

I'm seeing the following errors repeatedly in the error log file for our production MySQL server: [Warning] Access denied for user 'root'@'remote.appserver.com' (using password: NO) So, I know ...
0
votes
0answers
19 views

User grants and functions in a replicated DB

I manage a MySQL DB with replication enabled (with binary logs). On this DB I have 2 users : one in read/write on the MASTER and one in read-only on the MASTER and the SLAVE. The developer who uses ...
5
votes
3answers
322 views

Restricting users to COPY ONLY backups

I am looking to deploy log shipping in my production environment. This will mean I will have to manage backup chains which could be disrupted by people taking backups to refresh development ...
4
votes
1answer
150 views

SQL logs showing login that I can't find

Within my SQL server logs, I am showing a successful login to a database from an account (SERVER\loginname) that I cannot find in either Security > Logins OR Database > Security > Users. This ...
2
votes
1answer
66 views

Security Question

Hello guys I have a question I have a group in that group a user shouldn't have syadmin permissions but he must be on that group. He has his login map by the group and his windows login on sql ...
0
votes
1answer
77 views

AES 256 data encryption on Mysql

Is there a way to encrypt the whole data of a mysql DB using the AES 256 symmetric encryption method without encrypting the data manually using AES_ENCRYPT ? This article explains about the same ...
0
votes
2answers
86 views

Hidden user rights

I'm running SQL Server 2008 R2 SP2. I have a SQL Server user, that the application uses to connect to my database. I've removed the user from all roles except public and the login from all database ...
1
vote
2answers
58 views

Is there a simple, safe and low cost way to implement a (limited) database to be outside (close) IT control?

This question is a spin off of the discussion here (What are the risks of building a database outside IT control?). Background: I'm a risk guy that builds little betas, mostly in Excel-VBA. I have a ...
2
votes
4answers
88 views

What are the risks of building a database outside IT control?

I've been looking for the best StackExchange community to ask this. I hope it fits well here. As a risk analyst in a trading business, I'm often confronted with large volumes of data, way beyond the ...
2
votes
1answer
87 views

Can comments in stored procedures cause problems

We're running a webserver that calls stored procedures to compute complex queries. Using sp_who2, we've discovered a peculiar issue where an abnormal number of processes would be stuck on SELECT state ...
1
vote
2answers
156 views

Securing Your MySQL Server within your team?

Recently I have been having an issue with our internal team members changing the password of the root user. I noticed the following things: OLD_PASSWORD = 1 (So all passwords on our development ...
1
vote
2answers
177 views

Numerous failed authentication attempts in error log

I'm having a hellacious time trying to figure out what is attempting to authenticate against a particular database server, running SQL Server 2008 R2 Standard Edition. The following is the error ...
1
vote
1answer
81 views

Create USER and LOGIN permissions

What permission should I give to a user or role so that it can Create Login or Create User in database.
3
votes
1answer
72 views

Secure database access from particular applications

I have an C#.NET application and a SQL Server database (SQL Server 2008 R2) and would like to restrict the access to some of the Tables when it has been accessed from some other application rather ...
1
vote
1answer
47 views

How dangerous is it to have a user's password in plaintext in a cgi script?

I am setting up a MySQL database and am providing a web interface for it. Now, the DB is extremely simple and the interface just runs certain SELECT statements. I have created a user for my script to ...
2
votes
2answers
481 views

SQL Job step run as different sql account

I'm curious how to set up a SQL job step to be executed as a different SQL login account. It appears I need to set up a New Proxy Account which requires an existing credential. When I create a ...
2
votes
1answer
54 views

How do I add a user that has read access to only ONE database?

I have two databases admin and testdb ; Added a user Alice in the test database db.addUser( { user: "Alice",pwd: "Moon1234",roles: [ "readWrite" ] } ); But when I login using the user Alice, I can ...
1
vote
2answers
61 views

Changing the SQL Server service account - any additional considerations?

I have inherited a few instances that are running under LocalSystem. I need to change this to a domain account as we are changing our backup strategy to go to a network share and then to tape and I ...
0
votes
2answers
69 views

Known vulnerabilities for when a guest executes a stored procedure on SQL Server

I have a production database with crucial business information. Meanwhile, my company is involved in a project with some other company and we have to exchange some information on a regular basis. How ...
1
vote
1answer
66 views

Secure postgresql database encryption

According to this answer, it's not possible to have a fully secure database encryption with pgcrypto. Now, 2 years later (in postgresql 9.3) is there any new extension or new method to have a ...
1
vote
2answers
96 views

Questions since MySQL Startup

Have a weird question / (bug?) here. Using PHP My Admin I installed via apt-get on Ubuntu 13.10 Versions are as follows: Server version: 5.5.35-0ubuntu0.13.10.2 - (Ubuntu) Apache/2.4.6 (Ubuntu) ...
2
votes
2answers
460 views

How to enable a SQL Server 2012 login to create, alter and drop the created databases?

I'm trying to assign a proper GRANT permission to CI login, that will be able to: Create test DB Alter it Drop this test DB (and only it) But it appears that SQL Server 2012 GRANT CREATE ANY ...
0
votes
0answers
80 views

Oracle data obfuscation on specific columns with set field sizes

Would like to obfuscate data held in Oracle tables, but: Requirements only apply to specific columns e.g. personal data obfuscated value should not be longer then column size possibly only ...
0
votes
1answer
21 views

Select permission to each table

I have three schemas Production, HRecourse and Sales,tables in every week create and drop , I have six Users P_User1, P_User2, HR_User1, HR_User2 and S_User1 and S_User2. I have to grant then how i ...
0
votes
1answer
98 views

CHROOT install after I already installed Mysql 5.6

I installed some time ago Mysql 5.6 on Ubuntu server 12.04 and now I'd like to enhance security by putting mysql into a CHROOT environment on that same Ubuntu server. Is this possible without ...
1
vote
0answers
88 views

Secure database design for web-based medical data application [closed]

Background: I am in the process of creating a database which contains medical information (patient-specific, likely identifiable). The treating doctors shall have access to the database via a ...
0
votes
1answer
128 views

PostgreSQL, storing encrypted data or encrypt database with pgcrypto - what is more secure? [duplicate]

I have two machines: client and server (a database server). I want to connect from client to server and manipulate data from database (insert, update, delete, select) using dblink. I would like to ...