Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

5
votes
1answer
34 views

Find the source of a recurrent mass SQL edit on a server

I'll try to explain my problem as clear as possible. The server of a company I support runs many websites. This server runs Windows Server 2012 with Microsoft SQL Server 2014. Almost all of the ...
1
vote
1answer
30 views

How do I stop tables from being created in my mysql database?

I have noticed recently that some tables are being created in my mysql database by a rogue process. These tables typically have six letters followed by 32 (e.g. ernidt32). They just have one column ...
0
votes
0answers
17 views

Storing information in an online database securely whilst being able to access it through applications [on hold]

I am looking into making just a simple game for experience reasons, to learn about databases and storing the data online. However, how would I store the data in an database that is encrypted without ...
0
votes
1answer
14 views

How to fix MySQL anonymous account security issue?

How to fix this security issue on MySQL? [!!] User '@localhost' is an anonymous account.
0
votes
1answer
50 views

What is the best way to store SSH fingerprints and public keys?

I'm building a virtual Keyring in our DB to allow users to store PGP/GPG public keys with relation to email addresses so that they can optionally encrypt all communications our system sends them. I'm ...
0
votes
1answer
13 views

Sharing Databases and Tables between users in MySQL

I want to know how it is possible to share a database tables between multiple users/user groups, I mean, SQL Server has a security feature that we can create user groups and assign users to them, then ...
2
votes
0answers
7 views

InfluxDB - How can i limit the measures that an user can read by their tags?

I have some data that is collected by several sensors. Some users may own many of this sensors. So, i want to keep all the measures in a single database in InfluxDB. To differentiate the sensors i ...
1
vote
0answers
14 views

Security: direct remote access vs webinterface

I need to remotely connect to my (mongoDB) database and I currently allow direct access to the DB server port with user/pw login. I often read that this is generally a bad idea and that one should ...
6
votes
1answer
94 views

How can we have IIS talk to SQL Server with TLS1.0 disabled? [duplicate]

Background We need PCI-DSS compliance, and so must disable TLS1.0. In my test environment we have SQL Server 2014 SP1 with CU 1 (as per this post) and IIS 8 all on the same box. I used the Nartac ...
0
votes
1answer
17 views

Restricting info to SYS users - Oracle

Is it possible to restrict sensitive information from users having sysdba role? Does Data redaction help us in achieving this? I know we can restrict particular schemas to prevent from viewing from ...
3
votes
1answer
28 views

Is it dangerous to expose MongoDB's db.collection.find to users?

I know in SQL land people love referring to Little Bobby Tables as the main reason to have a very strict interface between your user base and your database. However, I want to implement a robust ...
2
votes
1answer
55 views

What are the consequences of dropping or changing the user name for the postgres DB account?

I feel confident I understand what's involved at the db level: If dropping, I'd need to create users for each sys admin, give them SUPERUSER, and then drop the postgres user. If changing the name, ...
3
votes
2answers
43 views

Enabling SQL Instant File Initialization when Restoring to a Network Path

We have a large Read Only SQL DB (SQL 2012) that we’re restoring to a NAS as a current duct tape solution. I had wondered why the restore process seemed to be hanging. Part of my guidance along the ...
0
votes
1answer
55 views

How to disable all password requirements in Oracle?

When I try to create a new database using DBCA it stops me because my password isn't complex enough. I am working with Oracle in a VirtualBox VM on my own laptop, so I don't need the password ...
0
votes
0answers
12 views

PostgreSQL: Recommended way of user creation/management for development, test and production. I use Ruby on Rails

I am trying to think of the best (aka recommended or common professional practice) way to create users/roles in PostgreSQL database for development, test and production environments. I have to say ...
7
votes
2answers
123 views

Transparent Data Encryption

Are there any best practices when configuring TDE in SQL Server 2008? On SQLMag, the article "Transparent Data Encryption FAQs" says the CPU may have increased usage by up to 30%? Other than adding ...
1
vote
2answers
29 views

Is there any danger in granting SUPER privileges to a user?

I had problems in restoring procedures in my db, so what I did was to grant SUPER privileges to my dbuser. This user is the same user used in my web application, so I would like to know if there is ...
0
votes
0answers
16 views

Minimum permissions to modify a job owned by someone else [duplicate]

We have a development team that historically has managed it's own SQL Server jobs. We would like to continue to let them do this but historically they have had sysadmin and we don't want them to have ...
-2
votes
2answers
74 views

Random numeric string as a primary key - security, performance, efficiency?

I'm building an app aimed to store lots of records (millions) and trying to find a best way to store records identifiers that is publicly accessible from the web (record URL). I'd like to get: ...
2
votes
2answers
49 views

Should I drop MS_DataCollectorInternalUser in msdb?

From SQL Server 2008, there is a user in msdb called MS_DataCollectorInternalUser. This user has no login associated with this and can be considered as a orphan user. It's a security best practice to ...
2
votes
2answers
142 views

SQL Server logins and users — assign multiple logins to a single user? [duplicate]

In SSMS, since I can't assign multiple login objects to a single user object, what is a best practice to achieve an equivalent security model? For example, I have 20 logins and want to give them all ...
0
votes
1answer
59 views

SQL Server 2014 - how to grant access to all objects (except for a few exceptions) in a database for a Database role?

In SQL Server 2014, I want to create a role that will have accesses (select, delete, update, insert, execute) to all the tables, views, stored procedures, except a certain list of tables that contain ...
0
votes
1answer
48 views

Cannot fix ERROR:ORA-01031: insufficient privileges

I have tried almost every solution on the internet however I still cannot fix this problem. I cannot login as sysdba every time I try SQL>connect /as sysdba I get the error ERROR:ORA-01031: ...
-1
votes
1answer
43 views

Password protected Database Engine with Server features and Store procedure [closed]

I like MS access password protect feature but it does not useful for server based software like as SQLite which has password protect but not useful for server. MS SQL server is one of the best DB ...
0
votes
1answer
28 views

Set Default Maximum Rows for Export

I am more of a Vertica database user than admin, so I'm not even sure if what I'm asking is absurd, but here goes nothing... Could I, as an admin, put default restrictions on the number of rows that ...
1
vote
1answer
24 views

SQL Server 2008 job failure

I have a problem on my servers sitting on different domains. I created a linked server that executes successfully and I can list the catalogue but when I schedule a job to execute I get this error: ...
1
vote
2answers
87 views

Is Database Mail worth the risk / a standard practice

I enabled Database Mail XPs and was testing it on my dev machine. I was just wondering if the DB Mail is a bad security choice, and if it more secure (or standard practice) to send this kind of ...
0
votes
2answers
52 views

Difference between TDE/VPD/Data Masking/OLS - Oralce

I've come across many kinds of data masking techniques used in Oracle database.. some are licensed some are included in enterprise edition itself.. leaving the licenses thing behind as it is ...
1
vote
1answer
56 views

I am getting a failed login message in the SQL Server error logs however, nothing actually failed?

I have a server which runs third party software (called Visualcut) to email Crystal Reports to our users. When I log onto the Visualcut Server, I can open the software and then preview a report. This ...
1
vote
0answers
88 views

PostgreSQL DML statements

I am trying to trick an application into executing a DML statement AFTER starting a SELECT statement without using stacked queries so I cannot use the ; character anywhere in my query. I have resorted ...
0
votes
1answer
71 views

Is it possible to know the remaining 'expiration of sql login password date' & ‘maximum password age’ through T-SQL

I would like to say that today incident whatever i have faced related to Microosft SQL Server 2012. I had logged in Microsoft SQL Server 2012 at starting working hour of office time ,but at the mid of ...
0
votes
0answers
33 views

Good Book for professional database design [duplicate]

I am currently working on a project with some friends and we are hoping to make a business out of it. We are at the database design phase and as a learning source I am using "An Introduction to ...
1
vote
0answers
80 views

Secure view on row level with custom security tables

Let's say I have a following table that lists all member of my application. CREATE TABLE dbo.Member ( MemberId BIGINT, LoginName NVARCHAR(64), SecurityRole NVARCHAR(64) ) I assume that ...
1
vote
0answers
28 views

MySQL can't connect as user with password locally

I am running into a strange authentification issue. Users can't connect to MySQL locally using a password, but they can without one. mysql -h localhost -u someuser -psomepassword won't work ...
1
vote
1answer
47 views

Permission in schema for user

I created a default database and created some schemas within this database. Created users for each schema, now I want to give full permission for each user in your schema only, how should I do?
1
vote
2answers
310 views

Locking SYS and SYSTEM Accounts

In the interest of keeping the database as secure as possible, I'd like to lock the SYS and SYSTEM accounts so that no one can login with them. Assuming that: There are no OS scripts/cron jobs ...
0
votes
0answers
8 views

impact on Nodejs app - Disable Server-Side Execution of JavaScript --noscripting

What does the startup option --noscripting do exactly? What is the impact on a Nodejs app? What does not work anymore if we Disable Server-Side Execution of JavaScript? The admin guys are the only ...
3
votes
2answers
160 views

SQL Server - How to protect against SQL Injection when dealing with a Dynamic WHERE clause passed to a Stored Procedure

Given the following stored procedure, can I protect against SQL injection in the supplied additional WHERE condition? CREATE PROCEDURE [dbo].[ProtectDynamicWhereClause] (@TableName varchar(50), ...
7
votes
0answers
166 views

SQL Server 2012 Compatibility with New TLS 1.2 Standards [duplicate]

I'm trying to switch off TLS 1.0 on my SQL Server 2012 server in order to comply with PCI standards. Initially I had some trouble with the SQL Server service not starting. I found help for this ...
6
votes
2answers
103 views

Scripting an application role with a hashed password

I need to script an application role with a hashed password, so I can copy it from one database to another. Consider the following example code, which uses an Application Role to provide elevated ...
2
votes
2answers
52 views

Asking SQL schema by FOIA

I've sent FOIA requests to various public institutions in my area. I'm only asking for the schema of the SQL databases their financial services might be using (column name for every table for every ...
1
vote
1answer
35 views

powershell problem when running on a remote server - access is denied

as a follow up from this question below: Run a PowerShell script on a different server - from inside a SQL Server job there you can see that for me tu run a powershell script from inside a sql ...
1
vote
1answer
28 views

Application specific users table or mysql.users

I am using a mysql installation that handles an application with multiple users. These users have varying permissions for table access, but also need to be referenced within tables in the application ...
3
votes
1answer
96 views

SQL Server 2008 : force user to change password at next login

How can I force users to change their password at next login? I want all my user change their password at next login to choose new password with new policy. user must change password at next login ...
3
votes
1answer
337 views

Do NT Service accounts need to be SysAdmin when using Domain Accounts

I'm not sure if I'm googling for the wrong thing but I can't find an answer. We're running SQL 2014. The SQL Server and SQL Agent processes are both running under Domain Managed Service Accounts. ...
1
vote
1answer
53 views

How to restrict table access to a application

I would like to know how I would go about restricting access to a table so that only a certain application can access the data within. Where I work, we have a database application that rather ...
-2
votes
1answer
39 views

Allowing non-sysadmin users to see SQL Server execution plans

Is this possible ? On SQL Server 2012+, grant access to a non sysadmin user to see the execution plans ? And can this be done for selected databases only ?
0
votes
1answer
93 views

Alter user - is password stored in audit trails

I was asked an interesting question the other day and I have not been able to find a definitive answer. If one of my DBA's changes a password, will the password the password show up in plain text in ...
3
votes
1answer
36 views

SQL Server Agent logs in as guest on a linked server

I have a job called @test_credentials which runs the following query select * from openquery(SERVER2, 'select USER_NAME(),* from openquery(SERVER1,''SELECT USER_NAME() '')') and outputs those ...
6
votes
1answer
341 views

Azure: Many Failed Login Attempts Logged

I run a SQL Server on an Azure Virtual Machine. I have noticed in the Event Logs of the server lots of failed SQL Login attempts using a ton of different usernames (none of which exist): Login ...