Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

1
vote
1answer
58 views

Wildcard subnet mask for IPv6

To allow any host to connect to PostgreSQL we can use the IPv4 wildcard subnet mask: 0.0.0.0/0 I need this to setup my PostgreSQL's pg_hba.conf file correctly. What is the IPv6 equivalent?
0
votes
1answer
142 views

Do I need to explicitly grant permissions for a login under the sysadmin role for it to access a custom schema?

So I have a login that has sysadmin rights on the db server. However, it's not able to access database objects under a custom schema that was created (eg. it cannot select from tables with ...
0
votes
1answer
49 views

Audit DML operations on MySQL Tables

We have several MySQL 5.0 databases. We've been having security problems, like records being modified without authorization. We need to implement some kind of audit on DML operations identifying ...
1
vote
0answers
41 views

SQL Server Logs > Windows NT > Security [closed]

I don't know how to trace down what is happening on one of our SQL Servers. If I look in the Windows NT > Security section of the SQL Server Logs I see the same three entries repeated every minute. ...
2
votes
1answer
91 views

What does role db_owner allow

I have been trying to troubleshoot a login that is not able to view certain tables in a SQL Server 2012 database. In doing so I find I don't quite understand what membership in the db_owner role ...
1
vote
3answers
133 views

Block user access to certain tables

DBMS allows the admin to grant table access to a user using something like: GRANT ALL ON mydb.mytbl1, mydb.mytbl2 TO 'someuser'@'somehost'; However, is it possible to grant all tables to a user and ...
1
vote
1answer
128 views

Secure postgresql database encryption

According to this answer, it's not possible to have a fully secure database encryption with pgcrypto. Now, 2 years later (in postgresql 9.3) is there any new extension or new method to have a ...
3
votes
1answer
93 views

SQL Agent Permissions - Job Level

We currently have an SQL Job that runs an SSIS package. The output of the package is required for a report. As a result, the application that can create the report on demand first tries to run the ...
3
votes
1answer
133 views

Row Level security or Multiple Tables

Im looking for documentation on best practices for the following scenario. A hosted application contains some "global" data and some "Per-tenant" data. A "Tenant" should have no access to another ...
1
vote
1answer
245 views

Map a Login to a User that was Created Without Mapping to a Login

This question has been asked before, but I didn't see any answer (http://stackoverflow.com/questions/6468813/assign-a-login-to-a-user-created-without-login-sql-server) How does one map a login to a ...
2
votes
1answer
44 views

Is MySQL secured?

When I go to directory of MySQL C:\ProgramData\MySQL\MySQL Server 5.1\data all database can see as folder. When I go into those folders I can see 3 file under one table. When I see those one by one ...
0
votes
1answer
31 views

MySQL Identifying Connection Attempt

I'm seeing the following errors repeatedly in the error log file for our production MySQL server: [Warning] Access denied for user 'root'@'remote.appserver.com' (using password: NO) So, I know ...
2
votes
0answers
113 views

Database Design - Multiple Dbs or Single - Security & Data

I've hit a brick wall with this and just cannot make a decision so want to throw this out there and see if there are any issues I have'n't considered. Basic Topography I have a system that currently ...
1
vote
2answers
106 views

SQL Server Login to access tables of three different database from single database

I have created a login in SQL Server 2008 R2 and given access to run stored procedures in that database only. But this stored procedure is actually accessing data from other two databases to which ...
0
votes
0answers
23 views

Application Role and access second database

I have written a script to create an audit trails to my database in a second one db. So far I had no problems during tests on my dev machine from SQL Server Management Studio. Problems started to ...
2
votes
0answers
72 views

User can create in SSRS, but can't manage objects

We have a user who can create, but is unable to manage objects in SSRS, even though he has content manager permissions and another user who has same permissions who is able to. It is SSRS 2008 R2, ...
2
votes
2answers
1k views

How to enable a SQL Server 2012 login to create, alter and drop the created databases?

I'm trying to assign a proper GRANT permission to CI login, that will be able to: Create test DB Alter it Drop this test DB (and only it) But it appears that SQL Server 2012 GRANT CREATE ANY ...
2
votes
2answers
151 views

How do I map a SQL Server login to a user that already exists in a read-only database?

One of our database users complains that they can't select from one of the databases in this particualr instance while they have no problems in accessing others in this very same instance. The one ...
1
vote
0answers
12 views

How do mySQL and web-interface deal with hashed data

I've recently been given access to a mySQL database which will sit behind a website designed to allow people to register their interest in a given subject and provide further information about ...
-4
votes
3answers
954 views

How database administrators can see my requests to SQL Server?

I'm a SQL Server 2008 user. I have access to some tables. I need to request few columns from table as I usually do. But I need to do it once (for example) in 5 seconds and system administrators ...
3
votes
1answer
55 views

What is an effective way to wipe sensitive data on a data pages after dropping a table's column?

After dropping a column with sensitive data from a SQL Server table, the data still exists on the data and index pages. To ensure the protection of this data, it needs to be removed from the pages as ...
17
votes
8answers
4k views

Why is it a bad practice to allow everyone to use the sa login?

Even Microsoft discourages the use of SQL Server authentication mode, but our applications require it. I've read that it's a best practice to not let users use the sa login directly, instead using ...
15
votes
7answers
3k views

Why should an application not use the sa account

My first question ever, please be gentle. I understand that the sa account enables complete control over a SQL Server and all the databases, users, permissions etc. I have an absolute belief that ...
2
votes
2answers
109 views

Restricting Database Access/Functions to User Groups?

We've been having issues with Databases being DROPed or RESTOREd WITH REPLACE with the incorrect backup etc... I'm developing a plan right now on how to restrict access and I have some questions. ...
3
votes
1answer
420 views

CREATE DATABASE permission denied for sysadmin

I'm attempting to create a stored procedure that can be used as a proxy for creating databases where users do not have rights for creating databases. See Restricting Database Access/Functions to User ...
1
vote
2answers
73 views

Changing the SQL Server service account - any additional considerations?

I have inherited a few instances that are running under LocalSystem. I need to change this to a domain account as we are changing our backup strategy to go to a network share and then to tape and I ...
0
votes
2answers
1k views

Saving every mysql user login attempts

Is there a way to save the username and the IP from which the user tries to login to a MySQL server?? Enabling general-log seems to log everything but that seems to write too much details taking more ...
0
votes
0answers
106 views

Login failed for a user in a Domain Local Group

I have recently been considering moving from using SQL Logins in my applications, to a model using Windows Authentication using Active Directory groups My intention is to allow users access to ...
5
votes
3answers
322 views

What are some important security-related error codes / events to monitor?

I am setting up alerts in SQL Server and am interested in what events I should be raising alerts for. In particular, I am looking for any events related to security. I am already monitoring error ...
0
votes
0answers
27 views

User grants and functions in a replicated DB

I manage a MySQL DB with replication enabled (with binary logs). On this DB I have 2 users : one in read/write on the MASTER and one in read-only on the MASTER and the SLAVE. The developer who uses ...
6
votes
3answers
381 views

Restricting users to COPY ONLY backups

I am looking to deploy log shipping in my production environment. This will mean I will have to manage backup chains which could be disrupted by people taking backups to refresh development ...
2
votes
1answer
125 views

Security Question

Hello guys I have a question I have a group in that group a user shouldn't have syadmin permissions but he must be on that group. He has his login map by the group and his windows login on sql ...
0
votes
2answers
132 views

Hidden user rights

I'm running SQL Server 2008 R2 SP2. I have a SQL Server user, that the application uses to connect to my database. I've removed the user from all roles except public and the login from all database ...
1
vote
2answers
165 views

Securing Your MySQL Server within your team?

Recently I have been having an issue with our internal team members changing the password of the root user. I noticed the following things: OLD_PASSWORD = 1 (So all passwords on our development ...
2
votes
4answers
114 views

What are the risks of building a database outside IT control?

I've been looking for the best StackExchange community to ask this. I hope it fits well here. As a risk analyst in a trading business, I'm often confronted with large volumes of data, way beyond the ...
0
votes
2answers
2k views

Secure Linked Server - Non privledged user possible? Registry corruption?

Is it possible to use a non privledged Windows domain account to impersonate itself in a linked server? And why would it be unable to read the registry for available network protocols? Overview: ...
2
votes
1answer
99 views

Can comments in stored procedures cause problems

We're running a webserver that calls stored procedures to compute complex queries. Using sp_who2, we've discovered a peculiar issue where an abnormal number of processes would be stuck on SELECT state ...
4
votes
2answers
2k views

How to export all the security-related information from a SQL Server database

As you guys probably know, SQL Server does not provide an out-of-the-box solution to export all the security related statements that are declared for each element in the database (both at the database ...
1
vote
2answers
404 views

Numerous failed authentication attempts in error log

I'm having a hellacious time trying to figure out what is attempting to authenticate against a particular database server, running SQL Server 2008 R2 Standard Edition. The following is the error ...
2
votes
2answers
70 views

How to revert multiple impersonations?

When there are nested impersonations (as in exec as user = 'user1'; exec as user = 'user2'; exec as user = 'user1';), is there a way to revert all of them without having to use the revert command ...
3
votes
1answer
75 views

Secure database access from particular applications

I have an C#.NET application and a SQL Server database (SQL Server 2008 R2) and would like to restrict the access to some of the Tables when it has been accessed from some other application rather ...
1
vote
2answers
1k views

Protect SQL Server from hackers

Today, my SQL Server 2008 is attacked by hacker from IP address in China [4300 Login failure in last 7 hours]. I contacted GoDaddy support and below is what they told me. EXEC sp_readerrorlog 0, 1, ...
2
votes
4answers
1k views

SQL Server grant permissions to STANDBY database

So, first: the setup. We have SQL Server 2012 (ServerA) running in domain A. We have SQL Server 2012 (ServerB) running in domain B, separate subnet, no trusts. These are completely separate domains ...
0
votes
1answer
134 views

Best practices in securing Oracle Standard edition one [closed]

I have a database server with Oracle Standard Edition One. I'm interested what are the best practices to secure Oracle? I have Java web application installed in the same server. The Java application ...
4
votes
2answers
3k views

SELECT permission on view querying table from another database

SQL Server 2008 R2 SP1 My company uses the Great Plains (GP) financial system with several customizations. Our Value-Added-Reseller (VAR) for GP has setup most of these customizations in a separate ...
1
vote
1answer
97 views

Create USER and LOGIN permissions

What permission should I give to a user or role so that it can Create Login or Create User in database.
1
vote
1answer
55 views

How dangerous is it to have a user's password in plaintext in a cgi script?

I am setting up a MySQL database and am providing a web interface for it. Now, the DB is extremely simple and the interface just runs certain SELECT statements. I have created a user for my script to ...
2
votes
2answers
2k views

SQL Job step run as different sql account

I'm curious how to set up a SQL job step to be executed as a different SQL login account. It appears I need to set up a New Proxy Account which requires an existing credential. When I create a ...
2
votes
1answer
68 views

How do I add a user that has read access to only ONE database?

I have two databases admin and testdb ; Added a user Alice in the test database db.addUser( { user: "Alice",pwd: "Moon1234",roles: [ "readWrite" ] } ); But when I login using the user Alice, I can ...
0
votes
2answers
70 views

Known vulnerabilities for when a guest executes a stored procedure on SQL Server

I have a production database with crucial business information. Meanwhile, my company is involved in a project with some other company and we have to exchange some information on a regular basis. How ...