Allowing users to access only the data they are authorized to access.
4
votes
1answer
128 views
Can I retrieve all database objects owned by a particular user?
We have a user who is leaving and I need to know every database object that he owns. Is there a query that will provide this information?
4
votes
4answers
548 views
SQL Server script to delete accounts no longer in Active Directory
We have a SQL Server 2000 that will shortly be migrated to SQL Server 2005. It has years of Windows Authentication accounts created that no longer exist in Active Directory, which prevent the Copy ...
3
votes
1answer
326 views
Does this mean the 'public' has full select, insert, update, and delete access?
I'm trying to create a new DB user in SQL Server 2008 R2 that can only select from one SQL View. But no matter what I try when I login as this new user I can select from any table. I ran this query: ...
2
votes
2answers
299 views
Securely Send Database Mail via an Insert Trigger
I have spent about 30 hours so far trying to get sp_send_dbmail to work. I finally got SOMETHING to work, but I have serious doubts as to its security. I would like know a method which is better yet ...
1
vote
0answers
223 views
How do I configure SQL Server 2012 so that it can restore and see files in my user account?
I have an SQL Server 2012 instance running as a service on my computer, and according to the service page it logs on as account "NT Service\MSSQLSERVER". However I can't see that account name ...
0
votes
1answer
139 views
Saving every mysql user login attempts
Is there a way to save the username and the IP from which the user tries to login to a MySQL server??
Enabling general-log seems to log everything but that seems to write too much details taking more ...
5
votes
1answer
119 views
SQL Server Security Hierarchy
I have been working as a developer with SQL Server for years without asking the question, "what is dbo", a shame. Recently I have been studying the security model of SQL Server 2008. I have been ...
1
vote
1answer
201 views
How to properly secure MySQL database?
We have a web application based on the famous triad apache + php + mysql which we sell to our customers and gets installed on their servers.
Currently, we are using MySQL 5.1.41 which has only a ...
2
votes
1answer
56 views
Searching transaction logs for changes
I currently have a database with an attached CMS. The CMS has about 50+ people with various permission levels that can log in etc... I would like to know if there is a way I can look at the ...
2
votes
1answer
88 views
Create MS SQL login for support engineer to access only vendor database
I have sql server 2005,
I need to create separate database login to support engineer of my software vendor to access their own database. My only worry is deny him to take backup from our database ...
1
vote
1answer
144 views
Can't grant role permissions under sysadmin login
I'm trying to execute this script from Management Studio:
GRANT ALTER ON ROLE::[AdaptTemplate] TO [AdaptAdmin] AS [AdminSapr]
Execution fails with this message:
Msg 15151, Level 16, State 1, ...
2
votes
1answer
342 views
What are SQL Server Securables?
I migrated two applications to the new server. One of the them works without any issues but the other ran into back end sql permission problems like
The EXECUTE permission was denied on the ...
1
vote
1answer
65 views
Does Microsoft Security Bulletin MS11-049 affect SQL Server 2008 SP3?
The security bulletin does not list SQL Server 2008 SP3 under affected software but it came out prior to that service pack. We are running SP3 but this issue is still showing up on a vulnerability ...
2
votes
1answer
178 views
Understanding SQL Server encryption (by password)?
After asking this I still have a question.
A company need to store sensitive data. Please let's not talk about certificate right now.
A DBA does the following :
CREATE SYMMETRIC KEY ...
4
votes
1answer
146 views
SQL Server 2008 encrypted connection using multiple server names
I have a SQL Server that must be accessed using various DNS names (SQL1, sql1.contoso.local, sql1.contoso.com, etc) and I'm struggling with creating a correct SSL certificate that can be used to ...
2
votes
1answer
662 views
Security permission to only read SSAS Cube with Excel
I have an SSAS database set up on a SQL Server 2008 server. I have a Role set up with a group of users that I want to be able to access the Cubes in that database. I set up "Read definition" and ...
3
votes
2answers
132 views
Integrated Security Success on Master, Fails on Other Database
I'm a bit perplexed as to why my connection string is selectively succeeding on the master database in SQL Server 2005. Here are the details of my app. Any ideas where to look? I'm clearly missing ...
3
votes
1answer
195 views
SQL Server 2008 R2 Express password overwrite
I'm using a program that requires SA log-in to SQL Server. We had issues where some 3rd party support numpty changed the SA password and never informed us, so the program couldn't log-in.
I've ...
1
vote
1answer
106 views
Using multiple Active Directory accounts to connect to SQL Server
I have web applications (Classic ASP and .NET) that connect to SQL Server using SQL authentication. Each one has their own login. I want to convert these to Windows Authentication. The new AD users (1 ...
2
votes
1answer
572 views
Grant select to dbo view without select on non dbo tables
SQL Server 2008 R2
We have a login & user called "JoeBlogs", this user has it's own default schema of JoeBlogs - it has Public access only to the database.
We then granted it SELECT on a dbo ...
1
vote
2answers
133 views
correct security and user setup for SQL Server database
I am currently on setting a sql server database on a database server. A front end web application running off a web server communicates to the database.
What is the best approach for setting up users ...
1
vote
3answers
396 views
Encrypt/Decrypt output & input for SSIS task
I use SSIS packages to output the data from one system as Comma Separated Values, and then import that same data into a second system. I have a new requirement to encrypt the CSV text files that are ...
1
vote
0answers
81 views
PhpMyAdmin: UploadDir & SaveDir
Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755.
I am the only one using phpmyadmin, but still, could I make this tighter?
Thanks
PHP 5.3.3 ...
1
vote
1answer
56 views
System test Database user management
We are in development stage and to be able to give the developers an integration test environment, we need to give them access to the database, they can share and test their code in the system ...
1
vote
1answer
77 views
SQL Server Schema Security
I have a user U in a database where I want it to be able to create types and stored procs in a specified schema say UserSchema but not be able to alter schema dbo. So I created the schema and also ...
2
votes
1answer
58 views
How can I deny a user the ability to Alter DB files and options but still allow schema and data modifications?
I'm establishing a shared development instance for multiple single-database applications.
I'm envisioning granting authorized users permissions to allow any schema and data modifications they need to ...
4
votes
1answer
101 views
Security Question involving Sys tables
We have an application user which has been given read write to the appropriate databases. This user has the ability to query the sys tables by default. I've also heard that there are times when this ...
8
votes
4answers
272 views
Potential risks of users connecting to SQL Server, through Excel, as sysadmin?
I recently discovered that a large swath of the finance department is using Excel to connect to my SQL Server 2000 instance with an account in the sysadmin role. What are my current risks that I ...
7
votes
1answer
295 views
Choice of authentication approach for financial app on PostgreSQL
First some background.
The LedgerSMB project is an open source financial accounting software project that runs on PostgreSQL. We implement a very large amount of business logic in user defined ...
1
vote
2answers
582 views
Exception Details: System.Data.SqlClient.SqlException: Login failed for user
One of our user from another domain WATSON received the following error message:
Exception Details: System.Data.SqlClient.SqlException: Login failed for user 'WATSON\User1'.
when he is trying to ...
5
votes
1answer
312 views
What's the difference between EXECUTE AS USER and EXECUTE AS LOGIN that makes the second one behave unexpectedly?
Recently I've been using EXECUTE AS LOGIN to check if a certain person could or couldn't use a table function in one of our databases. The tests showed that he could but he repeatedly reported ...
2
votes
2answers
376 views
Encrypt MySQL database on a Linux VPS?
I'm working on a rails app for our church, which stores some fairly sensitive information about our people in a MySQL database.
We have our own windows server running Hyper-V so the original ...
3
votes
2answers
977 views
SELECT permission on view querying table from another database
SQL Server 2008 R2 SP1
My company uses the Great Plains (GP) financial system with several customizations. Our Value-Added-Reseller (VAR) for GP has setup most of these customizations in a separate ...
10
votes
2answers
239 views
Understanding MS SQL Server encryption and backups
So I was asking in chat about how secure SQL Server backup files are.
I'm told that if an attacker has access to the .bak file unencrypted that they can have access to the data.
So lets look at ...
1
vote
2answers
484 views
Login Failed for User
I have written a code in Visual Studio.NET and used data from SQL Server 2008. But after debugging, it says:
Login failed for user 'sunny'.
When I try to set the user as something else, it keeps ...
5
votes
2answers
110 views
Most effective way to determine the minimum set of permissions for user
I have a database that an application connects to using db_owner permissions.
How do I effectively determine the minimum set of requirements actually needed by this user (application) to run without ...
1
vote
1answer
204 views
Creating a User to access multiple databases
Is it possible in SQL server to create a User without a Login that can access multiple databases?
I am creating a user setting up a service broker queue and the receiver of the message needs to be ...
3
votes
1answer
258 views
Log shipping setup across domains
I'm running SQL Server 2008 R2 on a Windows machine.
I've been tasked with setting up log shipping between our production site (managed by a service provider) and our QA environment which is hosted ...
5
votes
1answer
160 views
Map Oracle roles to Active Directory groups?
Is there any built-in way to map Oracle database roles to Microsoft Active Directory groups?
8
votes
1answer
238 views
Column level security
I am in need of a solution to hide specific columns in a table. We have people who need to build reports against this database and specifically some of these tables with confidential information but ...
2
votes
1answer
82 views
I would like to better understand the SQL Server security model in terms of users and groups to possibly replace an XML heirarchy model I am using
I am currently using XML in my database to represent metadata for individual products. I am using the below schema to enter the data. In each sub grouping of fields you will notice the cms_name ...
6
votes
1answer
350 views
Login to SQL Server 2k8 R2 SP1 via Active Directory Group
I added an Active Directory group as a Windows Authentication Login to our SQL Server 2008 R2 database.
When a user who is a member of that group tries to connect to the server he is given a login ...
1
vote
1answer
89 views
MySQL Database Temporarily Compromised?
Two days ago, I had connected to my ClearDB test server with MySQL workbench. I had left this workbench open and when I had checked it today, there were two new schemas named "test_justin" and ...
0
votes
2answers
401 views
Secure way to connect: Windows Authentication or SQL Server Authentication and why?
Which is the best way to create a connection string for SQL Server?
Should I be using a trusted connection string (windows authentication) or an untrusted connection string (sql server ...
6
votes
2answers
2k views
Listing the existing SQL Server Logins and Users
I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script.
I ran the query below but it shows Principal_id which ...
3
votes
3answers
299 views
Changing the port of the postgresql server for security reasons
For security reasons, it is common to change the port of Microsoft Sql Server.
The subject is discussed here in Is changing the SQL Server port really that much safer?
my question is: does this apply ...
3
votes
2answers
297 views
SQL Server EXECUTE AS trouble
I'm missing something while trying to make my stored procedure use EXECUTE AS. The stored procedure is reading data from source_db, aggregates it and stores result in target_db.
The sp itself is in ...
7
votes
1answer
135 views
Dynamic Dimension Security
I have a cube in SSAS 2012 with about 30 dimensions, one of which is Company.
The Company dimension contains a list of companies, of which there are several hundred in the cube. Our security model ...
3
votes
2answers
2k views
Cannot access any database in SQL Server 2008 R2 Express after moving workstation from domain to workgroup
My workstation that has SQL Server 2008 R2 Express for development purposes installed has been moved out of a domain into a Windows workgroup. While being part of the domain I used the account ...
2
votes
1answer
57 views
Should Crystal Report be allowed for certain employees for production database?
I am talking about production database. There are couple of people who use crystal on daily basis for various types of reports. Some use it to just peak at the data, other generate reports of it. ...
