Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

6
votes
2answers
1k views

SSRS appears to be ignoring Permissions set using Report Manager

I have setup SSRS on SQL Server 2008 in native mode. As an administrator I can login to report manager, upload reports and run them, and also use the Web Service URL to generate reports. I have also ...
5
votes
4answers
198 views

How do I tactfully bring up database shortcomings? [closed]

A little background: I recently inherited responsibility for support and development of a database application after the original developers left. Looking through the application, the database ...
5
votes
3answers
969 views

Does the PCI standard forbid the use of Windows Authentication?

We currently use Mixed Mode for our SQL Server Authentication. I've tried to convince our DBA to allow us to use Windows Authentication so we can use Team Foundation Server, however he absolutely ...
5
votes
3answers
21k views

How to get rid of ORA-28002 message the password will expire within 6 days?

I have a user getting an ORA-28002 indicating that the password will expire within six days. I ran the following: ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED; But when I try to log ...
5
votes
3answers
442 views

Using the sysadmin role with EXECUTE AS

It is my understanding that I can use the EXECUTE AS OWNER clause as part of a procedure that I create to make the body of that procedure run as a different user. My goal is to execute a command that ...
5
votes
3answers
330 views

What are some important security-related error codes / events to monitor?

I am setting up alerts in SQL Server and am interested in what events I should be raising alerts for. In particular, I am looking for any events related to security. I am already monitoring error ...
5
votes
2answers
2k views

Is there any benefit to having one sql server login for multiple users?

I just entered a development project where the developers use the same SQL Server login to connect to a central database for their work. I have never come across this before, as each dev usually has ...
5
votes
2answers
3k views

Restricting database access per IP addresses

I have filtered IP addresses to an access DB server like this: Set the sqlnet.ora tcp.validnode_checking = YES tcp.invited_nodes = (localhost, 192.168.100.130, 192.168.100.186) But in my ...
5
votes
1answer
380 views

Is a Named Instance more Secure than the Default Instance?

I realize that you can change the default instance from the default port of 1433, and equally you can make named instances use static ports as opposed to dynamic ports, but in general are named ...
5
votes
2answers
4k views

The SELECT permission was denied on the (View) object after explicit grant select on view to user

I have a database with a View Named '1098Statement' We are doing testing for an application with user name 'appuser'. I have tried the following solutions to granting select on the view and keep ...
5
votes
2answers
424 views

Stored Procedure as Create Table proxy?

With SQL Server it was my understanding, I thought, that you could elevate a users permissions with specific constraints. For example, you need a user to create a specific table object in a specific ...
5
votes
2answers
3k views

How do I configure SQL Server 2012 so that it can restore and see files in my user account?

I have an SQL Server 2012 instance running as a service on my computer, and according to the service page it logs on as account "NT Service\MSSQLSERVER". However I can't see that account name ...
5
votes
1answer
98 views

How is SQL Server host identity ensured?

When I connect to some e-commerce website with my browser I use HTTPS that uses a certificate that (more or less) guarantees that example.com is indeed example.com. Now I connect to a SQL Server ...
5
votes
2answers
2k views

RSExecRole missing

I have multiple servers and 4 of them have reporting services installed with the ReportServer & ReportServerTempDB databases. A few days ago I was setting up security for a new login and I found ...
5
votes
1answer
361 views

SQL Server Security Hierarchy

I have been working as a developer with SQL Server for years without asking the question, "what is dbo", a shame. Recently I have been studying the security model of SQL Server 2008. I have been ...
5
votes
1answer
2k views

What's the difference between EXECUTE AS USER and EXECUTE AS LOGIN that makes the second one behave unexpectedly?

Recently I've been using EXECUTE AS LOGIN to check if a certain person could or couldn't use a table function in one of our databases. The tests showed that he could but he repeatedly reported ...
5
votes
1answer
1k views

Cross Database Chaining vs. Trustworthy Option

Recently, we had a stored proc request that required access across multiple databases. Of course this is not uncommon to have but in our case, earlier we used service accounts and this service account ...
5
votes
1answer
192 views

SQL logs showing login that I can't find

Within my SQL server logs, I am showing a successful login to a database from an account (SERVER\loginname) that I cannot find in either Security > Logins OR Database > Security > Users. This ...
5
votes
1answer
204 views

SA permissions issues with many nested objects

I have a broker application that's relatively complicated. Today, after I made some changes, I started getting the error: The server principal 'sa' is not able to access the database 'XYZ' under ...
5
votes
3answers
1k views

How does “Be made using the login's current security context” pass the users password to remote server

Say you have a SQL Server with a "Linked Server" to another server - said "Linked Server" is set to use "Be made using the login's current security context" as its authentication model. How does the ...
5
votes
1answer
440 views

TFS 2012 - Database Project - User with NO LOGIN map to Windows - best practices

I have a SQL Server Database Project (.NET 4.5) in TFS 2012. As a DBA, i'm looking for a mechanism whereby the developers can create 'CREATE USER' sql scripts and assign their permissions within the ...
5
votes
2answers
301 views

SQLAgentReaderRole and SQL AD ID login case affecting ability to edit jobs

I have AD ID users on a SQL 2008 server that can't edit their own jobs. They can create them, but in order to edit them, they have to delete them and then re-add them. The issue is explained here: ...
5
votes
1answer
954 views

Using integrated security over VPN

We've got a client that we're going to allow to use one of our applications. Staff on site regularly connect to our network via VPN. The .Net application that connects to the SQL Server uses ...
5
votes
1answer
430 views

How can I make the audit system create new audit files if they already exist?

I am trying to make my audit files easier to read, I have audit trail configured as xml,extended. The problem is that if my server gets busy and reuses the pids - the logs are being appended to the ...
4
votes
3answers
2k views

Best practices to encrypt all the data

I'm working in a project, where the client is afraid their own employees (ie.: junior I.T. guys who the client does not trust) querying the database to get sensitive information. The database is a ...
4
votes
2answers
909 views

Securely generate a UNIQUEIDENTIFIER in SQL Server

I intend to be using a UNIQUEIDENTIFIER as an access key that users can use to access certain data. The key will act as a password in that sense. I need to generate multiple such identifiers as part ...
4
votes
3answers
1k views

Is it ever harmful to set a database owner in SQL Server?

There are a bunch of databases on one of our SQL servers that have no owner. Generally speaking, is it harmful to give them one? For example: USE dbName; GO EXEC sp_changedbowner 'sa'; GO I know ...
4
votes
2answers
3k views

Can we minimise the risk of using xp_cmdshell?

Using xp_cmdshell can be quite helpful and sometimes possibly the only answer to some scenarios. I've read some posts on the internet that enabling xp_cmdshell might jeopardize the security of the ...
4
votes
2answers
152 views

What are the risks (if any) of sharing a service account on more than one server?

I use domain accounts for SQL Server service accounts. Sometimes, when I have multiple servers that are logically or thematically related, I'll use the same set of domain accounts for the service ...
4
votes
1answer
162 views

Security Question involving Sys tables

We have an application user which has been given read write to the appropriate databases. This user has the ability to query the sys tables by default. I've also heard that there are times when this ...
4
votes
2answers
125 views

Easily give role in one database access to tables in another database on the same server

I have a database server (Sql Server 2008 R2 Enterprise) supporting two separate but related vendor products, each with it's own database (call them X and Y) In database X I a have a lot of users ...
4
votes
2answers
2k views

SQL Server EXECUTE AS trouble

I'm missing something while trying to make my stored procedure use EXECUTE AS. The stored procedure is reading data from source_db, aggregates it and stores result in target_db. The sp itself is in ...
4
votes
2answers
324 views

How to detach a sql server 2008 database that is not in database list?

I installed sql server 2008 on windows 7 then i create a Database! after 2 days, i reinstall the windows and isntall the sql server! now i am trying to attach my database file, bot i encounter to ...
4
votes
4answers
1k views

How to securely connect app and database servers?

(Updated) For a start, I have my app and database on separate servers. It's easy to connect them, except I am not sure how to secure my database server. Here's what I've already done: Ran ...
4
votes
1answer
2k views

Cross-database call fails in a job but succeeds in SSMS

I create two databases, a table in the second database and a stored procedure in the first database. The stored procedure cross-database accesses the table. I create a sql server login and I also map ...
4
votes
2answers
390 views

different login credentials based on user

I run a PHP symfony-framework web app for my company and it uses a single database login for all connections, whether the user is an admin or a client. I know that higher security systems often use ...
4
votes
2answers
2k views

How to export all the security-related information from a SQL Server database

As you guys probably know, SQL Server does not provide an out-of-the-box solution to export all the security related statements that are declared for each element in the database (both at the database ...
4
votes
2answers
1k views

Linked Server Risks

I'm implementing a new feature which requires data from databases on multiple servers. I just need to union data from all these servers and sort it. The two options that come to mind are: Use linked ...
4
votes
1answer
120 views

Security implications of guest account and database chaining on sql server?

I have another database Ydb accessing data in database Kdb. They both have the same owner. In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb. I did so ...
4
votes
2answers
2k views

Role db_ddladmin not working properly on SQL Server 2008

I want to allow certain user to create/modify objects on a database(tables, views, sp's, functions, schemas etc) and don't want to give db_owner. I thought I could do it with the db_ddladmin role, ...
4
votes
1answer
343 views

SQL Server 2008 encrypted connection using multiple server names

I have a SQL Server that must be accessed using various DNS names (SQL1, sql1.contoso.local, sql1.contoso.com, etc) and I'm struggling with creating a correct SSL certificate that can be used to ...
4
votes
2answers
651 views

Integrated Security Success on Master, Fails on Other Database

I'm a bit perplexed as to why my connection string is selectively succeeding on the master database in SQL Server 2005. Here are the details of my app. Any ideas where to look? I'm clearly missing ...
4
votes
2answers
5k views

Users cannot view tables in non-default schema in SSMS

I'm having an issue setting the VIEW DEFINITION permission appropriately at the schema level for one of my users. I've created the schema TestSchema and added some tables. The user currently has ...
4
votes
1answer
2k views

How do you disable anonymous login? - MySQL

According to the MySQL documentation, you can harden a MySQL server by adding passwords, or removing the anonymous accounts. If you want to prevent clients from connecting as anonymous users ...
4
votes
2answers
4k views

SELECT permission on view querying table from another database

SQL Server 2008 R2 SP1 My company uses the Great Plains (GP) financial system with several customizations. Our Value-Added-Reseller (VAR) for GP has setup most of these customizations in a separate ...
4
votes
2answers
1k views

How to obtain SIDs of Sql Server installed NT Service Accounts

I am using WMI to obtain members of server local groups, as well as the SIDs of the members. The WQL queries work for members that are local users, local groups, AD domain users and AD domain groups. ...
4
votes
1answer
217 views

DB Master Key Encrypted By *Correct* Service Master Key?

My client has frequently run process where we move databases from a prod environment to lower environments (refresh QA with prod database, etc). These DBs have database master keys on them. We have ...
3
votes
7answers
15k views

Can't Login to SQL Server 2008 when running single user mode

I'm following the MS documentation here to migrate logins from one instance of SQL Server to another as part of the process described here. This involves putting the server into single user mode ...
3
votes
3answers
4k views

SQL Server: does ddladmin rights contain datareader and datawriter rights to the database?

Does db_ddladmin fixed database role include db_datareader and db_datawriter rights, so that you don't have to grant those rights explicitly?
3
votes
2answers
161 views

Prevent SysAdmin from doing a Database Restore

I am a sysadmin on my SQL Server 2008, and I need to be, but I would like to setup my security on the Production server to prevent me from accidentally restoring to the production database. I ...