Allowing users to access only the data they are authorized to access.
3
votes
2answers
981 views
SELECT permission on view querying table from another database
SQL Server 2008 R2 SP1
My company uses the Great Plains (GP) financial system with several customizations. Our Value-Added-Reseller (VAR) for GP has setup most of these customizations in a separate ...
10
votes
2answers
240 views
Understanding MS SQL Server encryption and backups
So I was asking in chat about how secure SQL Server backup files are.
I'm told that if an attacker has access to the .bak file unencrypted that they can have access to the data.
So lets look at ...
5
votes
1answer
160 views
Map Oracle roles to Active Directory groups?
Is there any built-in way to map Oracle database roles to Microsoft Active Directory groups?
6
votes
1answer
350 views
Login to SQL Server 2k8 R2 SP1 via Active Directory Group
I added an Active Directory group as a Windows Authentication Login to our SQL Server 2008 R2 database.
When a user who is a member of that group tries to connect to the server he is given a login ...
1
vote
2answers
485 views
Login Failed for User
I have written a code in Visual Studio.NET and used data from SQL Server 2008. But after debugging, it says:
Login failed for user 'sunny'.
When I try to set the user as something else, it keeps ...
5
votes
2answers
110 views
Most effective way to determine the minimum set of permissions for user
I have a database that an application connects to using db_owner permissions.
How do I effectively determine the minimum set of requirements actually needed by this user (application) to run without ...
1
vote
1answer
204 views
Creating a User to access multiple databases
Is it possible in SQL server to create a User without a Login that can access multiple databases?
I am creating a user setting up a service broker queue and the receiver of the message needs to be ...
3
votes
1answer
258 views
Log shipping setup across domains
I'm running SQL Server 2008 R2 on a Windows machine.
I've been tasked with setting up log shipping between our production site (managed by a service provider) and our QA environment which is hosted ...
8
votes
1answer
239 views
Column level security
I am in need of a solution to hide specific columns in a table. We have people who need to build reports against this database and specifically some of these tables with confidential information but ...
1
vote
0answers
187 views
ORACLE SSL using Microsoft Certificate Store for PKI
I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store.
Client: Windows 7 64 bit with Oracle client 11.2.0.3.0
Server: Windows 2008 R2 64 bit with ...
1
vote
3answers
617 views
MySQL SSL disabled on Windows
I want to enable an SSL connection to my database. I've created SSL certificates and so on, however SSL remains disabled:
mysql> show variables like '%ssl%';
...
2
votes
1answer
82 views
I would like to better understand the SQL Server security model in terms of users and groups to possibly replace an XML heirarchy model I am using
I am currently using XML in my database to represent metadata for individual products. I am using the below schema to enter the data. In each sub grouping of fields you will notice the cms_name ...
0
votes
2answers
401 views
Secure way to connect: Windows Authentication or SQL Server Authentication and why?
Which is the best way to create a connection string for SQL Server?
Should I be using a trusted connection string (windows authentication) or an untrusted connection string (sql server ...
3
votes
1answer
511 views
Designing An ACL Based Permission System
I am trying to create a permissions system where everything is going to be stored in MySQL (or some database) and pulled using PHP for a project management system I am building. I am right now trying ...
5
votes
2answers
185 views
SQLAgentReaderRole and SQL AD ID login case affecting ability to edit jobs
I have AD ID users on a SQL 2008 server that can't edit their own jobs. They can create them, but in order to edit them, they have to delete them and then re-add them. The issue is explained here: ...
3
votes
3answers
299 views
Changing the port of the postgresql server for security reasons
For security reasons, it is common to change the port of Microsoft Sql Server.
The subject is discussed here in Is changing the SQL Server port really that much safer?
my question is: does this apply ...
1
vote
1answer
89 views
MySQL Database Temporarily Compromised?
Two days ago, I had connected to my ClearDB test server with MySQL workbench. I had left this workbench open and when I had checked it today, there were two new schemas named "test_justin" and ...
45
votes
5answers
3k views
Do stored procedures prevent SQL injection?
Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
4
votes
3answers
9k views
How to get rid of ORA-28002 message the password will expire within 6 days?
I have a user getting an ORA-28002 indicating that the password will expire within six days. I ran the following:
ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED;
But when I try to log ...
6
votes
2answers
2k views
Listing the existing SQL Server Logins and Users
I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script.
I ran the query below but it shows Principal_id which ...
2
votes
1answer
276 views
SQL Server 2005 - Map login to pre-existing user
The short of it is that we have several databases that are synchronized between two failover instances. The primary contains logins that are mapped to the users in the databases, and everything's ...
3
votes
2answers
2k views
Cannot access any database in SQL Server 2008 R2 Express after moving workstation from domain to workgroup
My workstation that has SQL Server 2008 R2 Express for development purposes installed has been moved out of a domain into a Windows workgroup. While being part of the domain I used the account ...
2
votes
1answer
57 views
Should Crystal Report be allowed for certain employees for production database?
I am talking about production database. There are couple of people who use crystal on daily basis for various types of reports. Some use it to just peak at the data, other generate reports of it. ...
3
votes
1answer
82 views
What is recommended level of security for a production database?
I have a production database on our local server. Currently there are two many logins to the database, about 20, half of them are windows authenticated and the other rest are SQL Server authenticated. ...
7
votes
2answers
1k views
Can Windows Authentication logins be disabled on SQL Server 2008 (or R2)?
So we can do Windows Login or Mixed Mode, but can we configure SQL Server to only use internal logins and to block all Windows Logins?
Is the only solution to add all potential Windows logins and set ...
1
vote
0answers
1k views
Error Authenticating Proxy Account when Executing SSIS job
I have a SQL Server instance that runs 5 scheduled tasks each night, each of which run SSIS packages.
These packages have been running for years and the associated steps run via a Proxy Account ...
3
votes
0answers
73 views
Security implications of guest account and database chaining on sql server?
I have another database Ydb accessing data in database Kdb. They both have the same owner.
In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb.
I did so ...
0
votes
0answers
92 views
Oracle VPD Implementation?
Our team is implementing VPD into the already existing Schema. The application is currently used by one customer and in order to generalize the application we need to implement VPD in our schema. The ...
3
votes
1answer
59 views
Administration of MySQL Users
What is the best practice for keeping and maintaining MySQL users? Say for example I have 5 programmers and a PHP application connecting to a database. Should I create 6 different users 1 for each ...
2
votes
2answers
307 views
What could trigger that a login created from a certificate is not visible in metadata
I am trying to create a login and grant it rights to run and unsafe assembly but the check on server_principals does not return the login when it already exists. The script works perfectly fine on my ...
5
votes
1answer
510 views
Cross Database Chaining vs. Trustworthy Option
Recently, we had a stored proc request that required access across multiple databases. Of course this is not uncommon to have but in our case, earlier we used service accounts and this service account ...
2
votes
1answer
961 views
SQL admin Scripts - Enabling read only access to all databases
I would like a script that will allow our web developers read only access to all databases on our SQL server.
Currently we are having to do this manually as we have no SQL expert / DB Admin.
Would ...
2
votes
2answers
733 views
Best practices to secure mysql
I don't have that much knowledge about mysql and i would like to secure a MySQL server.
We have a few VPS running around the world (6 currently) and they all need to store information in our mySQL ...
2
votes
2answers
192 views
Attacks on Postgresql listening for requests on 'localhost'
I am using jboss server for my servlets and the postgresql as the database server, listening on port 5432 on localhost. My jboss server is bound to a public IP. I want to know that since my postgesql ...
6
votes
2answers
255 views
Is it safe to run antivirus software on my database servers?
Some implementations of antivirus software are known to Microsoft to cause a variety of problems for SQL Server, and Microsoft has a support article dedicated just to picking the right antivirus ...
2
votes
0answers
629 views
Reconcile users with logins using 'sp_change_users_login'
Sql Server 2008 (and 2005):
I have a Sql Server instance, let's say, InstA, in a Domain (called AD). In that I have a domain Windows Authentication Login, called AD\Log1 that has an associated user, ...
2
votes
1answer
299 views
User in multiple windows groups mapped to sql logins
I have two C# apps with Windows Auth to Microsoft SQL Server 2008 R2.
For every app:
SQL login based on Windows Group is created
SQL server login is mapped to SQL database user
user is member of a ...
6
votes
1answer
547 views
SQL Server, remove all users' access right to a table object
As a clean up job, I am trying to remove all users' (including non public users) access right to a single table object (apart from superusers) and will subsequently grant new access rights. Is there a ...
0
votes
1answer
70 views
Can MySQL be patched
I just saw a note about a security issue in MySQL so thought that I'd better patch my test server just in case. The MySQL site is not very helpful and a quick google revealed lots of people asking how ...
5
votes
2answers
123 views
MySQL Permissions Necessary To Reset Password
On my team there is a desire for some users to periodically update their MySQL password.
Our MySQL server is shared between a few projects (and certain users are assigned to certain projects). If I'm ...
1
vote
1answer
57 views
Oracle DB administrator-specific security features
Yesterday I was presenting an internet banking solution to a potential client management. My offer is based on using MS SQL Server 2008 RDBMS.
One of the client's officers mentioned, that Oracle's ...
0
votes
1answer
154 views
How to troubleshoot/debug Oracle permission problems
An application is connecting to Oracle to do stuff. It's not working but I don't get any ORA errors in the application itself. I'm thinking its a permission problem. So my question is what is the best ...
0
votes
0answers
200 views
Provide a URL to a CouchDB document attachment without giving the username/password? [closed]
Sorry for not being clear, I will elaborate all the points here in this edit. Also I had to take out some URLs provided by jcolebrand because of new user spam prevention -_- really StackExchange? its ...
1
vote
1answer
171 views
When was the syslogin's password last updated?
In SQL Server, I see there's a field in syslogins titled "updatedate" which is a timestamp of the last time the login was updated.
What constitutes an "update"?
My goal is to only get a timestamp ...
4
votes
1answer
417 views
How do I find out *why* a user has certain effective permissions?
I know that I can query effective permissions by using sys.fn_my_permissions:
USE myDatabase;
SELECT * FROM fn_my_permissions('dbo.myTable', 'OBJECT')
entity_name | subentity_name | ...
2
votes
1answer
162 views
unreachable SQL Server for a group of computers
I'm deploying SQL Server 2008 Express in my company. I already installed, did a application, tested, gave permission to user.
All desktop users run the program without any problem. But the notebook ...
0
votes
0answers
41 views
Database security through stored procedures [duplicate]
Possible Duplicate:
Do stored procedures prevent SQL injection?
I'm curious about some database security techniques I've been learning in class recently.
Namely, I have implemented a SQL ...
1
vote
1answer
484 views
User has no password set
I see these when running MySQLTuner.pl:
-------- Security Recommendations -------------------------------------------
[!!] User '@debian' has no password set.
[!!] User '@localhost' has no password ...
4
votes
2answers
952 views
Is there any benefit to having one sql server login for multiple users?
I just entered a development project where the developers use the same SQL Server login to connect to a central database for their work. I have never come across this before, as each dev usually has ...
2
votes
1answer
836 views
Cross-database call fails in a job but succeeds in SSMS
I create two databases, a table in the second database and a stored procedure in the first database. The stored procedure cross-database accesses the table. I create a sql server login and I also map ...
