Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

1
vote
0answers
2k views

EXECUTE AS over Linked Servers

I have a front end that logs into the DB as "logInA", and only has permission to "schemaA" stored procs, which use EXECUTE AS "logInB", (I have also tried EXECUTE AS 'DBO'), to handle all the business ...
1
vote
1answer
244 views

set right permission to get connection ip for a user mapped to login

I have a problem with properly settings the rights permissions for my user to get access to connections ips. I know that, to get the conn ip I must set the VIEW SERVER STATE to the login that I use ...
0
votes
2answers
115 views

Difference between TDE/VPD/Data Masking/OLS - Oralce

I've come across many kinds of data masking techniques used in Oracle database.. some are licensed some are included in enterprise edition itself.. leaving the licenses thing behind as it is ...
2
votes
2answers
2k views

Creating a database under a different owner

I'm trying to set up a role in Postgres which can a) Create a new Role b) Create a new Database c) Make that new Role the owner of the database d) Have no other rights (as far as is possible!) I have ...
11
votes
1answer
2k views

Does sys.sql_logins.is_policy_checked mean that the policy has been checked?

When I look in sys.sql_logins, I see a column called is_policy_checked. Can I trust that my password policy has been checked for all of the logins where this column value is 1?
10
votes
2answers
78k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which ...
4
votes
2answers
9k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
1
vote
0answers
101 views

PostgreSQL DML statements

I am trying to trick an application into executing a DML statement AFTER starting a SELECT statement without using stacked queries so I cannot use the ; character anywhere in my query. I have resorted ...
0
votes
1answer
501 views

Passing passwords more securely to mysql utilities on the command line

This question is related to another question I subsequently asked here: Using the output from mysqldiff.exe to transform database2 to match database1. I have been trying to use mysqldiff.exe, part of ...
0
votes
1answer
106 views

Is it possible to know the remaining 'expiration of sql login password date' & ‘maximum password age’ through T-SQL

I would like to say that today incident whatever i have faced related to Microosft SQL Server 2012. I had logged in Microsoft SQL Server 2012 at starting working hour of office time ,but at the mid of ...
1
vote
0answers
86 views

Secure view on row level with custom security tables

Let's say I have a following table that lists all member of my application. CREATE TABLE dbo.Member ( MemberId BIGINT, LoginName NVARCHAR(64), SecurityRole NVARCHAR(64) ) I assume that ...
0
votes
0answers
33 views

Good Book for professional database design [duplicate]

I am currently working on a project with some friends and we are hoping to make a business out of it. We are at the database design phase and as a learning source I am using "An Introduction to ...
1
vote
0answers
709 views

ORACLE SSL using Microsoft Certificate Store for PKI

I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store. Client: Windows 7 64 bit with Oracle client 11.2.0.3.0 Server: Windows 2008 R2 64 bit with ...
1
vote
0answers
28 views

MySQL can't connect as user with password locally

I am running into a strange authentification issue. Users can't connect to MySQL locally using a password, but they can without one. mysql -h localhost -u someuser -psomepassword won't work ...
2
votes
2answers
629 views

Locking SYS and SYSTEM Accounts

In the interest of keeping the database as secure as possible, I'd like to lock the SYS and SYSTEM accounts so that no one can login with them. Assuming that: There are no OS scripts/cron jobs ...
2
votes
1answer
1k views

How to properly secure MySQL database?

We have a web application based on the famous triad apache + php + mysql which we sell to our customers and gets installed on their servers. Currently, we are using MySQL 5.1.41 which has only a ...
6
votes
2answers
143 views

Scripting an application role with a hashed password

I need to script an application role with a hashed password, so I can copy it from one database to another. Consider the following example code, which uses an Application Role to provide elevated ...
0
votes
0answers
10 views

impact on Nodejs app - Disable Server-Side Execution of JavaScript --noscripting

What does the startup option --noscripting do exactly? What is the impact on a Nodejs app? What does not work anymore if we Disable Server-Side Execution of JavaScript? The admin guys are the only ...
68
votes
6answers
8k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
-2
votes
1answer
49 views

Allowing non-sysadmin users to see SQL Server execution plans

Is this possible ? On SQL Server 2012+, grant access to a non sysadmin user to see the execution plans ? And can this be done for selected databases only ?
3
votes
2answers
191 views

SQL Server - How to protect against SQL Injection when dealing with a Dynamic WHERE clause passed to a Stored Procedure

Given the following stored procedure, can I protect against SQL injection in the supplied additional WHERE condition? CREATE PROCEDURE [dbo].[ProtectDynamicWhereClause] (@TableName varchar(50), ...
4
votes
2answers
110 views

Is there a way to grant SELECT for every database (including new ones) at a server level?

I have a unique (well, I think it is unique) situation where databases (yes, entire databases) can be created more or less dynamically. Ignoring the obvious issue with that, I need to be able to ...
2
votes
2answers
56 views

Asking SQL schema by FOIA

I've sent FOIA requests to various public institutions in my area. I'm only asking for the schema of the SQL databases their financial services might be using (column name for every table for every ...
0
votes
1answer
19 views

What does the presence of rsAccessDenied mean?

I'm troubleshooting a SSRS security issue where one user is being denied access, while another user with apparently identical settings is working as expected. I'm seeing "The permissions granted to ...
3
votes
1answer
170 views

SQL Server 2008 : force user to change password at next login

How can I force users to change their password at next login? I want all my user change their password at next login to choose new password with new policy. user must change password at next login ...
1
vote
1answer
30 views

Application specific users table or mysql.users

I am using a mysql installation that handles an application with multiple users. These users have varying permissions for table access, but also need to be referenced within tables in the application ...
1
vote
1answer
62 views

How to restrict table access to a application

I would like to know how I would go about restricting access to a table so that only a certain application can access the data within. Where I work, we have a database application that rather ...
14
votes
2answers
10k views

How do you reset the sa password?

I lost the sa password on a machine, and when I log in to the machine directly using an account in the admin group, SQL Server Management Studio will not allow me to log in using Windows ...
0
votes
1answer
173 views

Alter user - is password stored in audit trails

I was asked an interesting question the other day and I have not been able to find a definitive answer. If one of my DBA's changes a password, will the password the password show up in plain text in ...
3
votes
1answer
51 views

Is it safe to use set-returning sql functions instead of security-barrier views?

Since 9.2, it's been possible to use the security_barrier attribute to guard against maliciously-chosen functions and operators accessing data 'hidden' behind filters in views (full info in the ...
3
votes
1answer
40 views

SQL Server Agent logs in as guest on a linked server

I have a job called @test_credentials which runs the following query select * from openquery(SERVER2, 'select USER_NAME(),* from openquery(SERVER1,''SELECT USER_NAME() '')') and outputs those ...
6
votes
1answer
437 views

Azure: Many Failed Login Attempts Logged

I run a SQL Server on an Azure Virtual Machine. I have noticed in the Event Logs of the server lots of failed SQL Login attempts using a ton of different usernames (none of which exist): Login ...
0
votes
0answers
25 views

Ways for a Windows Administrator to get sysadmin [duplicate]

Based on a question why Builtin\Administrators don't get sysadmin by default, I want to ask which ways are known to get sysadmin rights as a normal windows Administrator without any given rights ...
6
votes
2answers
3k views

Linked Server Risks

I'm implementing a new feature which requires data from databases on multiple servers. I just need to union data from all these servers and sort it. The two options that come to mind are: Use linked ...
10
votes
3answers
7k views

Is there a way to find out who changed the password for a login?

I am trying to find out who changed the password for a login in SQL Server 2008 R2. I have already checked default trace - and it does not log that event. The default trace will include these ...
2
votes
1answer
3k views

SQL admin Scripts - Enabling read only access to all databases

I would like a script that will allow our web developers read only access to all databases on our SQL server. Currently we are having to do this manually as we have no SQL expert / DB Admin. Would ...
2
votes
1answer
94 views

How to find out if anything is running as or relies upon a user account in anyway before removing it?

Running SQL Server 2008. So I need to get around to removing an old users account, but I'm worried that just disabling or deleting it right away might cause some things to stop working properly if ...
-1
votes
1answer
928 views

Why does fn_my_permissions return empty rowset? [closed]

If I run this query: select * From fn_my_permissions(NULL, 'SERVER') This is what I'm getting: entity_name subentity_name permission_name ------------- --------------- ...
6
votes
2answers
205 views

SQL Server 2012 - SA account probe

On one of my servers (Win 2012 R2), SQL Server 2012 is constantly under attack with the SA account being hit like 10 times per second with different passwords. I don't have an SA account but still I ...
5
votes
3answers
25k views

Grant create permission on a specific schema in Oracle 11g

I have two users A and B. I want to grant B the permission to create, drop, etc. all tables in A's schema. As far as I can see, I can grant B full access to all schemas not a specific one. Is this ...
0
votes
1answer
71 views

MySQL transaction and replication between two datacenters

I'm using a master MySQL in an east coast data center and want to setup a replication server on a west coast data center. The app server on the west coast may at times need to write to the master. ...
1
vote
1answer
1k views

How to change the login for a database's dbo user?

I just finished a successful install of SQL Server 2014 Express, onto a domain-joined VM instance of Win8.1. During setup which I ran under DOMAIN\Admin I accepted the default configuration of adding ...
0
votes
1answer
56 views

What are the user privileges required to for an ssrs report owner to 'send email'

Yes, this question is a duplicate to: SSRS - rsAccessDenied error but that question is 2 years old and unanswered...so I thought I might try again. Our DBA has recently departed leaving ...
2
votes
2answers
85 views

Why would sp_helprolemember show different MemberSID for same member?

Have two databases on same SQL Server instance. If I run EXEC sp_helprolemember I get different MemberSID values for dbo on each. (the 2nd half of the SID is different, the start is the same) db #1 ...
0
votes
1answer
47 views

How to determine effective permissions and how granted for a local or domain account

With SQL Server - if you have a local or domain user (including accounts like LOCAL SYSTEM) how can you determine What effective permissions they have on a database How those permissions are ...
1
vote
0answers
29 views

Domain Alias for Azure Databases [duplicate]

I have 3 databases on Azure's cloud, all with domains names such as xxxxxxxx.database.windows.net. Would it be a bad idea to create domain name aliases for all 3, things such as: database.domain.com ...
1
vote
0answers
75 views

SQL Server 2012 restrict CmdExec to sysadmin server role

I'm trying to restricting CmdExec rights to sysadmin server role in SQL Server 2012. I've googled but just found some solution which they were for older version of SQL Server. Can you please help?
2
votes
2answers
430 views

AES 256 data encryption on Mysql

Is there a way to encrypt the whole data of a mysql DB using the AES 256 symmetric encryption method without encrypting the data manually using AES_ENCRYPT ? This article explains about the same ...
1
vote
1answer
115 views

Allow multiple users to see procedures and functions

I have GRANT ALL PRIVILEGES ON `test1`.* TO 'admin'@'%', GRANT ALL PRIVILEGES ON `test1`.* TO 'devel'@'%' (from SHOW GRANTS FOR some_user) and I have created simple procedure as admin in test1. And ...
1
vote
2answers
202 views

Sending a database dump

Quite new to db admin here and I have a quick question. I am collaborating with another colleague off site and they would like me to send them a dump of our (1.5GB sql db) database via email as they ...