Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

2
votes
2answers
306 views

SQL Server logins and users — assign multiple logins to a single user? [duplicate]

In SSMS, since I can't assign multiple login objects to a single user object, what is a best practice to achieve an equivalent security model? For example, I have 20 logins and want to give them all ...
0
votes
1answer
76 views

Cannot fix ERROR:ORA-01031: insufficient privileges

I have tried almost every solution on the internet however I still cannot fix this problem. I cannot login as sysdba every time I try SQL>connect /as sysdba I get the error ERROR:ORA-01031: ...
4
votes
1answer
5k views

Rights to execute stored procedure, but not read underlying tables directly

I have a stored procedure that contains lots of different columns from many different tables; I want to give 20 users access to the results of the stored procedure via Excel. Is it possible to make ...
4
votes
2answers
1k views

What are the risks (if any) of sharing a service account on more than one server?

I use domain accounts for SQL Server service accounts. Sometimes, when I have multiple servers that are logically or thematically related, I'll use the same set of domain accounts for the service ...
0
votes
1answer
31 views

Set Default Maximum Rows for Export

I am more of a Vertica database user than admin, so I'm not even sure if what I'm asking is absurd, but here goes nothing... Could I, as an admin, put default restrictions on the number of rows that ...
3
votes
2answers
538 views

MySQL: Securing Access using Stored Procedures

I'm new to using MySQL. I'd like to use stored procedures to help secure my database when accessing it from a web service (i.e., grant only proc execute to the web service account). What permissions ...
1
vote
2answers
200 views

Is Database Mail worth the risk / a standard practice

I enabled Database Mail XPs and was testing it on my dev machine. I was just wondering if the DB Mail is a bad security choice, and if it more secure (or standard practice) to send this kind of ...
1
vote
1answer
25 views

SQL Server 2008 job failure

I have a problem on my servers sitting on different domains. I created a linked server that executes successfully and I can list the catalogue but when I schedule a job to execute I get this error: ...
1
vote
0answers
2k views

EXECUTE AS over Linked Servers

I have a front end that logs into the DB as "logInA", and only has permission to "schemaA" stored procs, which use EXECUTE AS "logInB", (I have also tried EXECUTE AS 'DBO'), to handle all the business ...
1
vote
1answer
254 views

set right permission to get connection ip for a user mapped to login

I have a problem with properly settings the rights permissions for my user to get access to connections ips. I know that, to get the conn ip I must set the VIEW SERVER STATE to the login that I use ...
0
votes
2answers
129 views

Difference between TDE/VPD/Data Masking/OLS - Oralce

I've come across many kinds of data masking techniques used in Oracle database.. some are licensed some are included in enterprise edition itself.. leaving the licenses thing behind as it is ...
2
votes
2answers
2k views

Creating a database under a different owner

I'm trying to set up a role in Postgres which can a) Create a new Role b) Create a new Database c) Make that new Role the owner of the database d) Have no other rights (as far as is possible!) I have ...
11
votes
1answer
2k views

Does sys.sql_logins.is_policy_checked mean that the policy has been checked?

When I look in sys.sql_logins, I see a column called is_policy_checked. Can I trust that my password policy has been checked for all of the logins where this column value is 1?
10
votes
2answers
80k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which ...
4
votes
2answers
9k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
1
vote
0answers
104 views

PostgreSQL DML statements

I am trying to trick an application into executing a DML statement AFTER starting a SELECT statement without using stacked queries so I cannot use the ; character anywhere in my query. I have resorted ...
0
votes
1answer
546 views

Passing passwords more securely to mysql utilities on the command line

This question is related to another question I subsequently asked here: Using the output from mysqldiff.exe to transform database2 to match database1. I have been trying to use mysqldiff.exe, part of ...
0
votes
1answer
117 views

Is it possible to know the remaining 'expiration of sql login password date' & ‘maximum password age’ through T-SQL

I would like to say that today incident whatever i have faced related to Microosft SQL Server 2012. I had logged in Microsoft SQL Server 2012 at starting working hour of office time ,but at the mid of ...
1
vote
0answers
88 views

Secure view on row level with custom security tables

Let's say I have a following table that lists all member of my application. CREATE TABLE dbo.Member ( MemberId BIGINT, LoginName NVARCHAR(64), SecurityRole NVARCHAR(64) ) I assume that ...
0
votes
0answers
33 views

Good Book for professional database design [duplicate]

I am currently working on a project with some friends and we are hoping to make a business out of it. We are at the database design phase and as a learning source I am using "An Introduction to ...
1
vote
0answers
729 views

ORACLE SSL using Microsoft Certificate Store for PKI

I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store. Client: Windows 7 64 bit with Oracle client 11.2.0.3.0 Server: Windows 2008 R2 64 bit with ...
1
vote
0answers
28 views

MySQL can't connect as user with password locally

I am running into a strange authentification issue. Users can't connect to MySQL locally using a password, but they can without one. mysql -h localhost -u someuser -psomepassword won't work ...
2
votes
2answers
712 views

Locking SYS and SYSTEM Accounts

In the interest of keeping the database as secure as possible, I'd like to lock the SYS and SYSTEM accounts so that no one can login with them. Assuming that: There are no OS scripts/cron jobs ...
2
votes
1answer
1k views

How to properly secure MySQL database?

We have a web application based on the famous triad apache + php + mysql which we sell to our customers and gets installed on their servers. Currently, we are using MySQL 5.1.41 which has only a ...
6
votes
2answers
157 views

Scripting an application role with a hashed password

I need to script an application role with a hashed password, so I can copy it from one database to another. Consider the following example code, which uses an Application Role to provide elevated ...
0
votes
0answers
12 views

impact on Nodejs app - Disable Server-Side Execution of JavaScript --noscripting

What does the startup option --noscripting do exactly? What is the impact on a Nodejs app? What does not work anymore if we Disable Server-Side Execution of JavaScript? The admin guys are the only ...
68
votes
6answers
8k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
-2
votes
1answer
52 views

Allowing non-sysadmin users to see SQL Server execution plans

Is this possible ? On SQL Server 2012+, grant access to a non sysadmin user to see the execution plans ? And can this be done for selected databases only ?
3
votes
2answers
207 views

SQL Server - How to protect against SQL Injection when dealing with a Dynamic WHERE clause passed to a Stored Procedure

Given the following stored procedure, can I protect against SQL injection in the supplied additional WHERE condition? CREATE PROCEDURE [dbo].[ProtectDynamicWhereClause] (@TableName varchar(50), ...
4
votes
2answers
113 views

Is there a way to grant SELECT for every database (including new ones) at a server level?

I have a unique (well, I think it is unique) situation where databases (yes, entire databases) can be created more or less dynamically. Ignoring the obvious issue with that, I need to be able to ...
2
votes
2answers
60 views

Asking SQL schema by FOIA

I've sent FOIA requests to various public institutions in my area. I'm only asking for the schema of the SQL databases their financial services might be using (column name for every table for every ...
0
votes
1answer
21 views

What does the presence of rsAccessDenied mean?

I'm troubleshooting a SSRS security issue where one user is being denied access, while another user with apparently identical settings is working as expected. I'm seeing "The permissions granted to ...
3
votes
1answer
211 views

SQL Server 2008 : force user to change password at next login

How can I force users to change their password at next login? I want all my user change their password at next login to choose new password with new policy. user must change password at next login ...
1
vote
1answer
30 views

Application specific users table or mysql.users

I am using a mysql installation that handles an application with multiple users. These users have varying permissions for table access, but also need to be referenced within tables in the application ...
1
vote
1answer
66 views

How to restrict table access to a application

I would like to know how I would go about restricting access to a table so that only a certain application can access the data within. Where I work, we have a database application that rather ...
14
votes
2answers
11k views

How do you reset the sa password?

I lost the sa password on a machine, and when I log in to the machine directly using an account in the admin group, SQL Server Management Studio will not allow me to log in using Windows ...
0
votes
1answer
202 views

Alter user - is password stored in audit trails

I was asked an interesting question the other day and I have not been able to find a definitive answer. If one of my DBA's changes a password, will the password the password show up in plain text in ...
3
votes
1answer
51 views

Is it safe to use set-returning sql functions instead of security-barrier views?

Since 9.2, it's been possible to use the security_barrier attribute to guard against maliciously-chosen functions and operators accessing data 'hidden' behind filters in views (full info in the ...
3
votes
1answer
45 views

SQL Server Agent logs in as guest on a linked server

I have a job called @test_credentials which runs the following query select * from openquery(SERVER2, 'select USER_NAME(),* from openquery(SERVER1,''SELECT USER_NAME() '')') and outputs those ...
6
votes
1answer
484 views

Azure: Many Failed Login Attempts Logged

I run a SQL Server on an Azure Virtual Machine. I have noticed in the Event Logs of the server lots of failed SQL Login attempts using a ton of different usernames (none of which exist): Login ...
0
votes
0answers
25 views

Ways for a Windows Administrator to get sysadmin [duplicate]

Based on a question why Builtin\Administrators don't get sysadmin by default, I want to ask which ways are known to get sysadmin rights as a normal windows Administrator without any given rights ...
6
votes
2answers
3k views

Linked Server Risks

I'm implementing a new feature which requires data from databases on multiple servers. I just need to union data from all these servers and sort it. The two options that come to mind are: Use linked ...
10
votes
3answers
7k views

Is there a way to find out who changed the password for a login?

I am trying to find out who changed the password for a login in SQL Server 2008 R2. I have already checked default trace - and it does not log that event. The default trace will include these ...
2
votes
1answer
3k views

SQL admin Scripts - Enabling read only access to all databases

I would like a script that will allow our web developers read only access to all databases on our SQL server. Currently we are having to do this manually as we have no SQL expert / DB Admin. Would ...
2
votes
1answer
95 views

How to find out if anything is running as or relies upon a user account in anyway before removing it?

Running SQL Server 2008. So I need to get around to removing an old users account, but I'm worried that just disabling or deleting it right away might cause some things to stop working properly if ...
-1
votes
1answer
943 views

Why does fn_my_permissions return empty rowset? [closed]

If I run this query: select * From fn_my_permissions(NULL, 'SERVER') This is what I'm getting: entity_name subentity_name permission_name ------------- --------------- ...
6
votes
2answers
209 views

SQL Server 2012 - SA account probe

On one of my servers (Win 2012 R2), SQL Server 2012 is constantly under attack with the SA account being hit like 10 times per second with different passwords. I don't have an SA account but still I ...
0
votes
1answer
75 views

MySQL transaction and replication between two datacenters

I'm using a master MySQL in an east coast data center and want to setup a replication server on a west coast data center. The app server on the west coast may at times need to write to the master. ...
1
vote
1answer
1k views

How to change the login for a database's dbo user?

I just finished a successful install of SQL Server 2014 Express, onto a domain-joined VM instance of Win8.1. During setup which I ran under DOMAIN\Admin I accepted the default configuration of adding ...
0
votes
1answer
67 views

What are the user privileges required to for an ssrs report owner to 'send email'

Yes, this question is a duplicate to: SSRS - rsAccessDenied error but that question is 2 years old and unanswered...so I thought I might try again. Our DBA has recently departed leaving ...