Allowing users to access only the data they are authorized to access.
3
votes
1answer
82 views
What is recommended level of security for a production database?
I have a production database on our local server. Currently there are two many logins to the database, about 20, half of them are windows authenticated and the other rest are SQL Server authenticated. ...
1
vote
0answers
1k views
Error Authenticating Proxy Account when Executing SSIS job
I have a SQL Server instance that runs 5 scheduled tasks each night, each of which run SSIS packages.
These packages have been running for years and the associated steps run via a Proxy Account ...
3
votes
0answers
73 views
Security implications of guest account and database chaining on sql server?
I have another database Ydb accessing data in database Kdb. They both have the same owner.
In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb.
I did so ...
0
votes
0answers
92 views
Oracle VPD Implementation?
Our team is implementing VPD into the already existing Schema. The application is currently used by one customer and in order to generalize the application we need to implement VPD in our schema. The ...
3
votes
1answer
592 views
The server principal “<mydbuser>” is not able to access the database “<mydatabase>” under the current security context
When I try to install a new database, I'm getting this error from SQL Server 2008.
The server principal "<mydbuser>" is not able to access the database "<mydatabase>" under the current ...
7
votes
2answers
1k views
Can Windows Authentication logins be disabled on SQL Server 2008 (or R2)?
So we can do Windows Login or Mixed Mode, but can we configure SQL Server to only use internal logins and to block all Windows Logins?
Is the only solution to add all potential Windows logins and set ...
3
votes
1answer
59 views
Administration of MySQL Users
What is the best practice for keeping and maintaining MySQL users? Say for example I have 5 programmers and a PHP application connecting to a database. Should I create 6 different users 1 for each ...
2
votes
2answers
307 views
What could trigger that a login created from a certificate is not visible in metadata
I am trying to create a login and grant it rights to run and unsafe assembly but the check on server_principals does not return the login when it already exists. The script works perfectly fine on my ...
4
votes
2answers
164 views
How to detach a sql server 2008 database that is not in database list?
I installed sql server 2008 on windows 7 then i create a Database! after 2 days, i reinstall the windows and isntall the sql server! now i am trying to attach my database file, bot i encounter to ...
2
votes
1answer
959 views
SQL admin Scripts - Enabling read only access to all databases
I would like a script that will allow our web developers read only access to all databases on our SQL server.
Currently we are having to do this manually as we have no SQL expert / DB Admin.
Would ...
2
votes
2answers
729 views
Best practices to secure mysql
I don't have that much knowledge about mysql and i would like to secure a MySQL server.
We have a few VPS running around the world (6 currently) and they all need to store information in our mySQL ...
6
votes
2answers
253 views
Is it safe to run antivirus software on my database servers?
Some implementations of antivirus software are known to Microsoft to cause a variety of problems for SQL Server, and Microsoft has a support article dedicated just to picking the right antivirus ...
2
votes
2answers
191 views
Attacks on Postgresql listening for requests on 'localhost'
I am using jboss server for my servlets and the postgresql as the database server, listening on port 5432 on localhost. My jboss server is bound to a public IP. I want to know that since my postgesql ...
2
votes
0answers
623 views
Reconcile users with logins using 'sp_change_users_login'
Sql Server 2008 (and 2005):
I have a Sql Server instance, let's say, InstA, in a Domain (called AD). In that I have a domain Windows Authentication Login, called AD\Log1 that has an associated user, ...
2
votes
1answer
298 views
User in multiple windows groups mapped to sql logins
I have two C# apps with Windows Auth to Microsoft SQL Server 2008 R2.
For every app:
SQL login based on Windows Group is created
SQL server login is mapped to SQL database user
user is member of a ...
1
vote
2answers
335 views
SQL Server 2008 R2 recognizes a domain account as a SQL Server account
After migrating from SQL Server 2000 to SQL Server 2008 R2, we have a few domain accounts that appear to the new server as SQL Server accounts. These accounts can SELECT from tables in the database ...
5
votes
1answer
510 views
Cross Database Chaining vs. Trustworthy Option
Recently, we had a stored proc request that required access across multiple databases. Of course this is not uncommon to have but in our case, earlier we used service accounts and this service account ...
6
votes
1answer
544 views
SQL Server, remove all users' access right to a table object
As a clean up job, I am trying to remove all users' (including non public users) access right to a single table object (apart from superusers) and will subsequently grant new access rights. Is there a ...
2
votes
1answer
276 views
SQL Server 2005 - Map login to pre-existing user
The short of it is that we have several databases that are synchronized between two failover instances. The primary contains logins that are mapped to the users in the databases, and everything's ...
0
votes
1answer
70 views
Can MySQL be patched
I just saw a note about a security issue in MySQL so thought that I'd better patch my test server just in case. The MySQL site is not very helpful and a quick google revealed lots of people asking how ...
5
votes
2answers
123 views
MySQL Permissions Necessary To Reset Password
On my team there is a desire for some users to periodically update their MySQL password.
Our MySQL server is shared between a few projects (and certain users are assigned to certain projects). If I'm ...
0
votes
1answer
154 views
How to troubleshoot/debug Oracle permission problems
An application is connecting to Oracle to do stuff. It's not working but I don't get any ORA errors in the application itself. I'm thinking its a permission problem. So my question is what is the best ...
1
vote
1answer
57 views
Oracle DB administrator-specific security features
Yesterday I was presenting an internet banking solution to a potential client management. My offer is based on using MS SQL Server 2008 RDBMS.
One of the client's officers mentioned, that Oracle's ...
0
votes
0answers
200 views
Provide a URL to a CouchDB document attachment without giving the username/password? [closed]
Sorry for not being clear, I will elaborate all the points here in this edit. Also I had to take out some URLs provided by jcolebrand because of new user spam prevention -_- really StackExchange? its ...
1
vote
1answer
171 views
When was the syslogin's password last updated?
In SQL Server, I see there's a field in syslogins titled "updatedate" which is a timestamp of the last time the login was updated.
What constitutes an "update"?
My goal is to only get a timestamp ...
4
votes
1answer
417 views
How do I find out *why* a user has certain effective permissions?
I know that I can query effective permissions by using sys.fn_my_permissions:
USE myDatabase;
SELECT * FROM fn_my_permissions('dbo.myTable', 'OBJECT')
entity_name | subentity_name | ...
0
votes
0answers
41 views
Database security through stored procedures [duplicate]
Possible Duplicate:
Do stored procedures prevent SQL injection?
I'm curious about some database security techniques I've been learning in class recently.
Namely, I have implemented a SQL ...
3
votes
2answers
155 views
Setting up users and admins with schema privileges
I currently have a database that is split into two schemas: data and ref. I have two database roles named Users and Admins. Users need to be able to INSERT, SELECT, UPDATE, and DELETE from the data ...
1
vote
1answer
483 views
User has no password set
I see these when running MySQLTuner.pl:
-------- Security Recommendations -------------------------------------------
[!!] User '@debian' has no password set.
[!!] User '@localhost' has no password ...
1
vote
0answers
187 views
ORACLE SSL using Microsoft Certificate Store for PKI
I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store.
Client: Windows 7 64 bit with Oracle client 11.2.0.3.0
Server: Windows 2008 R2 64 bit with ...
2
votes
1answer
162 views
unreachable SQL Server for a group of computers
I'm deploying SQL Server 2008 Express in my company. I already installed, did a application, tested, gave permission to user.
All desktop users run the program without any problem. But the notebook ...
4
votes
2answers
946 views
Is there any benefit to having one sql server login for multiple users?
I just entered a development project where the developers use the same SQL Server login to connect to a central database for their work. I have never come across this before, as each dev usually has ...
2
votes
1answer
832 views
Cross-database call fails in a job but succeeds in SSMS
I create two databases, a table in the second database and a stored procedure in the first database. The stored procedure cross-database accesses the table. I create a sql server login and I also map ...
0
votes
1answer
78 views
Best practises in securing Oracle Standard edition one [closed]
I have a database server with Oracle Standard Edition One. I'm interested what are the best practices to secure Oracle? I have Java web application installed in the same server. The Java application ...
8
votes
1answer
486 views
What are the security implications of sp_executesql?
By default, in SQL Server, the [public] role has EXECUTE rights on sp_executesql.
However, I've inherited a database server where the previous DBA has revoked the EXECUTE right on sp_executesql.
As ...
1
vote
3answers
98 views
User Rights - Can alter Sp's but not tables
How can i make user permissions so that user can CREATE\ALTER\DELETE Store Procedures, but cannot CREATE\ALTER\DELETE tables in database.
2
votes
1answer
169 views
User Rights - Database Security
I am having following scenarios and i am having some issues and some questions.
We have a DB Server on which we have some databases in these 2(two databases) are for my users.
Now i have created 2 ...
1
vote
1answer
607 views
Rights needed to see database files in Properties dialog?
I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level.
When the contractor logs ...
3
votes
1answer
509 views
Designing An ACL Based Permission System
I am trying to create a permissions system where everything is going to be stored in MySQL (or some database) and pulled using PHP for a project management system I am building. I am right now trying ...
5
votes
1answer
614 views
Is there a way to grant a user access to only all non system views of database?
In SQL Server, I have a user in a particular database and I've been asked to grant them access to all of the non-system views of the database only. I believe this can be done by editing securables of ...
2
votes
2answers
99 views
What is this host?
I found this in my local MySQL installation today:
mysql> select host, user from user;
+--------------+---------+
| host | user |
+--------------+---------+
| ::1 | root |
| ...
11
votes
4answers
461 views
How much of a security risk are published conceptual schema?
I was requesting the conceptual schemas from a government agency's information system for my research. My request has been denied on the grounds of it being a security risk.
I don't really have ...
3
votes
2answers
701 views
What is the difference between a SQL Login and a Database User in terms of security?
I am currently working with a consulting agency to set up a new production environment. They have set up a separate SQL login for each database.
However, there is no corresponding database user ...
2
votes
2answers
86 views
Adding Security to a legacy DB with Schema
I am working on a DB where almost every technical user has full read / write permissions on all tables. We are working towards removing permissions, gradually, from certain users, and I had hoped that ...
3
votes
2answers
418 views
How to obtain SIDs of Sql Server installed NT Service Accounts
I am using WMI to obtain members of server local groups, as well as the SIDs of the members. The WQL queries work for members that are local users, local groups, AD domain users and AD domain groups. ...
12
votes
1answer
677 views
MySQL : Why are there “test” entries in mysql.db?
Recently, I posted an answer to a question about mysql.db.
Then, I got to thinking I should ask everyone this question:
I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
1
vote
2answers
4k views
Grant create permission on a specific schema in Oracle 11g
I have two users A and B. I want to grant B the permission to create, drop, etc. all tables in A's schema. As far as I can see, I can grant B full access to all schemas not a specific one. Is this ...
1
vote
1answer
49 views
User login error when trying to access secured SQL Server database
We have a username that was recently renamed from one username to another (think getting married). The Active Directory admin renamed the user because "it has always worked in the past".
One vendor ...
1
vote
1answer
145 views
Randomly generated password for mysql admin over time?
I have this idea of making my database's Admin account secured by creating the following:
Trigger is activated every hour in mysql this trigger activates a stored procedure
Stored procedure ...
10
votes
2answers
206 views
forensically deleting/updating data
I have a need to forensically remove data from oracle. If I just delete it, my understanding is the data will still actually be in the data file until that space is reused. I'm not concerned about the ...
