Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

4
votes
1answer
405 views

SQL Server 2008 encrypted connection using multiple server names

I have a SQL Server that must be accessed using various DNS names (SQL1, sql1.contoso.local, sql1.contoso.com, etc) and I'm struggling with creating a correct SSL certificate that can be used to ...
4
votes
2answers
855 views

Integrated Security Success on Master, Fails on Other Database

I'm a bit perplexed as to why my connection string is selectively succeeding on the master database in SQL Server 2005. Here are the details of my app. Any ideas where to look? I'm clearly missing ...
4
votes
2answers
2k views

How to obtain SIDs of Sql Server installed NT Service Accounts

I am using WMI to obtain members of server local groups, as well as the SIDs of the members. The WQL queries work for members that are local users, local groups, AD domain users and AD domain groups. ...
4
votes
1answer
261 views

DB Master Key Encrypted By *Correct* Service Master Key?

My client has frequently run process where we move databases from a prod environment to lower environments (refresh QA with prod database, etc). These DBs have database master keys on them. We have ...
3
votes
7answers
17k views

Can't Login to SQL Server 2008 when running single user mode

I'm following the MS documentation here to migrate logins from one instance of SQL Server to another as part of the process described here. This involves putting the server into single user mode ...
3
votes
3answers
4k views

SQL Server: does ddladmin rights contain datareader and datawriter rights to the database?

Does db_ddladmin fixed database role include db_datareader and db_datawriter rights, so that you don't have to grant those rights explicitly?
3
votes
2answers
222 views

Prevent SysAdmin from doing a Database Restore

I am a sysadmin on my SQL Server 2008, and I need to be, but I would like to setup my security on the Production server to prevent me from accidentally restoring to the production database. I ...
3
votes
3answers
433 views

Changing the port of the postgresql server for security reasons

For security reasons, it is common to change the port of Microsoft Sql Server. The subject is discussed here in Is changing the SQL Server port really that much safer? my question is: does this apply ...
3
votes
1answer
3k views

Rights to execute stored procedure, but not read underlying tables directly

I have a stored procedure that contains lots of different columns from many different tables; I want to give 20 users access to the results of the stored procedure via Excel. Is it possible to make ...
3
votes
1answer
1k views

Using AD groups vs roles in SQL Server

What is best practice for sql server security? Using AD groups that are given rights on schema objects or should I add the AD groups to a database role which is given rights on schema objects ? If the ...
3
votes
1answer
927 views

Different Results From sys.databases As Different Users

We have a SQL Agent job that is configured to run as user "dbo". This job gets a list of databases defined in sys.databases that match a naming scheme. The job then performs some dynamic SQL to ...
3
votes
1answer
649 views

Make sure MySQL is not accepting remote connections

I am currently doing development for a LAMP-based website. I do not know what configuration changes have been made to MySQL since it was installed on our server. The way that we use MySQL, there is no ...
3
votes
1answer
537 views

Understanding SQL Server encryption (by password)?

After asking this I still have a question. A company need to store sensitive data. Please let's not talk about certificate right now. A DBA does the following : CREATE SYMMETRIC KEY ...
3
votes
2answers
2k views

What is the difference between a SQL Login and a Database User in terms of security?

I am currently working with a consulting agency to set up a new production environment. They have set up a separate SQL login for each database. However, there is no corresponding database user ...
3
votes
2answers
581 views

Microsoft SQL Server 2005 Encryption Options

I'm trying to explore some encryption options on Microsoft SQL Server 2005. I've recently got around SQL Server 2008 and was able to enable Transparent Data Encryption (TDE). Now I'm trying to figure ...
3
votes
1answer
298 views

How do I identify the program that called a stored procedure?

As part of an application database design spec, we've been asked to block execution of a set of stored procedures if they have been fired directly from SSMS / osql / sqlcmd and so on; that is, they ...
3
votes
2answers
78 views

Is there a way to grant SELECT for every database (including new ones) at a server level?

I have a unique (well, I think it is unique) situation where databases (yes, entire databases) can be created more or less dynamically. Ignoring the obvious issue with that, I need to be able to ...
3
votes
1answer
82 views

Secure database access from particular applications

I have an C#.NET application and a SQL Server database (SQL Server 2008 R2) and would like to restrict the access to some of the Tables when it has been accessed from some other application rather ...
3
votes
2answers
614 views

Server permissions of an activation stored procedure of a Server Broker queue

I have a stored procedure that queries the sys.dm_exec_requests view. In the stored procedure the view only returns one row, while the stored procedure needs to see all of them. The MSDN article on ...
3
votes
1answer
695 views

SQL Server 2005 - Map login to pre-existing user

The short of it is that we have several databases that are synchronized between two failover instances. The primary contains logins that are mapped to the users in the databases, and everything's ...
3
votes
1answer
986 views

SQL: transfer database schema

If i want to transfer schema ownership to another schema i know that i need to use something like: ALTER SCHEMA destinationschema TRANSFER sourceschema.objectname; But how is it different from: ...
3
votes
1answer
1k views

CREATE DATABASE permission denied for sysadmin

I'm attempting to create a stored procedure that can be used as a proxy for creating databases where users do not have rights for creating databases. See Restricting Database Access/Functions to User ...
3
votes
1answer
3k views

SQL Server 2008 - is “NT AUTHORITY\ANONYMOUS LOGON” login “mandatory”?

My spider senses are tingling when I found this "NT AUTHORITY\ANONYMOUS LOGON" account on a SQL Server logins. I tried to research the matter and I even have a book about SQL Server management. Also ...
3
votes
1answer
4k views

Does this mean the 'public' has full select, insert, update, and delete access?

I'm trying to create a new DB user in SQL Server 2008 R2 that can only select from one SQL View. But no matter what I try when I login as this new user I can select from any table. I ran this query: ...
3
votes
1answer
4k views

Security permission to only read SSAS Cube with Excel

I have an SSAS database set up on a SQL Server 2008 server. I have a Role set up with a group of users that I want to be able to access the Cubes in that database. I set up "Read definition" and ...
3
votes
2answers
184 views

SQL 2005 Permission Precedence

Very simple question - I have two database roles (Basic, Admin). Say I explicitly deny the Basic role from deleting from table A and grant that to the Admin role. If I am a user who is in both ...
3
votes
1answer
983 views

Are passwordless logins like ##MS_SQLResourceSigningCertificate## , ##MS_AgentSigningCertificate## a vulnerability?

I'm new to MS SQL Server. Colleagues working in IT security, have run an scan showing come DB users with null password. Some of them are ( # included ) ##MS_SQLResourceSigningCertificate## ...
3
votes
2answers
200 views

Can I grant privileges to a role without specifying an object?

I am trying to create a role to simplify granting a set of privileges that I often give to users. I am wondering if there is any way to grant these privileges on only the objects owned by their schema ...
3
votes
1answer
2k views

User has no password set

I see these when running MySQLTuner.pl: -------- Security Recommendations ------------------------------------------- [!!] User '@debian' has no password set. [!!] User '@localhost' has no password ...
3
votes
1answer
651 views

Is it safe to let application administrators look at v$session, v$process, and v$sql?

In an Oracle database shared among multiple application, is it 'safe' (from a security and system integrity perspective) to allow application administrators access to v$session, v$process, and v$sql? ...
3
votes
1answer
88 views

Discrepancy between system catalog view and sp_change_users_login?

I want to check for orphaned users on a database. To that end, I use the following query on my SQL Server 2005 instance to get all users and their accompanying logins for a specific database (say ...
3
votes
1answer
332 views

Row Level security or Multiple Tables

Im looking for documentation on best practices for the following scenario. A hosted application contains some "global" data and some "Per-tenant" data. A "Tenant" should have no access to another ...
3
votes
1answer
208 views

Creative workaround for granting edit rights to individual jobs for a group?

We have two developers that say they can not function without full rights to a few jobs on our database server. They both want rights to the same jobs. Given that it seems that MS doesn't seem to be ...
3
votes
1answer
499 views

What are the implications of changing the SQL Server Service Logon Account?

What are the implications of changing the SQL Server Service Logon Account? My default instance currently uses Network Service. I want to change this to a domain account. Are there any implications?
3
votes
1answer
139 views

What is recommended level of security for a production database?

I have a production database on our local server. Currently there are two many logins to the database, about 20, half of them are windows authenticated and the other rest are SQL Server authenticated. ...
3
votes
1answer
2k views

Designing An ACL Based Permission System

I am trying to create a permissions system where everything is going to be stored in MySQL (or some database) and pulled using PHP for a project management system I am building.  I am right now trying ...
3
votes
1answer
799 views

SQL Server symmetric key & certificates games by Hacker?

1) CREATE SYMMETRIC KEY SecureSymmetricKey WITH ALGORITHM = DESX ENCRYPTION BY PASSWORD = N'StrongPassword'; I'm trying to figure out about the SQL Server encryption. once I've executed ...
3
votes
2answers
24 views

How do I connect to mysql without having to type an empty password?

I just installed MySQL, and by default the root user has no password. If I connect with this command: mysql --port=3307 --host=127.0.0.1 -uroot -p It asks me to enter a password, I just hit return, ...
3
votes
1answer
62 views

What is an effective way to wipe sensitive data on a data pages after dropping a table's column?

After dropping a column with sensitive data from a SQL Server table, the data still exists on the data and index pages. To ensure the protection of this data, it needs to be removed from the pages as ...
3
votes
2answers
4k views

How to enable a SQL Server 2012 login to create, alter and drop the created databases?

I'm trying to assign a proper GRANT permission to CI login, that will be able to: Create test DB Alter it Drop this test DB (and only it) But it appears that SQL Server 2012 GRANT CREATE ANY ...
3
votes
1answer
3k views

Is there a difference between granting SELECT a user and adding them to the db_datareader role?

I was asked to grant SELECT, INSERT and UPDATE to a given user for all tables in a database. I ended up adding the user to db_datareader and granting them INSERT and UPDATE at the database level. ...
3
votes
1answer
5k views

Login failed for user Error: 18456 State: 10

In one of my vb.net applications I am getting the error Login failed for user 'user'. But the user has full permission (sysadmin). Also this error happens intermittently. Error log has the following: ...
3
votes
1answer
72 views

Administration of MySQL Users

What is the best practice for keeping and maintaining MySQL users? Say for example I have 5 programmers and a PHP application connecting to a database. Should I create 6 different users 1 for each ...
3
votes
2answers
7k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
3
votes
1answer
177 views

Help configuring MySQL install for remote connections / root accounts understanding

I installed mysql/phpmyadmin/apache on a linux box for internal network use only. I don't have the strongest understanding of MySQL. Hostname: server.domain.lan IP: 192.168.0.54 After I installed ...
3
votes
2answers
6k views

How do I fix a login timout in SQL Server 2005 when using a linked server and a stored procedure called from a SQL Agent Job?

I have a sql agent job running on ServerA. This job executes a stored procedure ServerA.DatabaseA.dbo.SPROC_A, inside this SPROC there is a query that selects data from ...
3
votes
1answer
26 views

Partially contained databases and Windows Logins - best practices?

In versions of SQL Server prior to 2012, in order for anyone to log in to a database using Windows credentials, you first had to create a server-level login, them map that login to a user for each ...
3
votes
1answer
91 views

How can I create notification on user's connecting to database?

I have users that have access to several databases. I used to have an alert and notification sent to me when a specific user connects to a specific database, but I accidentally clobbered it. Now I ...
3
votes
2answers
92 views

What permissions should the account for MS SQL Server Agent have?

I'm in a situation where I need to change the account for the Server Agent of SQL Server from NETWORK SERVICE to an AD domain account. All I'm doing is making the domain account sysadmin in the ...
3
votes
1answer
447 views

SQL Agent Permissions - Job Level

We currently have an SQL Job that runs an SSIS package. The output of the package is required for a report. As a result, the application that can create the report on demand first tries to run the ...