Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

3
votes
2answers
2k views

What is the difference between a SQL Login and a Database User in terms of security?

I am currently working with a consulting agency to set up a new production environment. They have set up a separate SQL login for each database. However, there is no corresponding database user ...
3
votes
2answers
301 views

Microsoft SQL Server 2005 Encryption Options

I'm trying to explore some encryption options on Microsoft SQL Server 2005. I've recently got around SQL Server 2008 and was able to enable Transparent Data Encryption (TDE). Now I'm trying to figure ...
3
votes
1answer
75 views

Secure database access from particular applications

I have an C#.NET application and a SQL Server database (SQL Server 2008 R2) and would like to restrict the access to some of the Tables when it has been accessed from some other application rather ...
3
votes
1answer
883 views

SQL: transfer database schema

If i want to transfer schema ownership to another schema i know that i need to use something like: ALTER SCHEMA destinationschema TRANSFER sourceschema.objectname; But how is it different from: ...
3
votes
1answer
124 views

Just how secure is the data I put on SQL Azure?

My wife has been asking me to create a web application for her business and from what I've read using SQL Azure would be perfect. Except for a couple of small (really really big) gotchas. She ...
3
votes
2answers
289 views

Server permissions of an activation stored procedure of a Server Broker queue

I have a stored procedure that queries the sys.dm_exec_requests view. In the stored procedure the view only returns one row, while the stored procedure needs to see all of them. The MSDN article on ...
3
votes
1answer
2k views

SQL Server 2008 - is “NT AUTHORITY\ANONYMOUS LOGON” login “mandatory”?

My spider senses are tingling when I found this "NT AUTHORITY\ANONYMOUS LOGON" account on a SQL Server logins. I tried to research the matter and I even have a book about SQL Server management. Also ...
3
votes
1answer
2k views

Does this mean the 'public' has full select, insert, update, and delete access?

I'm trying to create a new DB user in SQL Server 2008 R2 that can only select from one SQL View. But no matter what I try when I login as this new user I can select from any table. I ran this query: ...
3
votes
2answers
161 views

SQL 2005 Permission Precedence

Very simple question - I have two database roles (Basic, Admin). Say I explicitly deny the Basic role from deleting from table A and grant that to the Admin role. If I am a user who is in both ...
3
votes
1answer
267 views

CREATE DATABASE permission denied for sysadmin

I'm attempting to create a stored procedure that can be used as a proxy for creating databases where users do not have rights for creating databases. See Restricting Database Access/Functions to User ...
3
votes
4answers
999 views

How to securely connect app and database servers?

(Updated) For a start, I have my app and database on separate servers. It's easy to connect them, except I am not sure how to secure my database server. Here's what I've already done: Ran ...
3
votes
2answers
149 views

Can I grant privileges to a role without specifying an object?

I am trying to create a role to simplify granting a set of privileges that I often give to users. I am wondering if there is any way to grant these privileges on only the objects owned by their schema ...
3
votes
1answer
2k views

User has no password set

I see these when running MySQLTuner.pl: -------- Security Recommendations ------------------------------------------- [!!] User '@debian' has no password set. [!!] User '@localhost' has no password ...
3
votes
1answer
551 views

Is it safe to let application administrators look at v$session, v$process, and v$sql?

In an Oracle database shared among multiple application, is it 'safe' (from a security and system integrity perspective) to allow application administrators access to v$session, v$process, and v$sql? ...
3
votes
1answer
93 views

Row Level security or Multiple Tables

Im looking for documentation on best practices for the following scenario. A hosted application contains some "global" data and some "Per-tenant" data. A "Tenant" should have no access to another ...
3
votes
2answers
813 views

Linked Server Risks

I'm implementing a new feature which requires data from databases on multiple servers. I just need to union data from all these servers and sort it. The two options that come to mind are: Use linked ...
3
votes
1answer
103 views

Creative workaround for granting edit rights to individual jobs for a group?

We have two developers that say they can not function without full rights to a few jobs on our database server. They both want rights to the same jobs. Given that it seems that MS doesn't seem to be ...
3
votes
1answer
313 views

What are the implications of changing the SQL Server Service Logon Account?

What are the implications of changing the SQL Server Service Logon Account? My default instance currently uses Network Service. I want to change this to a domain account. Are there any implications?
3
votes
2answers
1k views

SQL Server EXECUTE AS trouble

I'm missing something while trying to make my stored procedure use EXECUTE AS. The stored procedure is reading data from source_db, aggregates it and stores result in target_db. The sp itself is in ...
3
votes
1answer
117 views

What is recommended level of security for a production database?

I have a production database on our local server. Currently there are two many logins to the database, about 20, half of them are windows authenticated and the other rest are SQL Server authenticated. ...
3
votes
1answer
1k views

Designing An ACL Based Permission System

I am trying to create a permissions system where everything is going to be stored in MySQL (or some database) and pulled using PHP for a project management system I am building.  I am right now trying ...
3
votes
1answer
688 views

SQL Server symmetric key & certificates games by Hacker?

1) CREATE SYMMETRIC KEY SecureSymmetricKey WITH ALGORITHM = DESX ENCRYPTION BY PASSWORD = N'StrongPassword'; I'm trying to figure out about the SQL Server encryption. once I've executed ...
3
votes
1answer
55 views

What is an effective way to wipe sensitive data on a data pages after dropping a table's column?

After dropping a column with sensitive data from a SQL Server table, the data still exists on the data and index pages. To ensure the protection of this data, it needs to be removed from the pages as ...
3
votes
1answer
1k views

Is there a difference between granting SELECT a user and adding them to the db_datareader role?

I was asked to grant SELECT, INSERT and UPDATE to a given user for all tables in a database. I ended up adding the user to db_datareader and granting them INSERT and UPDATE at the database level. ...
3
votes
1answer
68 views

Administration of MySQL Users

What is the best practice for keeping and maintaining MySQL users? Say for example I have 5 programmers and a PHP application connecting to a database. Should I create 6 different users 1 for each ...
3
votes
2answers
4k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
3
votes
1answer
167 views

Help configuring MySQL install for remote connections / root accounts understanding

I installed mysql/phpmyadmin/apache on a linux box for internal network use only. I don't have the strongest understanding of MySQL. Hostname: server.domain.lan IP: 192.168.0.54 After I installed ...
3
votes
1answer
56 views

SQL Agent Permissions - Job Level

We currently have an SQL Job that runs an SSIS package. The output of the package is required for a report. As a result, the application that can create the report on demand first tries to run the ...
3
votes
2answers
66 views

disallow SET command in a postgresql server

Im planning to publish my postgresql server to a few untrusted clients. I dont want them to modify any runtime setting, like work_mem or something risky to my server. In general I assume the ...
3
votes
1answer
88 views

Analysis service database security at application level

I have got a SSAS Cube, we have written an windows application which would issue MDX queries to access the data from the cube and show it in the reports . This windows application is a licensed ...
3
votes
1answer
334 views

SQL Server 2008 R2 Express password overwrite

I'm using a program that requires SA log-in to SQL Server. We had issues where some 3rd party support numpty changed the SA password and never informed us, so the program couldn't log-in. I've ...
3
votes
1answer
2k views

Grant select to dbo view without select on non dbo tables

SQL Server 2008 R2 We have a login & user called "JoeBlogs", this user has it's own default schema of JoeBlogs - it has Public access only to the database. We then granted it SELECT on a dbo ...
3
votes
1answer
785 views

Log shipping setup across domains

I'm running SQL Server 2008 R2 on a Windows machine. I've been tasked with setting up log shipping between our production site (managed by a service provider) and our QA environment which is hosted ...
3
votes
2answers
8k views

Cannot access any database in SQL Server 2008 R2 Express after moving workstation from domain to workgroup

My workstation that has SQL Server 2008 R2 Express for development purposes installed has been moved out of a domain into a Windows workgroup. While being part of the domain I used the account ...
3
votes
1answer
3k views

The server principal “<mydbuser>” is not able to access the database “<mydatabase>” under the current security context

When I try to install a new database, I'm getting this error from SQL Server 2008. The server principal "<mydbuser>" is not able to access the database "<mydatabase>" under the current ...
3
votes
1answer
251 views

Security for Oracle linked server from SQL Server

I'm trying to make the linked server from SQL Server 2005 to Oracle more secure by not having user/pass on "Be made using this security context:" fields so only a specific user can access the data ...
3
votes
1answer
272 views

Domain group hierarchical group membership and SQL Logins mapped to AD groups [closed]

SQL Version: Microsoft SQL Server 2005 - 9.00.4035.00 (X64) Nov 24 2008 16:17:31 Copyright (c) 1988-2005 Microsoft Corporation Standard Edition (64-bit) on Windows NT 6.1 (Build 7601: ...
3
votes
2answers
193 views

Setting up users and admins with schema privileges

I currently have a database that is split into two schemas: data and ref. I have two database roles named Users and Admins. Users need to be able to INSERT, SELECT, UPDATE, and DELETE from the data ...
2
votes
3answers
145 views

What tasks can only sysadmin's do in SQL Server 2000?

I'm cleaning up permissions on my SQL Server 2000, and I want to verify that a particular account still has sysadmin privileges. What non-destructive tasks can only sysadmins do that I can use to ...
2
votes
2answers
383 views

What is this host?

I found this in my local MySQL installation today: mysql> select host, user from user; +--------------+---------+ | host | user | +--------------+---------+ | ::1 | root | | ...
2
votes
2answers
267 views

Attacks on Postgresql listening for requests on 'localhost'

I am using jboss server for my servlets and the postgresql as the database server, listening on port 5432 on localhost. My jboss server is bound to a public IP. I want to know that since my postgesql ...
2
votes
2answers
323 views

How to restrict users to select only query through application textbox field?

Say that I have a web application that lets users to type in a SQL query (SQL Server 2008+). I want users to be able to run any SELECT query and read whatever is in the database, but I do not want ...
2
votes
1answer
398 views

Understanding SQL Server encryption (by password)?

After asking this I still have a question. A company need to store sensitive data. Please let's not talk about certificate right now. A DBA does the following : CREATE SYMMETRIC KEY ...
2
votes
2answers
12k views

Grant create permission on a specific schema in Oracle 11g

I have two users A and B. I want to grant B the permission to create, drop, etc. all tables in A's schema. As far as I can see, I can grant B full access to all schemas not a specific one. Is this ...
2
votes
3answers
728 views

Is encrypted database possible?

I'm not a DBA but I've been asked to see if we can encrypt the data in sql server such that the admin, despite having access to SQL Server won't be able to see the data but application would still be ...
2
votes
2answers
842 views

Securely Send Database Mail via an Insert Trigger

I have spent about 30 hours so far trying to get sp_send_dbmail to work. I finally got SOMETHING to work, but I have serious doubts as to its security. I would like know a method which is better yet ...
2
votes
1answer
520 views

SQL Server 2005 - Map login to pre-existing user

The short of it is that we have several databases that are synchronized between two failover instances. The primary contains logins that are mapped to the users in the databases, and everything's ...
2
votes
1answer
57 views

What does role db_owner allow

I have been trying to troubleshoot a login that is not able to view certain tables in a SQL Server 2012 database. In doing so I find I don't quite understand what membership in the db_owner role ...
2
votes
2answers
90 views

Restricting Database Access/Functions to User Groups?

We've been having issues with Databases being DROPed or RESTOREd WITH REPLACE with the incorrect backup etc... I'm developing a plan right now on how to restrict access and I have some questions. ...
2
votes
1answer
53 views

Use users / logins from another database

Is it possible to use logins/users from one database(F) in another(S) one? I know I can copy it but, when I add user to (F) database I have to copy again them all (or add the same user to (S) ...