Allowing users to access only the data they are authorized to access.
4
votes
2answers
963 views
Is there any benefit to having one sql server login for multiple users?
I just entered a development project where the developers use the same SQL Server login to connect to a central database for their work. I have never come across this before, as each dev usually has ...
2
votes
1answer
852 views
Cross-database call fails in a job but succeeds in SSMS
I create two databases, a table in the second database and a stored procedure in the first database. The stored procedure cross-database accesses the table. I create a sql server login and I also map ...
8
votes
1answer
491 views
What are the security implications of sp_executesql?
By default, in SQL Server, the [public] role has EXECUTE rights on sp_executesql.
However, I've inherited a database server where the previous DBA has revoked the EXECUTE right on sp_executesql.
As ...
0
votes
1answer
78 views
Best practises in securing Oracle Standard edition one [closed]
I have a database server with Oracle Standard Edition One. I'm interested what are the best practices to secure Oracle? I have Java web application installed in the same server. The Java application ...
1
vote
2answers
1k views
MS SQL Linked Server Security failing using current security context
I have 2 instances of SQL 2008 64 bit (ver 10.0.4000) running on a windows 2008 64 bit server db03 and db03\ins2. The ins2 has a linked server connecting to db03 that was setup by replication. I have ...
1
vote
3answers
99 views
User Rights - Can alter Sp's but not tables
How can i make user permissions so that user can CREATE\ALTER\DELETE Store Procedures, but cannot CREATE\ALTER\DELETE tables in database.
2
votes
1answer
169 views
User Rights - Database Security
I am having following scenarios and i am having some issues and some questions.
We have a DB Server on which we have some databases in these 2(two databases) are for my users.
Now i have created 2 ...
1
vote
2answers
109 views
Impact of changing instances' passwords
As part of a security policy, the company I work for has given me the task of changing the sa's and SQL Server Agent service accounts' passwords for several instances.
What's the possible impact of ...
14
votes
2answers
336 views
Is it more secure to go through a 3rd database to connect two databases using the same login?
We have the following setup:
Multiple production database containing private data which is used by desktop software
A web database for a public website which needs some data from the private ...
1
vote
1answer
614 views
Rights needed to see database files in Properties dialog?
I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level.
When the contractor logs ...
5
votes
1answer
623 views
Is there a way to grant a user access to only all non system views of database?
In SQL Server, I have a user in a particular database and I've been asked to grant them access to all of the non-system views of the database only. I believe this can be done by editing securables of ...
2
votes
2answers
99 views
What is this host?
I found this in my local MySQL installation today:
mysql> select host, user from user;
+--------------+---------+
| host | user |
+--------------+---------+
| ::1 | root |
| ...
11
votes
4answers
461 views
How much of a security risk are published conceptual schema?
I was requesting the conceptual schemas from a government agency's information system for my research. My request has been denied on the grounds of it being a security risk.
I don't really have ...
6
votes
2answers
677 views
securely exposing sql server 2008 for windows authentication
My company wants to have approximately 100 of their sales people (distributed around the country) to be able to run stored procedures from excel and return the data onto the spreadsheet.
We have sql ...
9
votes
3answers
12k views
How do I assign an entire Active Directory group security access in SQL Server 2008?
I would like to use integrated security with my internal application which is all on a domain. Unfortunately, I've never been able to get this to work well. I would like to assign an entire Exchange ...
3
votes
2answers
709 views
What is the difference between a SQL Login and a Database User in terms of security?
I am currently working with a consulting agency to set up a new production environment. They have set up a separate SQL login for each database.
However, there is no corresponding database user ...
2
votes
2answers
86 views
Adding Security to a legacy DB with Schema
I am working on a DB where almost every technical user has full read / write permissions on all tables. We are working towards removing permissions, gradually, from certain users, and I had hoped that ...
1
vote
2answers
4k views
Grant create permission on a specific schema in Oracle 11g
I have two users A and B. I want to grant B the permission to create, drop, etc. all tables in A's schema. As far as I can see, I can grant B full access to all schemas not a specific one. Is this ...
10
votes
2answers
208 views
forensically deleting/updating data
I have a need to forensically remove data from oracle. If I just delete it, my understanding is the data will still actually be in the data file until that space is reused. I'm not concerned about the ...
1
vote
1answer
146 views
Randomly generated password for mysql admin over time?
I have this idea of making my database's Admin account secured by creating the following:
Trigger is activated every hour in mysql this trigger activates a stored procedure
Stored procedure ...
2
votes
1answer
1k views
CREATE DATABASE Permission denied in database 'master' error
I'm working with a tool that as one of the automated steps will attach databases from my file system to my local SQL Express 2008 instance. The tool requires a login in the sysadmin server role, for ...
1
vote
1answer
306 views
How to implement an effective ACL/auth in a relational db?
We are looking at implementing an ACL that fulfills the following requirements:
Most users have access to an item (access to the item by default), but a few is denied access.
Most users do not have ...
3
votes
2answers
128 views
Microsoft SQL Server 2005 Encryption Options
I'm trying to explore some encryption options on Microsoft SQL Server 2005.
I've recently got around SQL Server 2008 and was able to enable Transparent Data Encryption (TDE). Now I'm trying to figure ...
1
vote
2answers
193 views
Is it good practice to assign a system account for database owner?
I can see the owners of my databases usign this query
SELECT name ,
SUSER_SNAME(owner_sid)
FROM sys.databases
What are the things I should consider when choosing an account for database ...
4
votes
2answers
631 views
Does the PCI standard forbid the use of Windows Authentication?
We currently use Mixed Mode for our SQL Server Authentication. I've tried to convince our DBA to allow us to use Windows Authentication so we can use Team Foundation Server, however he absolutely ...
6
votes
3answers
188 views
How do you protect against malicious PREPROCESSOR attacks in Oracle External Tables?
I'm a new DBA and I recently found out about the option of External Tables in Oracle using the PREPROCESSOR feature ( ...
5
votes
2answers
1k views
Restricting database access per IP addresses
I have filtered IP addresses to an access DB server like this:
Set the sqlnet.ora
tcp.validnode_checking = YES
tcp.invited_nodes = (localhost, 192.168.100.130, 192.168.100.186)
But in my ...
1
vote
1answer
156 views
How to do MySQL User Accounting
I can't seem to find any information on this anywhere. I found a question here called Monitor MySQL activity per database? but that's not quite the answer either.
I'd like to be able to log the ...
0
votes
1answer
78 views
What privileges does the SQL Azure Migration Wizard need to copy a SQL Azure database?
Currently have 2 users in our SQL Azure subscription. One is the god login created when setting up the server, other is very limited account for our www app (has db_datareader and db_datawriter).
The ...
3
votes
1answer
132 views
Help configuring MySQL install for remote connections / root accounts understanding
I installed mysql/phpmyadmin/apache on a linux box for internal network use only. I don't have the strongest understanding of MySQL.
Hostname: server.domain.lan
IP: 192.168.0.54
After I installed ...
2
votes
1answer
266 views
how to restore database from other server - sql
I have backup database from server A. Then I want to restore it in server B.
I have manage to restore it, but I cannot connect to it when running my VB program. I already change the configuration ...
3
votes
2answers
127 views
SQL 2005 Permission Precedence
Very simple question -
I have two database roles (Basic, Admin). Say I explicitly deny the Basic role from deleting from table A and grant that to the Admin role. If I am a user who is in both ...
0
votes
1answer
121 views
What are the first necessary actions needed to help secure a database's schema & data? [closed]
This smells like an open-ended, opinionated, wiki free-for-all, but I'm not trying to make this a battle of opinions.
It seems like there should be a good checklist out there for all to agree on ...
1
vote
2answers
436 views
Any security related reasons to prefer Windows Authentication over Sql Server Authentication?
This is a rather short question:
When using Microsoft SQL Server (version 2005 and newer), are there any security related reasons to prefer Windows Authentication over SQL Server Authentication?
...
4
votes
1answer
284 views
Is a Named Instance more Secure than the Default Instance?
I realize that you can change the default instance from the default port of 1433, and equally you can make named instances use static ports as opposed to dynamic ports, but in general are named ...
1
vote
7answers
812 views
Implement Database Security?
I want to implement a database security on the database i created so no one can access it from SQL Server Management Studio, and that it will be only accessible through code.
Is that possible? and if ...
1
vote
1answer
857 views
Simple Implementation of SQL Server 2008 Encryption
I am looking at using some of SQL Server 2008's encryption.
I have read the following article on MSDN:
http://msdn.microsoft.com/en-us/library/ms179331.aspx
Q1a: Is the master key password ...
3
votes
1answer
383 views
Is it safe to let application administrators look at v$session, v$process, and v$sql?
In an Oracle database shared among multiple application, is it 'safe' (from a security and system integrity perspective) to allow application administrators access to v$session, v$process, and v$sql? ...
0
votes
1answer
2k views
Set permissions on all objects for SQL users
I have a procedure that loops through all objects in the database and assigns them proper permissions to that object. I want to know if there is a better way to do this? I use a model database to ...
6
votes
2answers
1k views
SQL Server: how to avoid sysadmin rights but give adequate rights
I have a collegue who want to get an access to one SQL Server 2008 instance. I'll have to give him rights to this instance. He should have rights to do is e.g.
Add and modify server logins
Add and ...
6
votes
4answers
172 views
SQL Server: what is the reason to favor customized database roles over fixed ones?
This may be a bit vague, but I was pondering how much DBA's use fixed database roles controlling security of databases. So the question is, is there a reason to favor customized database roles over ...
3
votes
3answers
2k views
SQL Server: does ddladmin rights contain datareader and datawriter rights to the database?
Does db_ddladmin fixed database role include db_datareader and db_datawriter rights, so that you don't have to grant those rights explicitly?
6
votes
2answers
249 views
How can I secure my database code?
We have a lot of proprietary database code that is simply encrypted using the "WITH ENCRYPTION" option. Unfortunately, this is a very weak method of securing database code.
Is there any better way ...
7
votes
1answer
1k views
Understanding SQL Server permissions
I am rooting around in SQL Server Management Studio against my instance of SQL Server 2008 R2 Express Edition. I am trying to understand how the permissions work.
What I can see is (via the ...
3
votes
2answers
889 views
Role db_ddladmin not working properly on SQL Server 2008
I want to allow certain user to create/modify objects on a database(tables, views, sp's, functions, schemas etc) and don't want to give db_owner.
I thought I could do it with the db_ddladmin role, ...
1
vote
1answer
196 views
SQL Server Schema Security
My company uses a multi-tenant database (one database, all tables have a customerID field).
We are in the process of setting up a data warehouse and giving clients direct access. Our initial ...
8
votes
4answers
259 views
What would I need to do to make sure my DB policies have to pass a security audit?
I have an audit coming up, and I was wondering what physical, electronic, and logical access controls an auditor would look for when auditing a database for an ERP system. I'm really new to this ...
2
votes
3answers
737 views
SQL Server Permission Denied Error When I'm DBOwner?
So I created an account, gave him dbcreator and securityadmin privileges and then through that account tried to run CREATE TABLE on a database that I had created and now owned, but was getting a ...
5
votes
1answer
739 views
Using integrated security over VPN
We've got a client that we're going to allow to use one of our applications. Staff on site regularly connect to our network via VPN. The .Net application that connects to the SQL Server uses ...
3
votes
1answer
632 views
SQL: transfer database schema
If i want to transfer schema ownership to another schema i know that i need to use something like:
ALTER SCHEMA destinationschema TRANSFER sourceschema.objectname;
But how is it different from:
...
