Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

1
vote
2answers
215 views

Role to view SQL server job log

We have a monitoring tool that can check if Microsoft SQL Server jobs have run successfully. What I want to do is create a user that has as little permission as possible but it must be able to watch ...
0
votes
0answers
22 views

Is it secure to disclose the key value of tables

I am currently working on a web application. And the application would link user to data with primary key of some table so user can find the key value (int). Is the application still safe? Or should ...
1
vote
1answer
108 views

How to change default security on SQL Server database so that everyone can use it?

I have a database hosted on my machine that I want co-workers to be able to access and edit through a program I created. My current connection string is: Server=MyMachine;Database=MyDatabase;...
3
votes
1answer
111 views

Is it secure to set default value for password field? [closed]

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
3
votes
1answer
248 views

Partially contained databases and Windows Logins - best practices?

In versions of SQL Server prior to 2012, in order for anyone to log in to a database using Windows credentials, you first had to create a server-level login, them map that login to a user for each ...
0
votes
1answer
123 views

Error using view to limit data access between databases in SQL Server [duplicate]

I am trying to limit user access to data through a view. I have a database full of replicated data that I do not want the users to be able to access, I also have a reporting database in which I will ...
0
votes
0answers
29 views

Accessing database from a number of servers

I have a few servers that access a database, and I was wondering what is the best way to handle access to the database. Is it secure that each server will be able to access the database, or should I ...
0
votes
1answer
126 views

How many database users/admins should be created for a website?

I have created a CMS website that only had one database connection for both the admin area and the user area and it only had one user("root") with no password, and now I want to upload it, but I am ...
2
votes
2answers
160 views

How to safeguard a symmetric key in SQL Server

I've got a database in which I need to store the encrypted values for a column. I use the SQL Server encryption format for encryption. The format is as follows: CREATE MASTER KEY ENCRYPTION BY ...
1
vote
1answer
2k views

How to set user-level security in 2007+ MS Access?

I've read this MS info which should cover my problem. There are quite clear steps: Open the .mdb or .mde file that you want to help protect. On the Database Tools tab, in the Administer group,...
2
votes
3answers
419 views

Query to find users with passwords same as their username in Oracle

I'm writing an Oracle audit script where I need to find users in a database who have set their passwords to be the same as their username, e.g. dbaadmin/dbaadmin. The query would need to get the list ...
0
votes
1answer
1k views

How to GRANT/REVOKE user permissions for user on Firebird 1.5?

I need to create a user in firebird 1.5 and give him permissions to access only some specific tables. I have managed to create the user, but apparently GRANT/REVOKE operations only work on version 2.1 ...
0
votes
2answers
45 views

is it a good practice to ip block dev/test app servers from production database server? [closed]

I would like to do this as somewhat of a last line of defense as we will be replicating production to test regularly. Is this good practice?
1
vote
1answer
135 views

Open port 1433 to use SSMS securely

I have a SQL Server placed in DMZ and I want to give access to internal users (and VPN clients) to use SSMS to remotely connect to it via port 1433 so server will accept the connection only form ...
0
votes
2answers
36 views

How to access to DB Instance from another DB Instance with Windows Authentication

i have two database servers DB_INSTANCE1 DB_INSTANCE2 is it possible to access from DB_INSTANCE1\DB1 SQL script to DB_INSTANCE2\DB2 tables without using SQL Logins ? (not every database servers are ...
0
votes
1answer
179 views

SA login history in sql

Is there any PowerShell script to get the SA log in history? I need to do an audit on SA login.
12
votes
1answer
2k views

Does sys.sql_logins.is_policy_checked mean that the policy has been checked?

When I look in sys.sql_logins, I see a column called is_policy_checked. Can I trust that my password policy has been checked for all of the logins where this column value is 1?
5
votes
1answer
176 views

Auditing database administrator actions with SQL Server 2014 Standard

We have a requirement to audit database administrator access to customer databases - at a minimum, knowing which customer database they were accessing (and ideally why). Without upgrading to SQL ...
1
vote
2answers
35 views

removing sql logins from one server, after migrating to another server, but all the databases were not migra

Here are the details of the production environment: I have 2 serevrs, A1 and A2. I have completely transfered 100 logins from server A1 to A2. Server A1 contains 5 DATABASES. But I moved only 2 ...
1
vote
1answer
165 views

MySQL Brute Force Defense

I was wondering what defense MySQL server uses to protect against brute force attacks on the user credentials? I hope this isn't too simple of a question! I have tried to Google it, but can't seem to ...
2
votes
2answers
122 views

Mysql's internal mysql database in replication

I searched around but the word game seems to delude any valid result and could not find anything relevant. Mysql (the RDBMS) has an internal database named mysql, this database has information about ...
1
vote
0answers
70 views

PostgreSQL security threats in external modules or PL languages

In reading the answer to question I came across a paragraph that indicated that some PostgreSQL PL languages and/or contrib modules can be used to compromise the security of the system. Is this only ...
0
votes
1answer
611 views

Passing passwords more securely to mysql utilities on the command line

This question is related to another question I subsequently asked here: Using the output from mysqldiff.exe to transform database2 to match database1. I have been trying to use mysqldiff.exe, part of ...
6
votes
3answers
5k views

Verifying password policy on existing users

I've recently come into an environment where a lot of databases logins do not have the enforce_password_policy flag enabled. An upcoming audit is necessitating the verification of these logins' ...
1
vote
0answers
985 views

Can we configure Certificate-based Authentication to connect(logon) sql client?

Can we configure Certificate-based Authentication to connect(logon) sql client? or any other method to connect sql client using mutual authentication(sql server and sql client)?
0
votes
1answer
280 views

Is the Advanced Security Pack required for windows authenticaion?

Can anyone tell me if the Oracle Advanced Security Pack is required for single sign in under Windows? I've been told we are not licensed for the "Oracle Advanced Security Pack" and need to remove it, ...
0
votes
1answer
41 views

How do I determine if membership in a DB fixed role is by direct user memership or through membership in a custom DB role?

I'm cataloging memberships of DB users in the various fixed DB roles so that I can create custom roles by business function and grant permissions through these custom roles only. When using SSMS to ...
0
votes
0answers
867 views

Database Role Membership: db_executor vs db_datareader and db_datawriter in SQL Server 2008R2?

I have a couple of users who have only public and db_executor memberships in their Server Login object, User Mapping properties in the one database (let's call it A), now that our front end ...
2
votes
1answer
104 views

Security implications of running SSRS and an OLTP database on the same server

I am in the process of building a new environment for my company's Customer Relationship Management (CRM) system. This system is a commercially available product which uses SQL Server as its back end ...
2
votes
2answers
2k views

Creating a database under a different owner

I'm trying to set up a role in Postgres which can a) Create a new Role b) Create a new Database c) Make that new Role the owner of the database d) Have no other rights (as far as is possible!) I have ...
-3
votes
1answer
68 views

Cannot open database “RidaDatabase” requested by the login. The login failed. Login failed for user 'PLESK01\IWAM_plesk(default)' [closed]

I have following message Cannot open database "RidaDatabase" requested by the login. The login failed. Login failed for user 'PLESK01\IWAM_plesk(default)'. Kindly assist in resolving this ...
0
votes
1answer
42 views

Regarding table access

How to revoke access for particular table from an user who have 'select any table' privilege? I want to block access to system tables that have password details such as user$ etc.. DB : Oracle 11.2....
0
votes
0answers
154 views

Security for SSIS packages in SQL Server - use a domain account?

I have an SSIS package that I want to deploy to SQL Server A. This package needs to access tables on SQL Server A, and another SQL Server, B. What is the best way to set this up? Should I create a ...
0
votes
1answer
1k views

Allow access to enter data through forms, but not full database access

Using Access 2013 or Sharepoint 2013 is it possible to give someone access to data entry forms that work with a back end database whether Access database or Sharepoint SQL. But from everything I've ...
0
votes
1answer
80 views

How comes that login with no rights cam give himself db_creator?

I just created a new login using the GUI, which generates this script: USE [master] GO CREATE LOGIN [tester] WITH PASSWORD=N'tester', DEFAULT_DATABASE=[master], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF ...
0
votes
0answers
31 views

Procedure Security Layer

I want discuss an idea with you and get your opinions what you think about it. From database (SQL Server 2008 R2) administration view and general security, its good practice to create DB roles and set ...
1
vote
0answers
169 views

When does SQL Server follow the Minimum Password Age policy?

According to this SQL Server 2008 whitepaper, SQL Server should only pay attention to the Minimum Password Age policy when the Check_Expiration (Enforce Password Expiration) option is turned on. Page ...
1
vote
1answer
2k views

Restrict Oracle DB Login based on SQL Client being used

We have an application in our organization that is based on Oracle Forms 11g (on Oracle Fusion Middleware/WLS). Users have access to the application through accounts created at the database (i.e. they ...
1
vote
2answers
2k views

Why am I able to query a remote database without a dblink?

While researching a security concern, I discovered that users are able to query a remote database without the need of a dblink. However, this was only true for databases that had no value for ...
2
votes
1answer
39 views

Circumstances under which a windows server login becomes disabled

Can anyone confirm under what circumstances a SQL Server windows login account changes from Enabled to Disabled? More specifically does this need to be a human interaction or can SQL Server ...
1
vote
1answer
246 views

User can see Oracle tables via ODBC that her account does not have access to [closed]

We have a user whose Oracle account, according to ALL_TAB_PRIVS, has access to tables A, B, and C. However, when the user creates an ODBC and connects to Oracle via Microsoft Access (using her Oracle ...
1
vote
1answer
5k views

SQL Server - Linked Server - Using OPENROWSET with windows integrated security

I have seen many articles regarding OPENROWSET using integrated security (Windows Authentication), but I could not make it work for me. It is working fine using SQL Server authentication: select * ...
3
votes
1answer
5k views

Query to List Encryption Certificate for Databases

What certificate is being used to encrypt each of the databases on the instances. I can get the data using the following but how do I write the queries USE master GO -- this provides the list of ...
0
votes
1answer
6k views

Login failed for user - Error: 18456, Severity: 14, State: 38 [duplicate]

I am trying to run and ADODB command in MS Access 2012 to exec a stored proc in our SQL server 2008R2 database, but I keep getting error 38 and SQL profiler shows the following: Error: 18456, ...
1
vote
1answer
427 views

SQL Server Service's Log On As account

I just inherited a set of new servers and whoever set them up left the "Log On As" account as the default "NT Service\MSSQLSERVER". I'd like to change that over to an Active Directory service name. I ...
1
vote
3answers
664 views

MySQL 5.7 - Where is the mysql_secret file on Windows 7?

I've just installed a copy of MySQL 5.7 for testing, and I love the fact that it now only creates a single root account, and puts the password into a file called .mysql_secret. There's just one ...
2
votes
1answer
2k views

Listing expired SQL logins

For audit purposes, we need to list all SQL logins with their creation and expiration dates. Is there a way to script this for all of my SQL Servers, rather than performing the task manually through ...
1
vote
0answers
287 views

How I can create user defined roles

I have a database in mongoDB 2.6.4 in which I want to restrict the users as per their level. I want to give read privileges to some users and insert/update privileges to some other users on a ...
2
votes
1answer
145 views

Can I grant multiple remote LocalService accounts access to a SQL Server database?

I am designing a multi-environment Windows-based software product that will extensively employ Windows services running as LocalService to perform data access operations. All of the data access ...
3
votes
0answers
90 views

Are there any outstanding critical security issues for Sql Server 2000?

Are there any outstanding (unpatched) security issues for Sql Server 2000? This isn't really for me: I moved on from Sql Server 2000 long ago. However, when answering questions here and (more likely) ...