Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

3
votes
1answer
448 views

SQL Agent Permissions - Job Level

We currently have an SQL Job that runs an SSIS package. The output of the package is required for a report. As a result, the application that can create the report on demand first tries to run the ...
3
votes
2answers
72 views

disallow SET command in a postgresql server

Im planning to publish my postgresql server to a few untrusted clients. I dont want them to modify any runtime setting, like work_mem or something risky to my server. In general I assume the ...
3
votes
1answer
107 views

Analysis service database security at application level

I have got a SSAS Cube, we have written an windows application which would issue MDX queries to access the data from the cube and show it in the reports . This windows application is a licensed ...
3
votes
1answer
431 views

SQL Server 2008 R2 Express password overwrite

I'm using a program that requires SA log-in to SQL Server. We had issues where some 3rd party support numpty changed the SA password and never informed us, so the program couldn't log-in. I've ...
3
votes
1answer
3k views

Grant select to dbo view without select on non dbo tables

SQL Server 2008 R2 We have a login & user called "JoeBlogs", this user has it's own default schema of JoeBlogs - it has Public access only to the database. We then granted it SELECT on a dbo ...
3
votes
1answer
1k views

Log shipping setup across domains

I'm running SQL Server 2008 R2 on a Windows machine. I've been tasked with setting up log shipping between our production site (managed by a service provider) and our QA environment which is hosted ...
3
votes
2answers
11k views

Cannot access any database in SQL Server 2008 R2 Express after moving workstation from domain to workgroup

My workstation that has SQL Server 2008 R2 Express for development purposes installed has been moved out of a domain into a Windows workgroup. While being part of the domain I used the account ...
3
votes
1answer
5k views

The server principal “<mydbuser>” is not able to access the database “<mydatabase>” under the current security context

When I try to install a new database, I'm getting this error from SQL Server 2008. The server principal "<mydbuser>" is not able to access the database "<mydatabase>" under the current ...
3
votes
0answers
63 views

Are there any outstanding critical security issues for Sql Server 2000?

Are there any outstanding (unpatched) security issues for Sql Server 2000? This isn't really for me: I moved on from Sql Server 2000 long ago. However, when answering questions here and (more likely) ...
3
votes
0answers
197 views

User can create in SSRS, but can't manage objects

We have a user who can create, but is unable to manage objects in SSRS, even though he has content manager permissions and another user who has same permissions who is able to. It is SSRS 2008 R2, ...
3
votes
2answers
475 views

Security for Oracle linked server from SQL Server

I'm trying to make the linked server from SQL Server 2005 to Oracle more secure by not having user/pass on "Be made using this security context:" fields so only a specific user can access the data ...
3
votes
1answer
453 views

Domain group hierarchical group membership and SQL Logins mapped to AD groups [closed]

SQL Version: Microsoft SQL Server 2005 - 9.00.4035.00 (X64) Nov 24 2008 16:17:31 Copyright (c) 1988-2005 Microsoft Corporation Standard Edition (64-bit) on Windows NT 6.1 (Build 7601: ...
3
votes
2answers
226 views

Setting up users and admins with schema privileges

I currently have a database that is split into two schemas: data and ref. I have two database roles named Users and Admins. Users need to be able to INSERT, SELECT, UPDATE, and DELETE from the data ...
2
votes
3answers
166 views

What tasks can only sysadmin's do in SQL Server 2000?

I'm cleaning up permissions on my SQL Server 2000, and I want to verify that a particular account still has sysadmin privileges. What non-destructive tasks can only sysadmins do that I can use to ...
2
votes
2answers
259 views

Can I configure MySQL's typecasting to consider 0 != 'foo'?

This article points out the following security problem with MySQL: USERS id | email | password_reset_token 1 | one@example.com | QTlXww)uV!Hdg3U6aGwKV2FPvAqzVgPx 2 | two@example.com | ...
2
votes
2answers
637 views

What is this host?

I found this in my local MySQL installation today: mysql> select host, user from user; +--------------+---------+ | host | user | +--------------+---------+ | ::1 | root | | ...
2
votes
2answers
305 views

Attacks on Postgresql listening for requests on 'localhost'

I am using jboss server for my servlets and the postgresql as the database server, listening on port 5432 on localhost. My jboss server is bound to a public IP. I want to know that since my postgesql ...
2
votes
2answers
707 views

How to restrict users to select only query through application textbox field?

Say that I have a web application that lets users to type in a SQL query (SQL Server 2008+). I want users to be able to run any SELECT query and read whatever is in the database, but I do not want ...
2
votes
3answers
774 views

Is encrypted database possible?

I'm not a DBA but I've been asked to see if we can encrypt the data in sql server such that the admin, despite having access to SQL Server won't be able to see the data but application would still be ...
2
votes
1answer
981 views

How the sys user gets the sysdba privilege?

I am using oracle 12c on Linux. Using the enterprise manager database express I am looking at the list of privileges and roles for the sys user but I haven’t found the sysdba privilege assigned there. ...
2
votes
4answers
1k views

Working Linked Server Query fails in sp_send_dbmail

Take the following example: EXEC msdb.dbo.sp_send_dbmail @recipients = 'me@whatever.co.uk' , @query = 'SELECT TOP 10 * FROM LINKEDSERVERA.DATABASE.dbo.TABLE' , @attach_query_result_as_file = N'True' ...
2
votes
2answers
1k views

Securely Send Database Mail via an Insert Trigger

I have spent about 30 hours so far trying to get sp_send_dbmail to work. I finally got SOMETHING to work, but I have serious doubts as to its security. I would like know a method which is better yet ...
2
votes
1answer
5k views

What are SQL Server Securables?

I migrated two applications to the new server. One of the them works without any issues but the other ran into back end sql permission problems like The EXECUTE permission was denied on the ...
2
votes
1answer
70 views

Use users / logins from another database

Is it possible to use logins/users from one database(F) in another(S) one? I know I can copy it but, when I add user to (F) database I have to copy again them all (or add the same user to (S) ...
2
votes
1answer
544 views

unreachable SQL Server for a group of computers

I'm deploying SQL Server 2008 Express in my company. I already installed, did a application, tested, gave permission to user. All desktop users run the program without any problem. But the notebook ...
2
votes
3answers
2k views

SQL Server Permission Denied Error When I'm DBOwner?

So I created an account, gave him dbcreator and securityadmin privileges and then through that account tried to run CREATE TABLE on a database that I had created and now owned, but was getting a ...
2
votes
1answer
69 views

SQl Sever Backup Exclude Users

I have a database on SQL Server 2012 that I need to backup and send to someone on a different network / domain. Is there a way to create a full backup file that will not include the users / security ...
2
votes
1answer
229 views

Security Question

Hello guys I have a question I have a group in that group a user shouldn't have syadmin permissions but he must be on that group. He has his login map by the group and his windows login on sql ...
2
votes
4answers
171 views

What are the risks of building a database outside IT control?

I've been looking for the best StackExchange community to ask this. I hope it fits well here. As a risk analyst in a trading business, I'm often confronted with large volumes of data, way beyond the ...
2
votes
1answer
3k views

In creating view use SQL Security definer or invoker?

CREATE VIEW syntax is CREATE [OR REPLACE] [ALGORITHM = {UNDEFINED | MERGE | TEMPTABLE}] [DEFINER = { user | CURRENT_USER }] [SQL SECURITY { DEFINER | INVOKER }] VIEW view_name ...
2
votes
1answer
853 views

If the users need INSERT/UPDATE/DELETE permissions, is Windows auth still more secure than SQL Server auth?

Some background first: The problem described below wouldn't exist at all if the database in question would have been built with a DBA's mindset: Data access only through views and stored procs --> ...
2
votes
2answers
243 views

Auto Disable a SQL Server User

I have a SQL Authentication User: JOHNDOE I would like this account to auto-expire or auto-disable after X days or at a certain date/time. Any suggestions or best practices to do this?
2
votes
1answer
108 views

Oracle Database: View schema without access to data

In Oracle Database 10g, I need to create a user with these permissions: user can access schema to be able to read table names and columns user can not select (get) any data from any table Is this ...
2
votes
2answers
192 views

One database per company for “security” reasons [duplicate]

Possible Duplicate: Is that a good idea to use one database for 50.000+ shops? We are developing an internet application in C# with MVC 4. It's connected to a database which will contain a ...
2
votes
1answer
155 views

SA Account has not been disabled

There has been a security audit for many of our sql servers and per script there are many findings. One of them says "SA Account has not been disabled" I know it can be disabled, but can it be ...
2
votes
1answer
137 views

MySQL Security - Storing lots of sensitive phone numbers securely?

Imagine a table in a database in MySQL that holds millions of telephone and cellphone numbers that relate to itemized billing for VoIP and Cellular carriers. All of these numbers are in VARCHAR ...
2
votes
1answer
2k views

Map a Login to a User that was Created Without Mapping to a Login

This question has been asked before, but I didn't see any answer (http://stackoverflow.com/questions/6468813/assign-a-login-to-a-user-created-without-login-sql-server) How does one map a login to a ...
2
votes
2answers
201 views

Restricting Database Access/Functions to User Groups?

We've been having issues with Databases being DROPed or RESTOREd WITH REPLACE with the incorrect backup etc... I'm developing a plan right now on how to restrict access and I have some questions. ...
2
votes
2answers
86 views

How to revert multiple impersonations?

When there are nested impersonations (as in exec as user = 'user1'; exec as user = 'user2'; exec as user = 'user1';), is there a way to revert all of them without having to use the revert command ...
2
votes
4answers
2k views

SQL Server grant permissions to STANDBY database

So, first: the setup. We have SQL Server 2012 (ServerA) running in domain A. We have SQL Server 2012 (ServerB) running in domain B, separate subnet, no trusts. These are completely separate domains ...
2
votes
2answers
277 views

How do I maintain more audit history?

I created a SQL Server audit and when I view the audit logs I only see today’s audit. I am saving it to a file and I want to store audit for one year. Is there a way to store database and server audit ...
2
votes
1answer
226 views

Need help to design model with multiple rights

For a website, I have multiple elements that need to be moderated by many different users. Until now, I have always used Role-Based Access Control (RBAC) model but I want a more flexible model. I ...
2
votes
1answer
105 views

Find application password expiration date

I changed password of my application on one sql server? when I am using Login property command I am getting last login date. I want to know when my application password is going to expired in SQL ...
2
votes
1answer
9k views

Login Failed for Domain\ServerName$ when trying to create a new SQL Server Reporting Services Application in SharePoint 2013

Basic setup: All of the following is installed on Domain\Servername: SharePoint 2013 Standalone Install (Trial version) Currently using an instance of SQL Server 2012 SP1 Express for basic ...
2
votes
3answers
929 views

Encrypt MySQL database on a Linux VPS?

I'm working on a rails app for our church, which stores some fairly sensitive information about our people in a MySQL database. We have our own windows server running Hyper-V so the original ...
2
votes
1answer
2k views

SQL admin Scripts - Enabling read only access to all databases

I would like a script that will allow our web developers read only access to all databases on our SQL server. Currently we are having to do this manually as we have no SQL expert / DB Admin. Would ...
2
votes
1answer
1k views

User in multiple windows groups mapped to sql logins

I have two C# apps with Windows Auth to Microsoft SQL Server 2008 R2. For every app: SQL login based on Windows Group is created SQL server login is mapped to SQL database user user is member of a ...
2
votes
1answer
464 views

how to restore database from other server - sql

I have backup database from server A. Then I want to restore it in server B. I have manage to restore it, but I cannot connect to it when running my VB program. I already change the configuration ...
2
votes
2answers
59 views

How to safeguard a symmetric key in SQL Server

I've got a database in which I need to store the encrypted values for a column. I use the SQL Server encryption format for encryption. The format is as follows: CREATE MASTER KEY ENCRYPTION BY ...
2
votes
3answers
66 views

Query to find users with passwords same as their username in Oracle

I'm writing an Oracle audit script where I need to find users in a database who have set their passwords to be the same as their username, e.g. dbaadmin/dbaadmin. The query would need to get the list ...