Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

0
votes
1answer
148 views

Best practices in securing Oracle Standard edition one [closed]

I have a database server with Oracle Standard Edition One. I'm interested what are the best practices to secure Oracle? I have Java web application installed in the same server. The Java application ...
5
votes
2answers
4k views

SELECT permission on view querying table from another database

SQL Server 2008 R2 SP1 My company uses the Great Plains (GP) financial system with several customizations. Our Value-Added-Reseller (VAR) for GP has setup most of these customizations in a separate ...
1
vote
1answer
131 views

Create USER and LOGIN permissions

What permission should I give to a user or role so that it can Create Login or Create User in database.
1
vote
1answer
59 views

How dangerous is it to have a user's password in plaintext in a cgi script?

I am setting up a MySQL database and am providing a web interface for it. Now, the DB is extremely simple and the interface just runs certain SELECT statements. I have created a user for my script to ...
2
votes
2answers
10k views

SQL Job step run as different sql account

I'm curious how to set up a SQL job step to be executed as a different SQL login account. It appears I need to set up a New Proxy Account which requires an existing credential. When I create a ...
2
votes
1answer
221 views

How do I add a user that has read access to only ONE database?

I have two databases admin and testdb ; Added a user Alice in the test database db.addUser( { user: "Alice",pwd: "Moon1234",roles: [ "readWrite" ] } ); But when I login using the user Alice, I can ...
0
votes
2answers
77 views

Known vulnerabilities for when a guest executes a stored procedure on SQL Server

I have a production database with crucial business information. Meanwhile, my company is involved in a project with some other company and we have to exchange some information on a regular basis. How ...
1
vote
1answer
624 views

How to check Oracle database connection encryption type

How to check the Oracle database connection encryption type?(between Oracle database and other client applications)How do I assure between Oracle database and Toad the database connection is ...
0
votes
0answers
288 views

Oracle data obfuscation on specific columns with set field sizes

Would like to obfuscate data held in Oracle tables, but: Requirements only apply to specific columns e.g. personal data obfuscated value should not be longer then column size possibly only ...
1
vote
2answers
202 views

Questions since MySQL Startup

Have a weird question / (bug?) here. Using PHP My Admin I installed via apt-get on Ubuntu 13.10 Versions are as follows: Server version: 5.5.35-0ubuntu0.13.10.2 - (Ubuntu) Apache/2.4.6 (Ubuntu) ...
0
votes
1answer
579 views

PostgreSQL, storing encrypted data or encrypt database with pgcrypto - what is more secure? [duplicate]

I have two machines: client and server (a database server). I want to connect from client to server and manipulate data from database (insert, update, delete, select) using dblink. I would like to ...
0
votes
1answer
34 views

Select permission to each table

I have three schemas Production, HRecourse and Sales,tables in every week create and drop , I have six Users P_User1, P_User2, HR_User1, HR_User2 and S_User1 and S_User2. I have to grant then how i ...
0
votes
1answer
317 views

CHROOT install after I already installed Mysql 5.6

I installed some time ago Mysql 5.6 on Ubuntu server 12.04 and now I'd like to enhance security by putting mysql into a CHROOT environment on that same Ubuntu server. Is this possible without ...
60
votes
5answers
6k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
11
votes
2answers
3k views

Limit connection rights on SQL Server

I have an app to deploy in production that uses 'honor system' security. That is, all users connect to the DB using a SQL user/passwd credential and the app manages permissions itself. The latter part ...
1
vote
2answers
193 views

security tools for mysql [closed]

We are using MySQL Community version on Windows and are trying to secure it as best we can. Assuming that changing the version (for example purchasing the Enterprise edition) is not possible in our ...
4
votes
2answers
279 views

Easily give role in one database access to tables in another database on the same server

I have a database server (Sql Server 2008 R2 Enterprise) supporting two separate but related vendor products, each with it's own database (call them X and Y) In database X I a have a lot of users ...
9
votes
3answers
4k views

Is there a way to find out who changed the password for a login?

I am trying to find out who changed the password for a login in SQL Server 2008 R2. I have already checked default trace - and it does not log that event. The default trace will include these ...
2
votes
1answer
874 views

Two “Connect SQL” permissions in SQL Server 2012

What is the difference between these two "Connect SQL" permissions in SQL Server 2012?
8
votes
6answers
1k views

What security threats does the SA account and other known account names pose to security?

Does an known account name like sa, pose a security threat to database? When using windows authentication on SQL Server does it impose the same password policy(if it was set to say account lockout ...
5
votes
3answers
1k views

Does the PCI standard forbid the use of Windows Authentication?

We currently use Mixed Mode for our SQL Server Authentication. I've tried to convince our DBA to allow us to use Windows Authentication so we can use Team Foundation Server, however he absolutely ...
0
votes
1answer
77 views

Would it make security sense to split up tables into different databases and or servers?

What I am asking is would it be more secure if I had a customer table in one database server and the transactional data in another database server? This way if the database is compromised they are ...
2
votes
1answer
92 views

What is the equivalent of a “Certificate of Destruction” when using a cloud-hosted database?

We have a Rails application hosted by Heroku and using an Heroku Postgres database. Some of the information we store is considered to be sensitive by our users, and we've been asked if we can provide ...
0
votes
1answer
56 views

Harden a public login to only let it retrieve a list of other logins, and do nothing else

I'd like my app's login dialog to give users a drop-down-list of login names on the server. So I'm wondering about the most secure way to retrieve this. The best I can come up with is a login with a ...
1
vote
1answer
95 views

Multi tenancy by schema - Deny access to another tenants [closed]

In a multi tenant environment, where the multiple tenants are in the same database and a schema is used to separate each one of them, how can I create a database user (MS SQL SERVER) for each schema, ...
1
vote
1answer
2k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
2
votes
2answers
277 views

How do I maintain more audit history?

I created a SQL Server audit and when I view the audit logs I only see today’s audit. I am saving it to a file and I want to store audit for one year. Is there a way to store database and server audit ...
3
votes
2answers
222 views

Prevent SysAdmin from doing a Database Restore

I am a sysadmin on my SQL Server 2008, and I need to be, but I would like to setup my security on the Production server to prevent me from accidentally restoring to the production database. I ...
2
votes
1answer
208 views

SQL Server 2005 and Standalone VB application

I'm new to this forum and just want to ask some questions/suggestions on how to manage my database.. I'm having an application with sql server 2005 database as a backend. I want make the ...
0
votes
2answers
436 views

How secure is mongodb with elastic beanstalk and EC2

I have a questions. I run MongoDB on one of instances of EC2 and application on Elastic BeansTalk. I restricted access to DB: only application can access it. DB instance has Elastic IP because it is ...
1
vote
1answer
3k views

How to transfer the ownership of the dbo schema in SQL Server 2012

I've accidentally given a user the ownership of the db_owner schema (using the check box in the UI as below) and now I cannot: Transfer ownership to another user Drop the user from DB (though I can ...
2
votes
1answer
2k views

How to setup Oracle SSL using self-signed certificate between client and DB?

I want my DB to send the data to the client in an encrypted way. I Googled and found that Oracle has SSL. Unfortunately, I can't find a step by step tutorial which explains how to create a ...
2
votes
2answers
99 views

Searching transaction logs for changes

I currently have a database with an attached CMS. The CMS has about 50+ people with various permission levels that can log in etc... I would like to know if there is a way I can look at the ...
5
votes
1answer
144 views

Security implications of guest account and database chaining on sql server?

I have another database Ydb accessing data in database Kdb. They both have the same owner. In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb. I did so ...
2
votes
3answers
929 views

Encrypt MySQL database on a Linux VPS?

I'm working on a rails app for our church, which stores some fairly sensitive information about our people in a MySQL database. We have our own windows server running Hyper-V so the original ...
1
vote
1answer
50 views

Adding the domain account to a security group on the SQL Server computer that has sufficient privileges to log on as a service

After reading this article, http://www.red-gate.com/supportcenter/content/knowledgebase/SQL_Backup/KB200710000173 I have some problems configuring point 2) and 3): 2) Create a SQL Server login that ...
1
vote
2answers
189 views

How can I create an ad-hoc domain user on SQL Server

Okay, so here's the problem. I have an application I need to install and run locally for testing and debugging. The application has been designed to run on a domain and as such expects to log into the ...
1
vote
1answer
147 views

Creating domain user login from another domain?

I have two domains named "Domain1" and "Domain2". I have SQL server 2005 in Domain2, and users in Domain1. How can I create a login in SQL Server 2005 (in Domain2) for the user that is present in ...
3
votes
1answer
1k views

Using AD groups vs roles in SQL Server

What is best practice for sql server security? Using AD groups that are given rights on schema objects or should I add the AD groups to a database role which is given rights on schema objects ? If the ...
2
votes
2answers
710 views

How to restrict users to select only query through application textbox field?

Say that I have a web application that lets users to type in a SQL query (SQL Server 2008+). I want users to be able to run any SELECT query and read whatever is in the database, but I do not want ...
3
votes
2answers
7k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
3
votes
1answer
2k views

User has no password set

I see these when running MySQLTuner.pl: -------- Security Recommendations ------------------------------------------- [!!] User '@debian' has no password set. [!!] User '@localhost' has no password ...
0
votes
3answers
265 views

Deny access to one database, allow all the rest

How can I deny access to specific databases from a login? I know that I can walk through and make the login a db_owner on all the ones I want the login to have access to, but how do I do the ...
1
vote
1answer
657 views

dcexec login failure

I have a SQL Server 2008 R2 instance that I have been trying to get Data Collection setup on. I get everything setup, but there is no data that gets uploaded. I've traced the root of the problem to be ...
2
votes
3answers
774 views

Is encrypted database possible?

I'm not a DBA but I've been asked to see if we can encrypt the data in sql server such that the admin, despite having access to SQL Server won't be able to see the data but application would still be ...
19
votes
1answer
4k views

MySQL : Why are there “test” entries in mysql.db?

Recently, I posted an answer to a question about mysql.db. Then, I got to thinking I should ask everyone this question: I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
1
vote
2answers
656 views

What are reasonable privileges to grant typical users? [closed]

I find the list of privileges provided by MySQL to be a bit overwhelming. I'm not sure who should have what privileges. In my mind there are three typical users for my situation: root developer ...
1
vote
3answers
157 views

Securely remove columns (and traces thereof) from a SQL database

I've come upon a database that has previously held sensitive data (think "passwords/credit-card-numbers" kind of sensitive) in plain text. All of the sensitive data in question has been deleted, but ...
7
votes
2answers
52k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which ...
3
votes
1answer
3k views

Is there a difference between granting SELECT a user and adding them to the db_datareader role?

I was asked to grant SELECT, INSERT and UPDATE to a given user for all tables in a database. I ended up adding the user to db_datareader and granting them INSERT and UPDATE at the database level. ...