Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

9
votes
3answers
3k views

Is there a way to find out who changed the password for a login?

I am trying to find out who changed the password for a login in SQL Server 2008 R2. I have already checked default trace - and it does not log that event. The default trace will include these ...
2
votes
1answer
787 views

Two “Connect SQL” permissions in SQL Server 2012

What is the difference between these two "Connect SQL" permissions in SQL Server 2012?
8
votes
6answers
1k views

What security threats does the SA account and other known account names pose to security?

Does an known account name like sa, pose a security threat to database? When using windows authentication on SQL Server does it impose the same password policy(if it was set to say account lockout ...
5
votes
3answers
1k views

Does the PCI standard forbid the use of Windows Authentication?

We currently use Mixed Mode for our SQL Server Authentication. I've tried to convince our DBA to allow us to use Windows Authentication so we can use Team Foundation Server, however he absolutely ...
0
votes
1answer
76 views

Would it make security sense to split up tables into different databases and or servers?

What I am asking is would it be more secure if I had a customer table in one database server and the transactional data in another database server? This way if the database is compromised they are ...
2
votes
1answer
91 views

What is the equivalent of a “Certificate of Destruction” when using a cloud-hosted database?

We have a Rails application hosted by Heroku and using an Heroku Postgres database. Some of the information we store is considered to be sensitive by our users, and we've been asked if we can provide ...
0
votes
1answer
56 views

Harden a public login to only let it retrieve a list of other logins, and do nothing else

I'd like my app's login dialog to give users a drop-down-list of login names on the server. So I'm wondering about the most secure way to retrieve this. The best I can come up with is a login with a ...
1
vote
1answer
91 views

Multi tenancy by schema - Deny access to another tenants [closed]

In a multi tenant environment, where the multiple tenants are in the same database and a schema is used to separate each one of them, how can I create a database user (MS SQL SERVER) for each schema, ...
1
vote
1answer
1k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
2
votes
2answers
265 views

How do I maintain more audit history?

I created a SQL Server audit and when I view the audit logs I only see today’s audit. I am saving it to a file and I want to store audit for one year. Is there a way to store database and server audit ...
3
votes
2answers
209 views

Prevent SysAdmin from doing a Database Restore

I am a sysadmin on my SQL Server 2008, and I need to be, but I would like to setup my security on the Production server to prevent me from accidentally restoring to the production database. I ...
2
votes
1answer
191 views

SQL Server 2005 and Standalone VB application

I'm new to this forum and just want to ask some questions/suggestions on how to manage my database.. I'm having an application with sql server 2005 database as a backend. I want make the ...
0
votes
2answers
414 views

How secure is mongodb with elastic beanstalk and EC2

I have a questions. I run MongoDB on one of instances of EC2 and application on Elastic BeansTalk. I restricted access to DB: only application can access it. DB instance has Elastic IP because it is ...
1
vote
1answer
2k views

How to transfer the ownership of the dbo schema in SQL Server 2012

I've accidentally given a user the ownership of the db_owner schema (using the check box in the UI as below) and now I cannot: Transfer ownership to another user Drop the user from DB (though I can ...
2
votes
1answer
1k views

How to setup Oracle SSL using self-signed certificate between client and DB?

I want my DB to send the data to the client in an encrypted way. I Googled and found that Oracle has SSL. Unfortunately, I can't find a step by step tutorial which explains how to create a ...
2
votes
2answers
98 views

Searching transaction logs for changes

I currently have a database with an attached CMS. The CMS has about 50+ people with various permission levels that can log in etc... I would like to know if there is a way I can look at the ...
5
votes
1answer
137 views

Security implications of guest account and database chaining on sql server?

I have another database Ydb accessing data in database Kdb. They both have the same owner. In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb. I did so ...
2
votes
3answers
916 views

Encrypt MySQL database on a Linux VPS?

I'm working on a rails app for our church, which stores some fairly sensitive information about our people in a MySQL database. We have our own windows server running Hyper-V so the original ...
1
vote
1answer
47 views

Adding the domain account to a security group on the SQL Server computer that has sufficient privileges to log on as a service

After reading this article, http://www.red-gate.com/supportcenter/content/knowledgebase/SQL_Backup/KB200710000173 I have some problems configuring point 2) and 3): 2) Create a SQL Server login that ...
1
vote
2answers
181 views

How can I create an ad-hoc domain user on SQL Server

Okay, so here's the problem. I have an application I need to install and run locally for testing and debugging. The application has been designed to run on a domain and as such expects to log into the ...
1
vote
1answer
142 views

Creating domain user login from another domain?

I have two domains named "Domain1" and "Domain2". I have SQL server 2005 in Domain2, and users in Domain1. How can I create a login in SQL Server 2005 (in Domain2) for the user that is present in ...
3
votes
1answer
1k views

Using AD groups vs roles in SQL Server

What is best practice for sql server security? Using AD groups that are given rights on schema objects or should I add the AD groups to a database role which is given rights on schema objects ? If the ...
2
votes
2answers
650 views

How to restrict users to select only query through application textbox field?

Say that I have a web application that lets users to type in a SQL query (SQL Server 2008+). I want users to be able to run any SELECT query and read whatever is in the database, but I do not want ...
3
votes
2answers
6k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
3
votes
1answer
2k views

User has no password set

I see these when running MySQLTuner.pl: -------- Security Recommendations ------------------------------------------- [!!] User '@debian' has no password set. [!!] User '@localhost' has no password ...
0
votes
3answers
241 views

Deny access to one database, allow all the rest

How can I deny access to specific databases from a login? I know that I can walk through and make the login a db_owner on all the ones I want the login to have access to, but how do I do the ...
1
vote
1answer
625 views

dcexec login failure

I have a SQL Server 2008 R2 instance that I have been trying to get Data Collection setup on. I get everything setup, but there is no data that gets uploaded. I've traced the root of the problem to be ...
2
votes
3answers
766 views

Is encrypted database possible?

I'm not a DBA but I've been asked to see if we can encrypt the data in sql server such that the admin, despite having access to SQL Server won't be able to see the data but application would still be ...
18
votes
1answer
3k views

MySQL : Why are there “test” entries in mysql.db?

Recently, I posted an answer to a question about mysql.db. Then, I got to thinking I should ask everyone this question: I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
1
vote
2answers
581 views

What are reasonable privileges to grant typical users? [closed]

I find the list of privileges provided by MySQL to be a bit overwhelming. I'm not sure who should have what privileges. In my mind there are three typical users for my situation: root developer ...
1
vote
3answers
146 views

Securely remove columns (and traces thereof) from a SQL database

I've come upon a database that has previously held sensitive data (think "passwords/credit-card-numbers" kind of sensitive) in plain text. All of the sensitive data in question has been deleted, but ...
7
votes
2answers
47k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which ...
3
votes
1answer
2k views

Is there a difference between granting SELECT a user and adding them to the db_datareader role?

I was asked to grant SELECT, INSERT and UPDATE to a given user for all tables in a database. I ended up adding the user to db_datareader and granting them INSERT and UPDATE at the database level. ...
3
votes
2answers
565 views

Server permissions of an activation stored procedure of a Server Broker queue

I have a stored procedure that queries the sys.dm_exec_requests view. In the stored procedure the view only returns one row, while the stored procedure needs to see all of them. The MSDN article on ...
0
votes
2answers
753 views

What does the Service Master Key protect?

I am looking for a complete list of items that the Service Master Key is used to protect in SQL Server 2008.
5
votes
1answer
247 views

SA permissions issues with many nested objects

I have a broker application that's relatively complicated. Today, after I made some changes, I started getting the error: The server principal 'sa' is not able to access the database 'XYZ' under ...
0
votes
1answer
452 views

Which databases can have row and column level security based upon Active Directory? [closed]

I have various database types, Oracle 11g, MySQL 5, Sql Server 2012. I have direct access. I can have other databases if I need them such as PostgreSQL. What I'm doing is protecting data at the ...
3
votes
1answer
930 views

Are passwordless logins like ##MS_SQLResourceSigningCertificate## , ##MS_AgentSigningCertificate## a vulnerability?

I'm new to MS SQL Server. Colleagues working in IT security, have run an scan showing come DB users with null password. Some of them are ( # included ) ##MS_SQLResourceSigningCertificate## ...
2
votes
1answer
215 views

Secure a hosted MySQL DB

We manage an internet based SaaS app which has a MySQL DB as its backend DB. It is a Windows 2008 R2 server running MySQL 5.5/Apache 2.2 I have started using MonYog to monitor the health of the DB ...
1
vote
1answer
79 views

User login error when trying to access secured SQL Server database

We have a username that was recently renamed from one username to another (think getting married). The Active Directory admin renamed the user because "it has always worked in the past". One vendor ...
4
votes
1answer
179 views

Just how secure is the data I put on SQL Azure?

My wife has been asking me to create a web application for her business and from what I've read using SQL Azure would be perfect. Except for a couple of small (really really big) gotchas. She ...
2
votes
1answer
3k views

Security permission to only read SSAS Cube with Excel

I have an SSAS database set up on a SQL Server 2008 server. I have a Role set up with a group of users that I want to be able to access the Cubes in that database. I set up "Read definition" and ...
6
votes
5answers
2k views

SQL server level permissions

I am aware of the Microsoft provided code to transfer logins between SQL servers, however this only does the account and the password. What if that particular account has various roles and ...
0
votes
1answer
500 views

How to revoke DBADM and clean up any related objects from DB2 LUW

This question has started because of us taking copies of production backups and restoring them into lower environments (with scrambled data of course) for developers to practice and/or debug against. ...
0
votes
0answers
55 views

How to secure SQL database?

I made a little application with a MySQL database. I want to secure my database.I think user name and password is not enough to protect it. Because anyone can access the database by copying database ...
1
vote
1answer
125 views

MySQL on Unix, should administrator accounts join the operating system “mysql” group?

When I install MySQL via Yum, it automatically creates the mysql operating system user and group. Then mysqld executes as mysql (instead of as root), and all the files in the data directory are owned ...
6
votes
1answer
10k views

Linked server available to users without permissions

I have users seeing a linked server which they are not supposed to see. The linked server is defined so that only I will have access to it, but everybody can see and use it. I have created the ...
3
votes
1answer
4k views

Login failed for user Error: 18456 State: 10

In one of my vb.net applications I am getting the error Login failed for user 'user'. But the user has full permission (sysadmin). Also this error happens intermittently. Error log has the following: ...
2
votes
1answer
212 views

Need help to design model with multiple rights

For a website, I have multiple elements that need to be moderated by many different users. Until now, I have always used Role-Based Access Control (RBAC) model but I want a more flexible model. I ...
3
votes
2answers
191 views

Can I grant privileges to a role without specifying an object?

I am trying to create a role to simplify granting a set of privileges that I often give to users. I am wondering if there is any way to grant these privileges on only the objects owned by their schema ...