Tagged Questions

Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

3
votes
1answer
687 views

Different Results From sys.databases As Different Users

We have a SQL Agent job that is configured to run as user "dbo". This job gets a list of databases defined in sys.databases that match a naming scheme. The job then performs some dynamic SQL to ...
5
votes
1answer
437 views

TFS 2012 - Database Project - User with NO LOGIN map to Windows - best practices

I have a SQL Server Database Project (.NET 4.5) in TFS 2012. As a DBA, i'm looking for a mechanism whereby the developers can create 'CREATE USER' sql scripts and assign their permissions within the ...
6
votes
2answers
1k views

SSRS appears to be ignoring Permissions set using Report Manager

I have setup SSRS on SQL Server 2008 in native mode. As an administrator I can login to report manager, upload reports and run them, and also use the Web Service URL to generate reports. I have also ...
3
votes
1answer
365 views

Make sure MySQL is not accepting remote connections

I am currently doing development for a LAMP-based website. I do not know what configuration changes have been made to MySQL since it was installed on our server. The way that we use MySQL, there is no ...
2
votes
2answers
164 views

One database per company for “security” reasons [duplicate]

Possible Duplicate: Is that a good idea to use one database for 50.000+ shops? We are developing an internet application in C# with MVC 4. It's connected to a database which will contain a ...
1
vote
1answer
157 views

sp_setapprole taking 100 - 200 ms [closed]

SQL Server 2008 SP1 here. We have a machine where sp_setapprole calls take more than 100ms and they are done many times per user operation on an application. The developer says that in his setup, ...
2
votes
1answer
636 views

Oracle Packages, Procedures and Functions Not Respecting Roles

When you create a package, sproc or function in one schema (say, SCHEMA1) that accesses objects in another schema (SCHEMA2), even when SCHEMA1 has appropriate permissions to the respective SCHEMA2 ...
6
votes
1answer
2k views

Can I retrieve all database objects owned by a particular user?

We have a user who is leaving and I need to know every database object that he owns. Is there a query that will provide this information?
6
votes
4answers
3k views

SQL Server script to delete accounts no longer in Active Directory

We have a SQL Server 2000 that will shortly be migrated to SQL Server 2005. It has years of Windows Authentication accounts created that no longer exist in Active Directory, which prevent the Copy ...
3
votes
1answer
3k views

Does this mean the 'public' has full select, insert, update, and delete access?

I'm trying to create a new DB user in SQL Server 2008 R2 that can only select from one SQL View. But no matter what I try when I login as this new user I can select from any table. I ran this query: ...
2
votes
2answers
986 views

Securely Send Database Mail via an Insert Trigger

I have spent about 30 hours so far trying to get sp_send_dbmail to work. I finally got SOMETHING to work, but I have serious doubts as to its security. I would like know a method which is better yet ...
5
votes
2answers
3k views

How do I configure SQL Server 2012 so that it can restore and see files in my user account?

I have an SQL Server 2012 instance running as a service on my computer, and according to the service page it logs on as account "NT Service\MSSQLSERVER". However I can't see that account name ...
0
votes
2answers
1k views

Saving every mysql user login attempts

Is there a way to save the username and the IP from which the user tries to login to a MySQL server?? Enabling general-log seems to log everything but that seems to write too much details taking more ...
5
votes
1answer
356 views

SQL Server Security Hierarchy

I have been working as a developer with SQL Server for years without asking the question, "what is dbo", a shame. Recently I have been studying the security model of SQL Server 2008. I have been ...
1
vote
1answer
804 views

How to properly secure MySQL database?

We have a web application based on the famous triad apache + php + mysql which we sell to our customers and gets installed on their servers. Currently, we are using MySQL 5.1.41 which has only a ...
2
votes
2answers
93 views

Searching transaction logs for changes

I currently have a database with an attached CMS. The CMS has about 50+ people with various permission levels that can log in etc... I would like to know if there is a way I can look at the ...
2
votes
1answer
128 views

Create MS SQL login for support engineer to access only vendor database

I have sql server 2005, I need to create separate database login to support engineer of my software vendor to access their own database. My only worry is deny him to take backup from our database ...
1
vote
1answer
1k views

Can't grant role permissions under sysadmin login

I'm trying to execute this script from Management Studio: GRANT ALTER ON ROLE::[AdaptTemplate] TO [AdaptAdmin] AS [AdminSapr] Execution fails with this message: Msg 15151, Level 16, State 1, ...
2
votes
1answer
3k views

What are SQL Server Securables?

I migrated two applications to the new server. One of the them works without any issues but the other ran into back end sql permission problems like The EXECUTE permission was denied on the ...
1
vote
1answer
115 views

Does Microsoft Security Bulletin MS11-049 affect SQL Server 2008 SP3?

The security bulletin does not list SQL Server 2008 SP3 under affected software but it came out prior to that service pack. We are running SP3 but this issue is still showing up on a vulnerability ...
2
votes
1answer
442 views

Understanding SQL Server encryption (by password)?

After asking this I still have a question. A company need to store sensitive data. Please let's not talk about certificate right now. A DBA does the following : CREATE SYMMETRIC KEY ...
4
votes
1answer
342 views

SQL Server 2008 encrypted connection using multiple server names

I have a SQL Server that must be accessed using various DNS names (SQL1, sql1.contoso.local, sql1.contoso.com, etc) and I'm struggling with creating a correct SSL certificate that can be used to ...
2
votes
1answer
3k views

Security permission to only read SSAS Cube with Excel

I have an SSAS database set up on a SQL Server 2008 server. I have a Role set up with a group of users that I want to be able to access the Cubes in that database. I set up "Read definition" and ...
4
votes
2answers
644 views

Integrated Security Success on Master, Fails on Other Database

I'm a bit perplexed as to why my connection string is selectively succeeding on the master database in SQL Server 2005. Here are the details of my app. Any ideas where to look? I'm clearly missing ...
3
votes
1answer
354 views

SQL Server 2008 R2 Express password overwrite

I'm using a program that requires SA log-in to SQL Server. We had issues where some 3rd party support numpty changed the SA password and never informed us, so the program couldn't log-in. I've ...
1
vote
1answer
255 views

Using multiple Active Directory accounts to connect to SQL Server

I have web applications (Classic ASP and .NET) that connect to SQL Server using SQL authentication. Each one has their own login. I want to convert these to Windows Authentication. The new AD users (1 ...
4
votes
2answers
5k views

Users cannot view tables in non-default schema in SSMS

I'm having an issue setting the VIEW DEFINITION permission appropriately at the schema level for one of my users. I've created the schema TestSchema and added some tables. The user currently has ...
3
votes
1answer
3k views

Grant select to dbo view without select on non dbo tables

SQL Server 2008 R2 We have a login & user called "JoeBlogs", this user has it's own default schema of JoeBlogs - it has Public access only to the database. We then granted it SELECT on a dbo ...
1
vote
2answers
254 views

correct security and user setup for SQL Server database

I am currently on setting a sql server database on a database server. A front end web application running off a web server communicates to the database. What is the best approach for setting up users ...
1
vote
3answers
2k views

Encrypt/Decrypt output & input for SSIS task

I use SSIS packages to output the data from one system as Comma Separated Values, and then import that same data into a second system. I have a new requirement to encrypt the CSV text files that are ...
2
votes
0answers
204 views

PhpMyAdmin: UploadDir & SaveDir

Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755. I am the only one using phpmyadmin, but still, could I make this tighter? Thanks PHP 5.3.3 ...
1
vote
1answer
68 views

System test Database user management

We are in development stage and to be able to give the developers an integration test environment, we need to give them access to the database, they can share and test their code in the system ...
2
votes
1answer
108 views

SQL Server Schema Security

I have a user U in a database where I want it to be able to create types and stored procs in a specified schema say UserSchema but not be able to alter schema dbo. So I created the schema and also ...
2
votes
1answer
88 views

How can I deny a user the ability to Alter DB files and options but still allow schema and data modifications?

I'm establishing a shared development instance for multiple single-database applications. I'm envisioning granting authorized users permissions to allow any schema and data modifications they need to ...
4
votes
1answer
162 views

Security Question involving Sys tables

We have an application user which has been given read write to the appropriate databases. This user has the ability to query the sys tables by default. I've also heard that there are times when this ...
9
votes
4answers
647 views

Potential risks of users connecting to SQL Server, through Excel, as sysadmin?

I recently discovered that a large swath of the finance department is using Excel to connect to my SQL Server 2000 instance with an account in the sysadmin role. What are my current risks that I ...
2
votes
3answers
150 views

What tasks can only sysadmin's do in SQL Server 2000?

I'm cleaning up permissions on my SQL Server 2000, and I want to verify that a particular account still has sysadmin privileges. What non-destructive tasks can only sysadmins do that I can use to ...
10
votes
1answer
999 views

Choice of authentication approach for financial app on PostgreSQL

First some background. The LedgerSMB project is an open source financial accounting software project that runs on PostgreSQL. We implement a very large amount of business logic in user defined ...
1
vote
2answers
2k views

Exception Details: System.Data.SqlClient.SqlException: Login failed for user

One of our user from another domain WATSON received the following error message: Exception Details: System.Data.SqlClient.SqlException: Login failed for user 'WATSON\User1'. when he is trying to ...
5
votes
1answer
2k views

What's the difference between EXECUTE AS USER and EXECUTE AS LOGIN that makes the second one behave unexpectedly?

Recently I've been using EXECUTE AS LOGIN to check if a certain person could or couldn't use a table function in one of our databases. The tests showed that he could but he repeatedly reported ...
2
votes
3answers
796 views

Encrypt MySQL database on a Linux VPS?

I'm working on a rails app for our church, which stores some fairly sensitive information about our people in a MySQL database. We have our own windows server running Hyper-V so the original ...
4
votes
2answers
4k views

SELECT permission on view querying table from another database

SQL Server 2008 R2 SP1 My company uses the Great Plains (GP) financial system with several customizations. Our Value-Added-Reseller (VAR) for GP has setup most of these customizations in a separate ...
10
votes
2answers
618 views

Understanding MS SQL Server encryption and backups

So I was asking in chat about how secure SQL Server backup files are. I'm told that if an attacker has access to the .bak file unencrypted that they can have access to the data. So lets look at ...
1
vote
2answers
1k views

Login Failed for User

I have written a code in Visual Studio.NET and used data from SQL Server 2008. But after debugging, it says: Login failed for user 'sunny'. When I try to set the user as something else, it keeps ...
6
votes
2answers
158 views

Most effective way to determine the minimum set of permissions for user

I have a database that an application connects to using db_owner permissions. How do I effectively determine the minimum set of requirements actually needed by this user (application) to run without ...
1
vote
1answer
499 views

Creating a User to access multiple databases

Is it possible in SQL server to create a User without a Login that can access multiple databases? I am creating a user setting up a service broker queue and the receiver of the message needs to be ...
3
votes
1answer
879 views

Log shipping setup across domains

I'm running SQL Server 2008 R2 on a Windows machine. I've been tasked with setting up log shipping between our production site (managed by a service provider) and our QA environment which is hosted ...
7
votes
1answer
518 views

Map Oracle roles to Active Directory groups?

Is there any built-in way to map Oracle database roles to Microsoft Active Directory groups?
8
votes
1answer
554 views

Column level security

I am in need of a solution to hide specific columns in a table. We have people who need to build reports against this database and specifically some of these tables with confidential information but ...
2
votes
1answer
120 views

I would like to better understand the SQL Server security model in terms of users and groups to possibly replace an XML heirarchy model I am using

I am currently using XML in my database to represent metadata for individual products. I am using the below schema to enter the data. In each sub grouping of fields you will notice the cms_name ...