Tagged Questions

Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

6
votes
1answer
754 views

Login to SQL Server 2k8 R2 SP1 via Active Directory Group

I added an Active Directory group as a Windows Authentication Login to our SQL Server 2008 R2 database. When a user who is a member of that group tries to connect to the server he is given a login ...
1
vote
1answer
104 views

MySQL Database Temporarily Compromised?

Two days ago, I had connected to my ClearDB test server with MySQL workbench. I had left this workbench open and when I had checked it today, there were two new schemas named "test_justin" and ...
0
votes
2answers
984 views

Secure way to connect: Windows Authentication or SQL Server Authentication and why?

Which is the best way to create a connection string for SQL Server? Should I be using a trusted connection string (windows authentication) or an untrusted connection string (sql server ...
6
votes
2answers
31k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which ...
3
votes
3answers
412 views

Changing the port of the postgresql server for security reasons

For security reasons, it is common to change the port of Microsoft Sql Server. The subject is discussed here in Is changing the SQL Server port really that much safer? my question is: does this apply ...
4
votes
2answers
2k views

SQL Server EXECUTE AS trouble

I'm missing something while trying to make my stored procedure use EXECUTE AS. The stored procedure is reading data from source_db, aggregates it and stores result in target_db. The sp itself is in ...
7
votes
1answer
177 views

Dynamic Dimension Security

I have a cube in SSAS 2012 with about 30 dimensions, one of which is Company. The Company dimension contains a list of companies, of which there are several hundred in the cube. Our security model ...
3
votes
2answers
8k views

Cannot access any database in SQL Server 2008 R2 Express after moving workstation from domain to workgroup

My workstation that has SQL Server 2008 R2 Express for development purposes installed has been moved out of a domain into a Windows workgroup. While being part of the domain I used the account ...
2
votes
1answer
70 views

Should Crystal Report be allowed for certain employees for production database?

I am talking about production database. There are couple of people who use crystal on daily basis for various types of reports. Some use it to just peak at the data, other generate reports of it. ...
3
votes
1answer
124 views

What is recommended level of security for a production database?

I have a production database on our local server. Currently there are two many logins to the database, about 20, half of them are windows authenticated and the other rest are SQL Server authenticated. ...
2
votes
3answers
6k views

Error Authenticating Proxy Account when Executing SSIS job

I have a SQL Server instance that runs 5 scheduled tasks each night, each of which run SSIS packages. These packages have been running for years and the associated steps run via a Proxy Account ...
4
votes
1answer
120 views

Security implications of guest account and database chaining on sql server?

I have another database Ydb accessing data in database Kdb. They both have the same owner. In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb. I did so ...
3
votes
1answer
4k views

The server principal “<mydbuser>” is not able to access the database “<mydatabase>” under the current security context

When I try to install a new database, I'm getting this error from SQL Server 2008. The server principal "<mydbuser>" is not able to access the database "<mydatabase>" under the current ...
8
votes
2answers
4k views

Can Windows Authentication logins be disabled on SQL Server 2008 (or R2)?

So we can do Windows Login or Mixed Mode, but can we configure SQL Server to only use internal logins and to block all Windows Logins? Is the only solution to add all potential Windows logins and set ...
3
votes
1answer
70 views

Administration of MySQL Users

What is the best practice for keeping and maintaining MySQL users? Say for example I have 5 programmers and a PHP application connecting to a database. Should I create 6 different users 1 for each ...
2
votes
2answers
579 views

What could trigger that a login created from a certificate is not visible in metadata

I am trying to create a login and grant it rights to run and unsafe assembly but the check on server_principals does not return the login when it already exists. The script works perfectly fine on my ...
4
votes
2answers
322 views

How to detach a sql server 2008 database that is not in database list?

I installed sql server 2008 on windows 7 then i create a Database! after 2 days, i reinstall the windows and isntall the sql server! now i am trying to attach my database file, bot i encounter to ...
2
votes
1answer
2k views

SQL admin Scripts - Enabling read only access to all databases

I would like a script that will allow our web developers read only access to all databases on our SQL server. Currently we are having to do this manually as we have no SQL expert / DB Admin. Would ...
2
votes
2answers
2k views

Best practices to secure mysql

I don't have that much knowledge about mysql and i would like to secure a MySQL server. We have a few VPS running around the world (6 currently) and they all need to store information in our mySQL ...
6
votes
2answers
585 views

Is it safe to run antivirus software on my database servers?

Some implementations of antivirus software are known to Microsoft to cause a variety of problems for SQL Server, and Microsoft has a support article dedicated just to picking the right antivirus ...
2
votes
2answers
273 views

Attacks on Postgresql listening for requests on 'localhost'

I am using jboss server for my servlets and the postgresql as the database server, listening on port 5432 on localhost. My jboss server is bound to a public IP. I want to know that since my postgesql ...
2
votes
1answer
3k views

Reconcile users with logins using 'sp_change_users_login'

Sql Server 2008 (and 2005): I have a Sql Server instance, let's say, InstA, in a Domain (called AD). In that I have a domain Windows Authentication Login, called AD\Log1 that has an associated user, ...
2
votes
1answer
1k views

User in multiple windows groups mapped to sql logins

I have two C# apps with Windows Auth to Microsoft SQL Server 2008 R2. For every app: SQL login based on Windows Group is created SQL server login is mapped to SQL database user user is member of a ...
1
vote
2answers
561 views

SQL Server 2008 R2 recognizes a domain account as a SQL Server account

After migrating from SQL Server 2000 to SQL Server 2008 R2, we have a few domain accounts that appear to the new server as SQL Server accounts. These accounts can SELECT from tables in the database ...
5
votes
1answer
1k views

Cross Database Chaining vs. Trustworthy Option

Recently, we had a stored proc request that required access across multiple databases. Of course this is not uncommon to have but in our case, earlier we used service accounts and this service account ...
6
votes
1answer
2k views

SQL Server, remove all users' access right to a table object

As a clean up job, I am trying to remove all users' (including non public users) access right to a single table object (apart from superusers) and will subsequently grant new access rights. Is there a ...
2
votes
1answer
561 views

SQL Server 2005 - Map login to pre-existing user

The short of it is that we have several databases that are synchronized between two failover instances. The primary contains logins that are mapped to the users in the databases, and everything's ...
0
votes
1answer
99 views

Can MySQL be patched

I just saw a note about a security issue in MySQL so thought that I'd better patch my test server just in case. The MySQL site is not very helpful and a quick google revealed lots of people asking how ...
6
votes
2answers
562 views

MySQL Permissions Necessary To Reset Password

On my team there is a desire for some users to periodically update their MySQL password. Our MySQL server is shared between a few projects (and certain users are assigned to certain projects). If I'm ...
0
votes
1answer
298 views

How to troubleshoot/debug Oracle permission problems

An application is connecting to Oracle to do stuff. It's not working but I don't get any ORA errors in the application itself. I'm thinking its a permission problem. So my question is what is the best ...
1
vote
1answer
76 views

Oracle DB administrator-specific security features

Yesterday I was presenting an internet banking solution to a potential client management. My offer is based on using MS SQL Server 2008 RDBMS. One of the client's officers mentioned, that Oracle's ...
1
vote
1answer
263 views

When was the syslogin's password last updated?

In SQL Server, I see there's a field in syslogins titled "updatedate" which is a timestamp of the last time the login was updated. What constitutes an "update"? My goal is to only get a timestamp ...
6
votes
1answer
989 views

How do I find out *why* a user has certain effective permissions?

I know that I can query effective permissions by using sys.fn_my_permissions: USE myDatabase; SELECT * FROM fn_my_permissions('dbo.myTable', 'OBJECT') entity_name | subentity_name | ...
0
votes
0answers
45 views

Database security through stored procedures [duplicate]

Possible Duplicate: Do stored procedures prevent SQL injection? I'm curious about some database security techniques I've been learning in class recently. Namely, I have implemented a SQL ...
3
votes
2answers
200 views

Setting up users and admins with schema privileges

I currently have a database that is split into two schemas: data and ref. I have two database roles named Users and Admins. Users need to be able to INSERT, SELECT, UPDATE, and DELETE from the data ...
3
votes
1answer
2k views

User has no password set

I see these when running MySQLTuner.pl: -------- Security Recommendations ------------------------------------------- [!!] User '@debian' has no password set. [!!] User '@localhost' has no password ...
1
vote
0answers
431 views

ORACLE SSL using Microsoft Certificate Store for PKI

I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store. Client: Windows 7 64 bit with Oracle client 11.2.0.3.0 Server: Windows 2008 R2 64 bit with ...
2
votes
1answer
400 views

unreachable SQL Server for a group of computers

I'm deploying SQL Server 2008 Express in my company. I already installed, did a application, tested, gave permission to user. All desktop users run the program without any problem. But the notebook ...
5
votes
2answers
2k views

Is there any benefit to having one sql server login for multiple users?

I just entered a development project where the developers use the same SQL Server login to connect to a central database for their work. I have never come across this before, as each dev usually has ...
4
votes
1answer
2k views

Cross-database call fails in a job but succeeds in SSMS

I create two databases, a table in the second database and a stored procedure in the first database. The stored procedure cross-database accesses the table. I create a sql server login and I also map ...
0
votes
1answer
136 views

Best practices in securing Oracle Standard edition one [closed]

I have a database server with Oracle Standard Edition One. I'm interested what are the best practices to secure Oracle? I have Java web application installed in the same server. The Java application ...
8
votes
1answer
923 views

What are the security implications of sp_executesql?

By default, in SQL Server, the [public] role has EXECUTE rights on sp_executesql. However, I've inherited a database server where the previous DBA has revoked the EXECUTE right on sp_executesql. As ...
1
vote
3answers
115 views

User Rights - Can alter Sp's but not tables

How can i make user permissions so that user can CREATE\ALTER\DELETE Store Procedures, but cannot CREATE\ALTER\DELETE tables in database.
2
votes
1answer
215 views

User Rights - Database Security

I am having following scenarios and i am having some issues and some questions. We have a DB Server on which we have some databases in these 2(two databases) are for my users. Now i have created 2 ...
1
vote
1answer
1k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
3
votes
1answer
1k views

Designing An ACL Based Permission System

I am trying to create a permissions system where everything is going to be stored in MySQL (or some database) and pulled using PHP for a project management system I am building.  I am right now trying ...
8
votes
2answers
2k views

Is there a way to grant a user access to only all non system views of database?

In SQL Server, I have a user in a particular database and I've been asked to grant them access to all of the non-system views of the database only. I believe this can be done by editing securables of ...
2
votes
2answers
452 views

What is this host?

I found this in my local MySQL installation today: mysql> select host, user from user; +--------------+---------+ | host | user | +--------------+---------+ | ::1 | root | | ...
12
votes
4answers
522 views

How much of a security risk are published conceptual schema?

I was requesting the conceptual schemas from a government agency's information system for my research. My request has been denied on the grounds of it being a security risk. I don't really have ...
3
votes
2answers
2k views

What is the difference between a SQL Login and a Database User in terms of security?

I am currently working with a consulting agency to set up a new production environment. They have set up a separate SQL login for each database. However, there is no corresponding database user ...