Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

2
votes
0answers
182 views

Database Design - Multiple Dbs or Single - Security & Data [closed]

I've hit a brick wall with this and just cannot make a decision so want to throw this out there and see if there are any issues I have'n't considered. Basic Topography I have a system that currently ...
2
votes
1answer
228 views

Secure a hosted MySQL DB

We manage an internet based SaaS app which has a MySQL DB as its backend DB. It is a Windows 2008 R2 server running MySQL 5.5/Apache 2.2 I have started using MonYog to monitor the health of the DB ...
2
votes
0answers
958 views

which role-permission database design?

I want to manage roles and permissions. Most of designs on web look like this tables: Users Roles UserRoles Permissions RolePermissions Here, what is permissions? I am thinking for such a design ...
2
votes
1answer
96 views

What is the equivalent of a “Certificate of Destruction” when using a cloud-hosted database?

We have a Rails application hosted by Heroku and using an Heroku Postgres database. Some of the information we store is considered to be sensitive by our users, and we've been asked if we can provide ...
2
votes
1answer
509 views

“The SELECT permission was denied” only for some of my tables

In my database there are about 100 tables on 2 tables I get the following error when accessing the database by a SP (all data access uses SP): The SELECT permission was denied on the object 'XXX' ...
2
votes
0answers
258 views

PhpMyAdmin: UploadDir & SaveDir

Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755. I am the only one using phpmyadmin, but still, could I make this tighter? Thanks PHP 5.3.3 ...
2
votes
1answer
100 views

How can I deny a user the ability to Alter DB files and options but still allow schema and data modifications?

I'm establishing a shared development instance for multiple single-database applications. I'm envisioning granting authorized users permissions to allow any schema and data modifications they need to ...
2
votes
2answers
720 views

What could trigger that a login created from a certificate is not visible in metadata

I am trying to create a login and grant it rights to run and unsafe assembly but the check on server_principals does not return the login when it already exists. The script works perfectly fine on my ...
2
votes
2answers
95 views

Is there a simple, safe and low cost way to implement a (limited) database to be outside (close) IT control? [closed]

This question is a spin off of the discussion here (What are the risks of building a database outside IT control?). Background: I'm a risk guy that builds little betas, mostly in Excel-VBA. I have a ...
1
vote
7answers
1k views

Implement Database Security?

I want to implement a database security on the database i created so no one can access it from SQL Server Management Studio, and that it will be only accessible through code. Is that possible? and if ...
1
vote
2answers
1k views

Any security related reasons to prefer Windows Authentication over Sql Server Authentication?

This is a rather short question: When using Microsoft SQL Server (version 2005 and newer), are there any security related reasons to prefer Windows Authentication over SQL Server Authentication? ...
1
vote
1answer
65 views

How to change default security on SQL Server database so that everyone can use it?

I have a database hosted on my machine that I want co-workers to be able to access and edit through a program I created. My current connection string is: ...
1
vote
1answer
2k views

Simple Implementation of SQL Server 2008 Encryption

I am looking at using some of SQL Server 2008's encryption. I have read the following article on MSDN: http://msdn.microsoft.com/en-us/library/ms179331.aspx Q1a: Is the master key password ...
1
vote
2answers
636 views

SQL Server Grant execute on all stored procedures without ddl permissions

I have some users in my database. They are member of db_datareader. They now also need to have execute permissions on stored procedures. I was just wondering what would happen if one of the stored ...
1
vote
2answers
491 views

Security or performance risks using SQL CLR [closed]

Are there any particular security or performance risks in using the CLR in SQL Server ?
1
vote
2answers
655 views

How can I run a T-SQL Script using SQL Credentials?

I need to develop a T-SQL insert script for use on a remote SQL 2005 Express instance but I would like the script to include the necessary SQL credentials so all the user has to do is execute the ...
1
vote
2answers
1k views

Issues with module signing and SSIS catalog internal procedures

I'm trying to set up a stored procedure to execute an SSIS package. I want to allow a user to execute only this stored procedure, so I need it to run as a different user. I found this article which ...
1
vote
2answers
79 views

Known vulnerabilities for when a guest executes a stored procedure on SQL Server

I have a production database with crucial business information. Meanwhile, my company is involved in a project with some other company and we have to exchange some information on a regular basis. How ...
1
vote
3answers
120 views

User Rights - Can alter Sp's but not tables

How can i make user permissions so that user can CREATE\ALTER\DELETE Store Procedures, but cannot CREATE\ALTER\DELETE tables in database.
1
vote
1answer
220 views

Randomly generated password for mysql admin over time?

I have this idea of making my database's Admin account secured by creating the following: Trigger is activated every hour in mysql this trigger activates a stored procedure Stored procedure ...
1
vote
1answer
191 views

How does SQL Server handle logins when the user is a part of multiple groups with various privileges?

I'm trying to wrap my head around how SQL Server decides to grant certain rights based on a users login privileges. If a user is part of a group "READ ONLY" which has access to DB1, but they are also ...
1
vote
1answer
122 views

What does exec(text) do?

I just found the following function in two RDS PostgreSQL 9.3 DBs: -- -- Name: exec(text); Type: FUNCTION; Schema: public; Owner: adam -- CREATE FUNCTION exec(text) RETURNS text LANGUAGE plpgsql ...
1
vote
3answers
724 views

Block user access to certain tables

DBMS allows the admin to grant table access to a user using something like: GRANT ALL ON mydb.mytbl1, mydb.mytbl2 TO 'someuser'@'somehost'; However, is it possible to grant all tables to a user and ...
1
vote
2answers
185 views

Securing Your MySQL Server within your team?

Recently I have been having an issue with our internal team members changing the password of the root user. I noticed the following things: OLD_PASSWORD = 1 (So all passwords on our development ...
1
vote
1answer
4k views

How to transfer the ownership of the dbo schema in SQL Server 2012

I've accidentally given a user the ownership of the db_owner schema (using the check box in the UI as below) and now I cannot: Transfer ownership to another user Drop the user from DB (though I can ...
1
vote
2answers
774 views

What are reasonable privileges to grant typical users? [closed]

I find the list of privileges provided by MySQL to be a bit overwhelming. I'm not sure who should have what privileges. In my mind there are three typical users for my situation: root developer ...
1
vote
1answer
5k views

Set permissions on all objects for SQL users

I have a procedure that loops through all objects in the database and assigns them proper permissions to that object. I want to know if there is a better way to do this? I use a model database to ...
1
vote
1answer
251 views

SQL Server Schema Security

My company uses a multi-tenant database (one database, all tables have a customerID field). We are in the process of setting up a data warehouse and giving clients direct access. Our initial ...
1
vote
2answers
524 views

Determining sizes for Separated Partitions of programs, data and logs in SQL Server

As per the recommendations of the CIS benchmarks for SQL Server, I want to create separate partitions for the data, the programs and the logs on my SQL Server dedicated server. Question is, what is ...
1
vote
2answers
144 views

Sending a database dump

Quite new to db admin here and I have a quick question. I am collaborating with another colleague off site and they would like me to send them a dump of our (1.5GB sql db) database via email as they ...
1
vote
1answer
30 views

How to grant access to IP range in Postgres?

I would like to configure my Postgres DB to be accessed by any IP 10.8.101.*. I know I have to create a rule in pg_hba.conf but I'm not sure what it should look like. My LAN IP is currently ...
1
vote
2answers
1k views

Numerous failed authentication attempts in error log

I'm having a hellacious time trying to figure out what is attempting to authenticate against a particular database server, running SQL Server 2008 R2 Standard Edition. The following is the error ...
1
vote
1answer
166 views

Creating domain user login from another domain?

I have two domains named "Domain1" and "Domain2". I have SQL server 2005 in Domain2, and users in Domain1. How can I create a login in SQL Server 2005 (in Domain2) for the user that is present in ...
1
vote
1answer
233 views

Restrict access for Windows administrator in PostgreSQL

Is there a way to protect PostgreSQL from user with Windows administrator rights? Like this question but for Postgres.
1
vote
1answer
329 views

One call to `decryptbypassphrase` for decrypting all columns

If I use ENCRYPTBYPASSPHRASE to encrypt the full table then how can I decrypt full table easily by using DECRYPTBYPASSPHRASE? Actually I have to use DECRYPTBYPASSPHRASE ('passphrase', column_name) ...
1
vote
1answer
106 views

MySQL Database Temporarily Compromised?

Two days ago, I had connected to my ClearDB test server with MySQL workbench. I had left this workbench open and when I had checked it today, there were two new schemas named "test_justin" and ...
1
vote
1answer
305 views

When was the syslogin's password last updated?

In SQL Server, I see there's a field in syslogins titled "updatedate" which is a timestamp of the last time the login was updated. What constitutes an "update"? My goal is to only get a timestamp ...
1
vote
1answer
2k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
1
vote
2answers
387 views

Is it good practice to assign a system account for database owner?

I can see the owners of my databases usign this query SELECT name , SUSER_SNAME(owner_sid) FROM sys.databases What are the things I should consider when choosing an account for database ...
1
vote
1answer
367 views

Creating a database under a different owner

I'm trying to set up a role in Postgres which can a) Create a new Role b) Create a new Database c) Make that new Role the owner of the database d) Have no other rights (as far as is possible!) I have ...
1
vote
1answer
1k views

SQL Server - Linked Server - Using OPENROWSET with windows integrated security

I have seen many articles regarding OPENROWSET using integrated security (Windows Authentication), but I could not make it work for me. It is working fine using SQL Server authentication: select * ...
1
vote
1answer
390 views

Is someone trying to hack into my SQL Server Database?

I was asked by a friend, who isn't technical at all, to help her with her application. I thought I would just being doing a little C# development and some SQL queries. Turns out it has been a lot ...
1
vote
3answers
296 views

How to enable windows authentication on server that is not part of domain

We have an SQL server instance running on a standalone server (not part of the organizations domain network). Is there any way that we can use windows authentication to logon to sql server without ...
1
vote
3answers
59 views

How do I keep a database physically secure? [closed]

This is more of a conceptual question. I am learning how to integrate Java and databases (using PostgreSQL at the moment) and my initial questions is: What are the guarantees that the data I ...
1
vote
2answers
297 views

SQL Server Login to access tables of three different database from single database

I have created a login in SQL Server 2008 R2 and given access to run stored procedures in that database only. But this stored procedure is actually accessing data from other two databases to which ...
1
vote
2answers
62 views

oracle database login information

In a database there is a username called u1, someone tried to access u1 but due to wrong password it got locked. How to find who did this suspicious activity.
1
vote
1answer
214 views

Create USER and LOGIN permissions

What permission should I give to a user or role so that it can Create Login or Create User in database.
1
vote
1answer
1k views

Secure postgresql database encryption

According to this answer, it's not possible to have a fully secure database encryption with pgcrypto. Now, 2 years later (in postgresql 9.3) is there any new extension or new method to have a ...
1
vote
2answers
199 views

How can I create an ad-hoc domain user on SQL Server

Okay, so here's the problem. I have an application I need to install and run locally for testing and debugging. The application has been designed to run on a domain and as such expects to log into the ...
1
vote
3answers
308 views

Deny access to one database, allow all the rest

How can I deny access to specific databases from a login? I know that I can walk through and make the login a db_owner on all the ones I want the login to have access to, but how do I do the ...