Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

1
vote
7answers
1k views

Implement Database Security?

I want to implement a database security on the database i created so no one can access it from SQL Server Management Studio, and that it will be only accessible through code. Is that possible? and if ...
1
vote
2answers
1k views

Any security related reasons to prefer Windows Authentication over Sql Server Authentication?

This is a rather short question: When using Microsoft SQL Server (version 2005 and newer), are there any security related reasons to prefer Windows Authentication over SQL Server Authentication? ...
1
vote
1answer
61 views

How to change default security on SQL Server database so that everyone can use it?

I have a database hosted on my machine that I want co-workers to be able to access and edit through a program I created. My current connection string is: ...
1
vote
1answer
2k views

Simple Implementation of SQL Server 2008 Encryption

I am looking at using some of SQL Server 2008's encryption. I have read the following article on MSDN: http://msdn.microsoft.com/en-us/library/ms179331.aspx Q1a: Is the master key password ...
1
vote
2answers
618 views

SQL Server Grant execute on all stored procedures without ddl permissions

I have some users in my database. They are member of db_datareader. They now also need to have execute permissions on stored procedures. I was just wondering what would happen if one of the stored ...
1
vote
2answers
403 views

Security or performance risks using SQL CLR [closed]

Are there any particular security or performance risks in using the CLR in SQL Server ?
1
vote
2answers
626 views

How can I run a T-SQL Script using SQL Credentials?

I need to develop a T-SQL insert script for use on a remote SQL 2005 Express instance but I would like the script to include the necessary SQL credentials so all the user has to do is execute the ...
1
vote
2answers
1k views

Issues with module signing and SSIS catalog internal procedures

I'm trying to set up a stored procedure to execute an SSIS package. I want to allow a user to execute only this stored procedure, so I need it to run as a different user. I found this article which ...
1
vote
2answers
79 views

Known vulnerabilities for when a guest executes a stored procedure on SQL Server

I have a production database with crucial business information. Meanwhile, my company is involved in a project with some other company and we have to exchange some information on a regular basis. How ...
1
vote
3answers
120 views

User Rights - Can alter Sp's but not tables

How can i make user permissions so that user can CREATE\ALTER\DELETE Store Procedures, but cannot CREATE\ALTER\DELETE tables in database.
1
vote
1answer
220 views

Randomly generated password for mysql admin over time?

I have this idea of making my database's Admin account secured by creating the following: Trigger is activated every hour in mysql this trigger activates a stored procedure Stored procedure ...
1
vote
1answer
178 views

How does SQL Server handle logins when the user is a part of multiple groups with various privileges?

I'm trying to wrap my head around how SQL Server decides to grant certain rights based on a users login privileges. If a user is part of a group "READ ONLY" which has access to DB1, but they are also ...
1
vote
1answer
121 views

What does exec(text) do?

I just found the following function in two RDS PostgreSQL 9.3 DBs: -- -- Name: exec(text); Type: FUNCTION; Schema: public; Owner: adam -- CREATE FUNCTION exec(text) RETURNS text LANGUAGE plpgsql ...
1
vote
3answers
661 views

Block user access to certain tables

DBMS allows the admin to grant table access to a user using something like: GRANT ALL ON mydb.mytbl1, mydb.mytbl2 TO 'someuser'@'somehost'; However, is it possible to grant all tables to a user and ...
1
vote
2answers
183 views

Securing Your MySQL Server within your team?

Recently I have been having an issue with our internal team members changing the password of the root user. I noticed the following things: OLD_PASSWORD = 1 (So all passwords on our development ...
1
vote
2answers
707 views

What are reasonable privileges to grant typical users? [closed]

I find the list of privileges provided by MySQL to be a bit overwhelming. I'm not sure who should have what privileges. In my mind there are three typical users for my situation: root developer ...
1
vote
2answers
6k views

Granting privileges to dbms_crypto

I'm trying to grant proper privileges for using DBMS_CRYPTO. Whenever I call it from package it gives me error: PLS-00201: identifier 'DBMS_CRYPTO' must be declared User already has privileges: ...
1
vote
1answer
5k views

Set permissions on all objects for SQL users

I have a procedure that loops through all objects in the database and assigns them proper permissions to that object. I want to know if there is a better way to do this? I use a model database to ...
1
vote
1answer
250 views

SQL Server Schema Security

My company uses a multi-tenant database (one database, all tables have a customerID field). We are in the process of setting up a data warehouse and giving clients direct access. Our initial ...
1
vote
2answers
509 views

Determining sizes for Separated Partitions of programs, data and logs in SQL Server

As per the recommendations of the CIS benchmarks for SQL Server, I want to create separate partitions for the data, the programs and the logs on my SQL Server dedicated server. Question is, what is ...
1
vote
2answers
139 views

Sending a database dump

Quite new to db admin here and I have a quick question. I am collaborating with another colleague off site and they would like me to send them a dump of our (1.5GB sql db) database via email as they ...
1
vote
1answer
26 views

How to grant access to IP range in Postgres?

I would like to configure my Postgres DB to be accessed by any IP 10.8.101.*. I know I have to create a rule in pg_hba.conf but I'm not sure what it should look like. My LAN IP is currently ...
1
vote
2answers
981 views

Numerous failed authentication attempts in error log

I'm having a hellacious time trying to figure out what is attempting to authenticate against a particular database server, running SQL Server 2008 R2 Standard Edition. The following is the error ...
1
vote
1answer
4k views

How to transfer the ownership of the dbo schema in SQL Server 2012

I've accidentally given a user the ownership of the db_owner schema (using the check box in the UI as below) and now I cannot: Transfer ownership to another user Drop the user from DB (though I can ...
1
vote
1answer
157 views

Creating domain user login from another domain?

I have two domains named "Domain1" and "Domain2". I have SQL server 2005 in Domain2, and users in Domain1. How can I create a login in SQL Server 2005 (in Domain2) for the user that is present in ...
1
vote
1answer
224 views

Restrict access for Windows administrator in PostgreSQL

Is there a way to protect PostgreSQL from user with Windows administrator rights? Like this question but for Postgres.
1
vote
1answer
318 views

One call to `decryptbypassphrase` for decrypting all columns

If I use ENCRYPTBYPASSPHRASE to encrypt the full table then how can I decrypt full table easily by using DECRYPTBYPASSPHRASE? Actually I have to use DECRYPTBYPASSPHRASE ('passphrase', column_name) ...
1
vote
1answer
106 views

MySQL Database Temporarily Compromised?

Two days ago, I had connected to my ClearDB test server with MySQL workbench. I had left this workbench open and when I had checked it today, there were two new schemas named "test_justin" and ...
1
vote
1answer
299 views

When was the syslogin's password last updated?

In SQL Server, I see there's a field in syslogins titled "updatedate" which is a timestamp of the last time the login was updated. What constitutes an "update"? My goal is to only get a timestamp ...
1
vote
1answer
2k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
1
vote
2answers
376 views

Is it good practice to assign a system account for database owner?

I can see the owners of my databases usign this query SELECT name , SUSER_SNAME(owner_sid) FROM sys.databases What are the things I should consider when choosing an account for database ...
1
vote
1answer
223 views

Creating a database under a different owner

I'm trying to set up a role in Postgres which can a) Create a new Role b) Create a new Database c) Make that new Role the owner of the database d) Have no other rights (as far as is possible!) I have ...
1
vote
1answer
937 views

SQL Server - Linked Server - Using OPENROWSET with windows integrated security

I have seen many articles regarding OPENROWSET using integrated security (Windows Authentication), but I could not make it work for me. It is working fine using SQL Server authentication: select * ...
1
vote
1answer
307 views

Query to List Encryption Certificate for Databases

What certificate is being used to encrypt each of the databases on the instances. I can get the data using the following but how do I write the queries USE master GO -- this provides the list of ...
1
vote
1answer
343 views

Is someone trying to hack into my SQL Server Database?

I was asked by a friend, who isn't technical at all, to help her with her application. I thought I would just being doing a little C# development and some SQL queries. Turns out it has been a lot ...
1
vote
3answers
238 views

How to enable windows authentication on server that is not part of domain

We have an SQL server instance running on a standalone server (not part of the organizations domain network). Is there any way that we can use windows authentication to logon to sql server without ...
1
vote
3answers
58 views

How do I keep a database physically secure? [closed]

This is more of a conceptual question. I am learning how to integrate Java and databases (using PostgreSQL at the moment) and my initial questions is: What are the guarantees that the data I ...
1
vote
2answers
269 views

SQL Server Login to access tables of three different database from single database

I have created a login in SQL Server 2008 R2 and given access to run stored procedures in that database only. But this stored procedure is actually accessing data from other two databases to which ...
1
vote
2answers
62 views

oracle database login information

In a database there is a username called u1, someone tried to access u1 but due to wrong password it got locked. How to find who did this suspicious activity.
1
vote
1answer
153 views

Create USER and LOGIN permissions

What permission should I give to a user or role so that it can Create Login or Create User in database.
1
vote
1answer
1k views

Secure postgresql database encryption

According to this answer, it's not possible to have a fully secure database encryption with pgcrypto. Now, 2 years later (in postgresql 9.3) is there any new extension or new method to have a ...
1
vote
2answers
193 views

How can I create an ad-hoc domain user on SQL Server

Okay, so here's the problem. I have an application I need to install and run locally for testing and debugging. The application has been designed to run on a domain and as such expects to log into the ...
1
vote
3answers
283 views

Deny access to one database, allow all the rest

How can I deny access to specific databases from a login? I know that I can walk through and make the login a db_owner on all the ones I want the login to have access to, but how do I do the ...
1
vote
3answers
162 views

Securely remove columns (and traces thereof) from a SQL database

I've come upon a database that has previously held sensitive data (think "passwords/credit-card-numbers" kind of sensitive) in plain text. All of the sensitive data in question has been deleted, but ...
1
vote
2answers
976 views

Where should I look for details about 'access denied' errors?

This question derives from Deploying a new database on a new server, an msbuild ssdt rookie issue. Since I have a permission denied error, I expect to find which user is failing to access so I can ...
1
vote
1answer
936 views

How to properly secure MySQL database?

We have a web application based on the famous triad apache + php + mysql which we sell to our customers and gets installed on their servers. Currently, we are using MySQL 5.1.41 which has only a ...
1
vote
1answer
3k views

Can't grant role permissions under sysadmin login

I'm trying to execute this script from Management Studio: GRANT ALTER ON ROLE::[AdaptTemplate] TO [AdaptAdmin] AS [AdminSapr] Execution fails with this message: Msg 15151, Level 16, State 1, ...
1
vote
1answer
330 views

Using multiple Active Directory accounts to connect to SQL Server

I have web applications (Classic ASP and .NET) that connect to SQL Server using SQL authentication. Each one has their own login. I want to convert these to Windows Authentication. The new AD users (1 ...
1
vote
2answers
3k views

MS SQL Linked Server Security failing using current security context

I have 2 instances of SQL 2008 64 bit (ver 10.0.4000) running on a windows 2008 64 bit server db03 and db03\ins2. The ins2 has a linked server connecting to db03 that was setup by replication. I have ...
1
vote
1answer
27 views

Allow multiple users to see procedures and functions

I have GRANT ALL PRIVILEGES ON `test1`.* TO 'admin'@'%', GRANT ALL PRIVILEGES ON `test1`.* TO 'devel'@'%' (from SHOW GRANTS FOR some_user) and I have created simple procedure as admin in test1. And ...