Tagged Questions

Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

3
votes
1answer
4k views

The server principal “<mydbuser>” is not able to access the database “<mydatabase>” under the current security context

When I try to install a new database, I'm getting this error from SQL Server 2008. The server principal "<mydbuser>" is not able to access the database "<mydatabase>" under the current ...
8
votes
2answers
4k views

Can Windows Authentication logins be disabled on SQL Server 2008 (or R2)?

So we can do Windows Login or Mixed Mode, but can we configure SQL Server to only use internal logins and to block all Windows Logins? Is the only solution to add all potential Windows logins and set ...
3
votes
1answer
70 views

Administration of MySQL Users

What is the best practice for keeping and maintaining MySQL users? Say for example I have 5 programmers and a PHP application connecting to a database. Should I create 6 different users 1 for each ...
2
votes
2answers
565 views

What could trigger that a login created from a certificate is not visible in metadata

I am trying to create a login and grant it rights to run and unsafe assembly but the check on server_principals does not return the login when it already exists. The script works perfectly fine on my ...
4
votes
2answers
303 views

How to detach a sql server 2008 database that is not in database list?

I installed sql server 2008 on windows 7 then i create a Database! after 2 days, i reinstall the windows and isntall the sql server! now i am trying to attach my database file, bot i encounter to ...
2
votes
1answer
2k views

SQL admin Scripts - Enabling read only access to all databases

I would like a script that will allow our web developers read only access to all databases on our SQL server. Currently we are having to do this manually as we have no SQL expert / DB Admin. Would ...
2
votes
2answers
2k views

Best practices to secure mysql

I don't have that much knowledge about mysql and i would like to secure a MySQL server. We have a few VPS running around the world (6 currently) and they all need to store information in our mySQL ...
6
votes
2answers
564 views

Is it safe to run antivirus software on my database servers?

Some implementations of antivirus software are known to Microsoft to cause a variety of problems for SQL Server, and Microsoft has a support article dedicated just to picking the right antivirus ...
2
votes
2answers
272 views

Attacks on Postgresql listening for requests on 'localhost'

I am using jboss server for my servlets and the postgresql as the database server, listening on port 5432 on localhost. My jboss server is bound to a public IP. I want to know that since my postgesql ...
2
votes
1answer
2k views

Reconcile users with logins using 'sp_change_users_login'

Sql Server 2008 (and 2005): I have a Sql Server instance, let's say, InstA, in a Domain (called AD). In that I have a domain Windows Authentication Login, called AD\Log1 that has an associated user, ...
2
votes
1answer
966 views

User in multiple windows groups mapped to sql logins

I have two C# apps with Windows Auth to Microsoft SQL Server 2008 R2. For every app: SQL login based on Windows Group is created SQL server login is mapped to SQL database user user is member of a ...
1
vote
2answers
558 views

SQL Server 2008 R2 recognizes a domain account as a SQL Server account

After migrating from SQL Server 2000 to SQL Server 2008 R2, we have a few domain accounts that appear to the new server as SQL Server accounts. These accounts can SELECT from tables in the database ...
5
votes
1answer
1k views

Cross Database Chaining vs. Trustworthy Option

Recently, we had a stored proc request that required access across multiple databases. Of course this is not uncommon to have but in our case, earlier we used service accounts and this service account ...
6
votes
1answer
2k views

SQL Server, remove all users' access right to a table object

As a clean up job, I am trying to remove all users' (including non public users) access right to a single table object (apart from superusers) and will subsequently grant new access rights. Is there a ...
2
votes
1answer
546 views

SQL Server 2005 - Map login to pre-existing user

The short of it is that we have several databases that are synchronized between two failover instances. The primary contains logins that are mapped to the users in the databases, and everything's ...
0
votes
1answer
99 views

Can MySQL be patched

I just saw a note about a security issue in MySQL so thought that I'd better patch my test server just in case. The MySQL site is not very helpful and a quick google revealed lots of people asking how ...
6
votes
2answers
532 views

MySQL Permissions Necessary To Reset Password

On my team there is a desire for some users to periodically update their MySQL password. Our MySQL server is shared between a few projects (and certain users are assigned to certain projects). If I'm ...
0
votes
1answer
293 views

How to troubleshoot/debug Oracle permission problems

An application is connecting to Oracle to do stuff. It's not working but I don't get any ORA errors in the application itself. I'm thinking its a permission problem. So my question is what is the best ...
1
vote
1answer
76 views

Oracle DB administrator-specific security features

Yesterday I was presenting an internet banking solution to a potential client management. My offer is based on using MS SQL Server 2008 RDBMS. One of the client's officers mentioned, that Oracle's ...
1
vote
1answer
255 views

When was the syslogin's password last updated?

In SQL Server, I see there's a field in syslogins titled "updatedate" which is a timestamp of the last time the login was updated. What constitutes an "update"? My goal is to only get a timestamp ...
6
votes
1answer
959 views

How do I find out *why* a user has certain effective permissions?

I know that I can query effective permissions by using sys.fn_my_permissions: USE myDatabase; SELECT * FROM fn_my_permissions('dbo.myTable', 'OBJECT') entity_name | subentity_name | ...
0
votes
0answers
45 views

Database security through stored procedures [duplicate]

Possible Duplicate: Do stored procedures prevent SQL injection? I'm curious about some database security techniques I've been learning in class recently. Namely, I have implemented a SQL ...
3
votes
2answers
199 views

Setting up users and admins with schema privileges

I currently have a database that is split into two schemas: data and ref. I have two database roles named Users and Admins. Users need to be able to INSERT, SELECT, UPDATE, and DELETE from the data ...
3
votes
1answer
2k views

User has no password set

I see these when running MySQLTuner.pl: -------- Security Recommendations ------------------------------------------- [!!] User '@debian' has no password set. [!!] User '@localhost' has no password ...
1
vote
0answers
412 views

ORACLE SSL using Microsoft Certificate Store for PKI

I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store. Client: Windows 7 64 bit with Oracle client 11.2.0.3.0 Server: Windows 2008 R2 64 bit with ...
2
votes
1answer
379 views

unreachable SQL Server for a group of computers

I'm deploying SQL Server 2008 Express in my company. I already installed, did a application, tested, gave permission to user. All desktop users run the program without any problem. But the notebook ...
5
votes
2answers
2k views

Is there any benefit to having one sql server login for multiple users?

I just entered a development project where the developers use the same SQL Server login to connect to a central database for their work. I have never come across this before, as each dev usually has ...
4
votes
1answer
2k views

Cross-database call fails in a job but succeeds in SSMS

I create two databases, a table in the second database and a stored procedure in the first database. The stored procedure cross-database accesses the table. I create a sql server login and I also map ...
0
votes
1answer
135 views

Best practices in securing Oracle Standard edition one [closed]

I have a database server with Oracle Standard Edition One. I'm interested what are the best practices to secure Oracle? I have Java web application installed in the same server. The Java application ...
8
votes
1answer
899 views

What are the security implications of sp_executesql?

By default, in SQL Server, the [public] role has EXECUTE rights on sp_executesql. However, I've inherited a database server where the previous DBA has revoked the EXECUTE right on sp_executesql. As ...
1
vote
3answers
115 views

User Rights - Can alter Sp's but not tables

How can i make user permissions so that user can CREATE\ALTER\DELETE Store Procedures, but cannot CREATE\ALTER\DELETE tables in database.
2
votes
1answer
214 views

User Rights - Database Security

I am having following scenarios and i am having some issues and some questions. We have a DB Server on which we have some databases in these 2(two databases) are for my users. Now i have created 2 ...
1
vote
1answer
1k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
3
votes
1answer
1k views

Designing An ACL Based Permission System

I am trying to create a permissions system where everything is going to be stored in MySQL (or some database) and pulled using PHP for a project management system I am building.  I am right now trying ...
8
votes
2answers
2k views

Is there a way to grant a user access to only all non system views of database?

In SQL Server, I have a user in a particular database and I've been asked to grant them access to all of the non-system views of the database only. I believe this can be done by editing securables of ...
2
votes
2answers
431 views

What is this host?

I found this in my local MySQL installation today: mysql> select host, user from user; +--------------+---------+ | host | user | +--------------+---------+ | ::1 | root | | ...
12
votes
4answers
521 views

How much of a security risk are published conceptual schema?

I was requesting the conceptual schemas from a government agency's information system for my research. My request has been denied on the grounds of it being a security risk. I don't really have ...
3
votes
2answers
2k views

What is the difference between a SQL Login and a Database User in terms of security?

I am currently working with a consulting agency to set up a new production environment. They have set up a separate SQL login for each database. However, there is no corresponding database user ...
2
votes
2answers
103 views

Adding Security to a legacy DB with Schema

I am working on a DB where almost every technical user has full read / write permissions on all tables. We are working towards removing permissions, gradually, from certain users, and I had hoped that ...
4
votes
2answers
1k views

How to obtain SIDs of Sql Server installed NT Service Accounts

I am using WMI to obtain members of server local groups, as well as the SIDs of the members. The WQL queries work for members that are local users, local groups, AD domain users and AD domain groups. ...
17
votes
1answer
3k views

MySQL : Why are there “test” entries in mysql.db?

Recently, I posted an answer to a question about mysql.db. Then, I got to thinking I should ask everyone this question: I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
3
votes
2answers
13k views

Grant create permission on a specific schema in Oracle 11g

I have two users A and B. I want to grant B the permission to create, drop, etc. all tables in A's schema. As far as I can see, I can grant B full access to all schemas not a specific one. Is this ...
1
vote
1answer
77 views

User login error when trying to access secured SQL Server database

We have a username that was recently renamed from one username to another (think getting married). The Active Directory admin renamed the user because "it has always worked in the past". One vendor ...
1
vote
1answer
203 views

Randomly generated password for mysql admin over time?

I have this idea of making my database's Admin account secured by creating the following: Trigger is activated every hour in mysql this trigger activates a stored procedure Stored procedure ...
12
votes
2answers
632 views

forensically deleting/updating data

I have a need to forensically remove data from oracle. If I just delete it, my understanding is the data will still actually be in the data file until that space is reused. I'm not concerned about the ...
1
vote
2answers
336 views

Impact of changing instances' passwords

As part of a security policy, the company I work for has given me the task of changing the sa's and SQL Server Agent service accounts' passwords for several instances. What's the possible impact of ...
15
votes
2answers
366 views

Is it more secure to go through a 3rd database to connect two databases using the same login?

We have the following setup: Multiple production database containing private data which is used by desktop software A web database for a public website which needs some data from the private ...
3
votes
2answers
4k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
2
votes
1answer
2k views

CREATE DATABASE Permission denied in database 'master' error

I'm working with a tool that as one of the automated steps will attach databases from my file system to my local SQL Express 2008 instance. The tool requires a login in the sysadmin server role, for ...
6
votes
2answers
1k views

securely exposing sql server 2008 for windows authentication

My company wants to have approximately 100 of their sales people (distributed around the country) to be able to run stored procedures from excel and return the data onto the spreadsheet. We have sql ...