Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

63
votes
6answers
7k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
27
votes
8answers
2k views

Security implications of restoring a backup from an unknown source?

Scenario: You're handed a database backup and told to restore it to a server (that's already hosting other databases), but are given no useful information about what the backup contains or whether the ...
23
votes
4answers
10k views

Why is OS authentication considered poor security for Oracle databases?

Oracle is deprecating OS authentication according to the Oracle Database Security Guide, which says Be aware that the REMOTE_OS_AUTHENT parameter was deprecated in Oracle Database 11g Release ...
20
votes
1answer
4k views

MySQL : Why are there “test” entries in mysql.db?

Recently, I posted an answer to a question about mysql.db. Then, I got to thinking I should ask everyone this question: I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
19
votes
8answers
6k views

Why is it a bad practice to allow everyone to use the sa login?

Even Microsoft discourages the use of SQL Server authentication mode, but our applications require it. I've read that it's a best practice to not let users use the sa login directly, instead using ...
19
votes
8answers
6k views

Why should an application not use the sa account

My first question ever, please be gentle. I understand that the sa account enables complete control over a SQL Server and all the databases, users, permissions etc. I have an absolute belief that ...
17
votes
3answers
31k views

How do I assign an entire Active Directory group security access in SQL Server 2008?

I would like to use integrated security with my internal application which is all on a domain. Unfortunately, I've never been able to get this to work well. I would like to assign an entire Exchange ...
16
votes
2answers
377 views

Is it more secure to go through a 3rd database to connect two databases using the same login?

We have the following setup: Multiple production database containing private data which is used by desktop software A web database for a public website which needs some data from the private ...
15
votes
6answers
287 views

Securing DB passwords

Looking at the structure of most PHP/MySQL-based websites I've seen, it appears that it's not terribly difficult to discern the database password if you dig a bit, as there's invariably a setup or ...
13
votes
4answers
562 views

How much of a security risk are published conceptual schema?

I was requesting the conceptual schemas from a government agency's information system for my research. My request has been denied on the grounds of it being a security risk. I don't really have ...
13
votes
2answers
940 views

forensically deleting/updating data

I have a need to forensically remove data from oracle. If I just delete it, my understanding is the data will still actually be in the data file until that space is reused. I'm not concerned about the ...
13
votes
2answers
7k views

How do you reset the sa password?

I lost the sa password on a machine, and when I log in to the machine directly using an account in the admin group, SQL Server Management Studio will not allow me to log in using Windows ...
12
votes
1answer
1k views

Choice of authentication approach for financial app on PostgreSQL

First some background. The LedgerSMB project is an open source financial accounting software project that runs on PostgreSQL. We implement a very large amount of business logic in user defined ...
12
votes
2answers
805 views

Understanding MS SQL Server encryption and backups

So I was asking in chat about how secure SQL Server backup files are. I'm told that if an attacker has access to the .bak file unencrypted that they can have access to the data. So lets look at ...
11
votes
2answers
3k views

Limit connection rights on SQL Server

I have an app to deploy in production that uses 'honor system' security. That is, all users connect to the DB using a SQL user/passwd credential and the app manages permissions itself. The latter part ...
10
votes
1answer
410 views

Does sys.sql_logins.is_policy_checked mean that the policy has been checked?

When I look in sys.sql_logins, I see a column called is_policy_checked. Can I trust that my password policy has been checked for all of the logins where this column is 1?
10
votes
2answers
2k views

Security for Application Developers doing PL/SQL work in Oracle

How do you handle the lack of Schema level privileges in Oracle? Oracle’s security architecture works well for applications that only need object level privileges and it works well for DBAs that need ...
10
votes
1answer
13k views

The login already has an account under a different user name

When I execute this SQL: USE ASPState GO IF NOT EXISTS(SELECT * FROM sys.sysusers WHERE NAME = 'R2Server\AAOUser') CREATE USER [R2Server\AAOUser] FOR LOGIN [R2Server\AAOUser]; GO I get the ...
9
votes
4answers
861 views

Potential risks of users connecting to SQL Server, through Excel, as sysadmin?

I recently discovered that a large swath of the finance department is using Excel to connect to my SQL Server 2000 instance with an account in the sysadmin role. What are my current risks that I ...
9
votes
3answers
4k views

Restrict access for Windows administrator

As the SQL Server best practices says, "Windows Authentication mode is more secure than SQL Authentication". And now I want to know: is there a way to protect SQL Server from user with Windows ...
9
votes
3answers
4k views

Is there a way to find out who changed the password for a login?

I am trying to find out who changed the password for a login in SQL Server 2008 R2. I have already checked default trace - and it does not log that event. The default trace will include these ...
9
votes
3answers
336 views

Any pointers on reducing my privileges in production but not making my job excessively difficult

Running SQL Server 2005 and 2008 on Windows 2008 R2. We're going to be reducing privileges in production for developers - and I'd like to do the same for myself as a DBA, limiting rights to ...
8
votes
6answers
2k views

What security threats does the SA account and other known account names pose to security?

Does an known account name like sa, pose a security threat to database? When using windows authentication on SQL Server does it impose the same password policy(if it was set to say account lockout ...
8
votes
4answers
30k views

How to get rid of ORA-28002 message the password will expire within 6 days?

I have a user getting an ORA-28002 indicating that the password will expire within six days. I ran the following: ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED; But when I try to log ...
8
votes
1answer
774 views

Column level security

I am in need of a solution to hide specific columns in a table. We have people who need to build reports against this database and specifically some of these tables with confidential information but ...
8
votes
4answers
299 views

What would I need to do to make sure my DB policies have to pass a security audit?

I have an audit coming up, and I was wondering what physical, electronic, and logical access controls an auditor would look for when auditing a database for an ERP system. I'm really new to this ...
8
votes
2answers
6k views

Can Windows Authentication logins be disabled on SQL Server 2008 (or R2)?

So we can do Windows Login or Mixed Mode, but can we configure SQL Server to only use internal logins and to block all Windows Logins? Is the only solution to add all potential Windows logins and set ...
8
votes
2answers
3k views

Is there a way to grant a user access to only all non system views of database?

In SQL Server, I have a user in a particular database and I've been asked to grant them access to all of the non-system views of the database only. I believe this can be done by editing securables of ...
8
votes
2answers
538 views

SQL Server : how to create user with access only from specific HOSTNAME or IP addres

I have one stupid app which I rely on, which has hardcoded connection string inside. To increase security of my SQL Server I'd love to make SQL users same as one hardcoded inside app, but I want to ...
8
votes
1answer
1k views

What are the security implications of sp_executesql?

By default, in SQL Server, the [public] role has EXECUTE rights on sp_executesql. However, I've inherited a database server where the previous DBA has revoked the EXECUTE right on sp_executesql. As ...
8
votes
1answer
2k views

How do I find out *why* a user has certain effective permissions?

I know that I can query effective permissions by using sys.fn_my_permissions: USE myDatabase; SELECT * FROM fn_my_permissions('dbo.myTable', 'OBJECT') entity_name | subentity_name | ...
8
votes
3answers
2k views

MySQL LDAP authentication

Is LDAP authentication and authorization in MySQL possible? What are the requirements (MySQL version, third-party software etc.)? How it's organized? Thanks.
7
votes
4answers
196 views

SQL Server: what is the reason to favor customized database roles over fixed ones?

This may be a bit vague, but I was pondering how much DBA's use fixed database roles controlling security of databases. So the question is, is there a reason to favor customized database roles over ...
7
votes
2answers
2k views

Securely generate a UNIQUEIDENTIFIER in SQL Server

I intend to be using a UNIQUEIDENTIFIER as an access key that users can use to access certain data. The key will act as a password in that sense. I need to generate multiple such identifiers as part ...
7
votes
3answers
604 views

Restricting users to COPY ONLY backups

I am looking to deploy log shipping in my production environment. This will mean I will have to manage backup chains which could be disrupted by people taking backups to refresh development ...
7
votes
3answers
878 views

Verifying password policy on existing users

I've recently come into an environment where a lot of databases logins do not have the enforce_password_policy flag enabled. An upcoming audit is necessitating the verification of these logins' ...
7
votes
3answers
264 views

How do you protect against malicious PREPROCESSOR attacks in Oracle External Tables?

I'm a new DBA and I recently found out about the option of External Tables in Oracle using the PREPROCESSOR feature ( ...
7
votes
3answers
268 views

SQL Server compatibility with New TLS Standards

The major browsers are moving beyond SSL3.0 and TLS1.0 . The PCI Security Council has declared an end-of-life date for these protocols to be considered sufficiently strong encryption. We need to ...
7
votes
2answers
8k views

Create database role to allow read access to all tables; write access to some

We have a database with over 1000 tables. I need to create a role that allows read only on all tables, as well as write access to two specific tables. I was messing around with database roles, but ...
7
votes
2answers
972 views

Is it safe to run antivirus software on my database servers?

Some implementations of antivirus software are known to Microsoft to cause a variety of problems for SQL Server, and Microsoft has a support article dedicated just to picking the right antivirus ...
7
votes
1answer
215 views

SQL Server trace based on client TCP port

I have a Windows terminal server with many different users logging in via RDP to run an application. The application makes one or more connections per user to a SQL Server 2008 R2 instance. All users ...
7
votes
2answers
57k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which ...
7
votes
3answers
9k views

How do I configure SQL Server 2012 so that it can restore and see files in my user account?

I have an SQL Server 2012 instance running as a service on my computer, and according to the service page it logs on as account "NT Service\MSSQLSERVER". However I can't see that account name ...
7
votes
1answer
2k views

Understanding SQL Server permissions

I am rooting around in SQL Server Management Studio against my instance of SQL Server 2008 R2 Express Edition. I am trying to understand how the permissions work. What I can see is (via the ...
7
votes
1answer
760 views

Map Oracle roles to Active Directory groups?

Is there any built-in way to map Oracle database roles to Microsoft Active Directory groups?
7
votes
1answer
4k views

How do you disable anonymous login? - MySQL

According to the MySQL documentation, you can harden a MySQL server by adding passwords, or removing the anonymous accounts. If you want to prevent clients from connecting as anonymous users ...
7
votes
1answer
13k views

Linked server available to users without permissions

I have users seeing a linked server which they are not supposed to see. The linked server is defined so that only I will have access to it, but everybody can see and use it. I have created the ...
7
votes
1answer
190 views

Dynamic Dimension Security

I have a cube in SSAS 2012 with about 30 dimensions, one of which is Company. The Company dimension contains a list of companies, of which there are several hundred in the cube. Our security model ...
6
votes
2answers
1k views

securely exposing sql server 2008 for windows authentication

My company wants to have approximately 100 of their sales people (distributed around the country) to be able to run stored procedures from excel and return the data onto the spreadsheet. We have sql ...
6
votes
5answers
2k views

SQL server level permissions

I am aware of the Microsoft provided code to transfer logins between SQL servers, however this only does the account and the password. What if that particular account has various roles and ...