Tag Info

Hot answers tagged

13

The words "securely", "exposing", "outside" and "database" do not belong together. Under no circumstance should you ever expose a SQL server to the internet. It's a very bad idea. So your question really should be: How do we give access to our SQL server to remote locations? The answer: VPN. The remote users should establish a VPN connection to your ...


11

Here is a quick-and-dirty method for checking out how MySQL performs successful authentication. Please run this query: SELECT USER(),CURRENT_USER(); USER() reports how you attempted to authenticate in mysqld CURRENT_USER() reports how you were allowed to authenticate by mysqld Sometimes, USER() and CURRENT_USER() are different. That's because mysql ...


7

This appears to be a authentication scheme problem. If my memory serves correctly, the appearance of the ANONYMOUS LOGON is indicative of NTLM being used instead of Kerberos. If your SQL Server service is running under a domain credential, you will need to ensure there is a Service Principle Name (SPN) present for SQL Server. The syntax of the SetSPN ...


7

It sounds from your description like this Excel sheet will be used as a sort of interactive report. If that's the case, I encourage you to try out Reporting Services. It's included with every edition of SQL Server, ever since 2005. This way, accessing the report only requires connecting to the report server with a web browser, rather than going directly to ...


7

Yes! According to this post, you absolutely can, with significant speed improvements over OID. Looking at this absolutely ancient post, it was apparently possible back in 2003. Here's the Archive.Org transcript of the page they reference. This is a Oracle documentation link about hooking OID up to an "external directory". Good luck.


7

IMHO You do not need to physically split it up. Yet, it would be nice to cache it. If the users table uses the MyISAM Storage Engine, you have a nice advantage. Since MyISAM only caches indexes, you could do two things You could create a custom key cache just to load MyISAM index for the users table only You could index the username and password to force ...


7

I'd rather have the environment be the suffix assuming I had to pick one convention. Otherwise, it's too difficult to navigate through lists of login names that all use the same first five characters. Of course, if given my choice, I would prefer to use neither the prefix nor the suffix. I'd rather keep the same username in all environments and vary my ...


6

Windows Authentication is going to be the most secure means, as opposed to SQL Server Authentication. The reason behind this is because with Windows Authentication, the OS handles the auth as opposed to SQL Server handling it with its respective method. When you use Windows Auth, SQL Server just uses the authentication token that is stored when you log ...


6

A System DSN is stored in the registry and does not have the ability to store a password. If you want to store the password, you'd have to use a File DSN and that would require changing the CRM to use the file DSN which you say is not possible. Usually applications that use a System DSN, rely on SQL Server authentication of the users for their security. ...


6

I think you have anonymous users Try running this: SELECT user,host,password FROM mysql.user WHERE user=''; This will show what anonymous users exist. Most likely, you will see a line with a blank user, host %, and a blank password as shown below: mysql> select user,host,password from mysql.user; ...


5

A table of a couple million rows shouldn't need to be split up. Performance tuning should be done through indexes. MySpace had hundreds of millions of accounts listed in a single table and performance on that table was just fine. (I was a DBA for MySpace at the height of their usage.) The table in that case was probably 80-90 bytes wide (maybe a little ...


5

An example, separation of duties On a web server, the password for the service account is only known by one team. It isn't required to lie around in web.config or source control. One team sets up the IIS App Pool (password is known here) One team deploys code One team manages the SQL Server Instance If you want to pass an audit where PCI or SoX is ...


5

You can have your app impersonate a windows user and do the connection that way. Example for ASP.net app.


5

You are attempting to pass Windows credentials in plain text from the connection string of an application. This simply isn't how Windows authentication works, and largely defeats the purpose. You also can't just create the same username with the same password in your own domain, and expect that to magically work. Domain name is still part of the validation ...


5

This error does not sound like a problem with the password at all, but rather a connectivity issue. It could be that some policy is re-establishing firewall rules, or it could be simply that you have flaky DNS, an unreliable connection to the domain controller, or some other network issue. As @Thomas pointed out, the "pipe" in the error message implies that ...


5

The IPv6 addresses starting with fe80: are link-local addresses. They cannot be routed across different subnets or the internet. They are for communication between machines connected to the same LAN only. The link-local range is defined as fe80::/10. If you trust everybody on your local LAN then you could do host all all fe80::/10 trust If you don't ...


4

This is a long-standing bug in the GUI tools. However, as long as your password does not contain a double quote (") character, then you can work around this by putting double quotes around the password to connect. connect to sample user test using test! --> SQL0104N connect to sample user test using "test!" --> connection succeeded. This method ...


4

there are no users and groups in postgres anymore (> 8.2?), there are only ROLEs, roles may or may not be able to login. Not that this matters much as CREATE USER and CREATE GROUP are just aliases for CREATE ROLE. As @Peter Eisentraut says this code should work fine. Some of the bigger differences I noticed in this area, outside of the fact that Postgres ...


4

With Windows authentication the username and password are never transmitted to the SQL Server. Only the users Kerberos or NTLM token are passed. With SQL authentication the actual username and password are passed, but they are not passed in clear text. The authentication process is encrypted via SSL with a self signed certificate to ensure that the ...


4

When working with SQL Logins you "group" them by using roles within SQL Server. Roles are created at the database-level but with SQL Server 2012 you will be able to create them at the server-level as well. Once the role is created you can assign specific permissions to that group and it will be applied to the logins that are member of that role. The roles ...


4

use OpenDS with MySQL cluster to implement LDAP I think this will help a bit...


4

Create matching usernames and passwords. It really is that simple. For your example, create an account for User1 on Server1 with the same password as on PC1. Just in case this is an issue you're having with connecting SSMS with a non-domain account, that requires jumping through an additional hoop. Some applications don't support stored usernames and ...


4

DEFAULT_SCHEMA is ignored if the user is a member of the sysadmin fixed role. If DOMAIN\Glen is in the sysadmin role, the default schema is always dbo and you have to explicitly use the schema name.


4

In my view Windows Authentication is still more secure. Just. With windows authentication you can allow a group of people (via a Windows Group) to have access to the database. Only those users can use an application, any application, to connect to the database. If you use a SQL Server account then anyone who knows the credentials (and invariably these ...


4

Follow the steps on Connect to SQL Server When System Administrators Are Locked Out. Start server with -m, connect as local admin, enable [sa], retsart server normally. Read the link.


4

Correct Answer: It looks like SSMS looks at the context of the user who opens up SSMS itself, and not the user who connects to the DB engine. I was able to log in to MS SQL Server as a SQL Server user and I was still able to restart the service under these 2 conditions: Logged in directly into the server via RDP as a user with admin or start/stop services ...


4

Do the username and password match between the network pc and the sql machine? I also found this link regarding, xp home. I am not sure what version of XP you are using. http://serverfault.com/questions/54761/pass-through-authentication-does-not-work-with-a-specific-account-in-windows-xp


4

After researching, I found that we need to find the pg_hba.conf file under C:\Program Files\PostgreSQL\9.3\data Run the notepad++ as administrator (or the editor you usually use to edit the files) Open the file and at the very bottom, look for # TYPE DATABASE USER ADDRESS METHOD For all the entries for TYPE host, ...


4

It would be better to store the credentials in a config file, and load them as an extra-defaults file: $ mysqldump --defaults-extra-file=mycred.cnf ... The config file is the same format as /etc/my.cnf or ~/.my.cnf $ cat mycred.cnf [mysqldump] user = myuser password = xyzzy MySQL 5.6 also introduces encrypted storage of credentials. You can set up an ...


3

Do you actually have 2 million users? Unless you already have this problem or are certain that you will, you are optimizing way ahead of time. Add a compound index on login and password fields and be done with it. Don't optimize unless you know you actually have a problem to solve. I'm certain you have bigger problems to solve.



Only top voted, non community-wiki answers of a minimum length are eligible