Tag Info

Hot answers tagged

5

Microsoft has recently revealed (without a lot of fanfare) that they will be investing in TLS 1.2 and phasing out SSL. It should be relevant to all editions of SQL Server. Whether this move will affect all existing versions, just 2014 and above, or just 2016, remains to be seen. The quote below seems to imply at least 2014 will be part of the work - and I ...


5

By default, no direct access is permitted to either tables or stored procedures. One must explicitly grant access in order for non-privileged users to have access. The best practice to simplify security administration is to grant permissions to roles, and control access via role membership. If you want to restrict access only via stored procedures, take a ...


3

The /128 in the address is the NUMBER OF BITS to match... not a range. So you would want 10.8.101.0/24 (match the first 24 bits). As an additional example, if you wanted to restrict it to 10.8.101.128 to 10.8.101.255 then you'd do 10.8.101.128/25 Please see the address subsection in the documentation


2

The settings that you are looking for are stored in msmdsrv.ini \Program Files\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Config\msmdsrv.ini or <your Analysis service custom path>\OLAP\Config\msmdsrv.ini Note: Above path applies for Default installation. Its a good practice to create a backup of that file, if you are changing any config value.


2

As MySQL's documentation says: The ALL or ALL PRIVILEGES privilege specifier is shorthand. It stands for “all privileges available at a given privilege level” (except GRANT OPTION). For example, granting ALL at the global or table level grants all global privileges or all table-level privileges. Just use: GRANT ALL ON test.* TO 'admin'@'%'; ...


2

No application should require the SA account and password to operate. However, I have installed an IT Service Management product, and during the installation process you have the option to supply the SA account credentials to allow the installer to create the DB and attach an account to the DB for the software to use. The SA account credentials are not ...


2

I can confirm that as SQL 2012 SP2 CU7, which has the TLS 1.2 support for SQL 2012 from CU6, you cannot disable TLS 1.0 at the server level and be able to connect to SQL server using an un-encrypted management studio connection on an instance which does not force client encryption. This is on an instance that does not use TDE or other certificates. I will ...


2

Of course you can put it up on Dropbox - or anywhere else. Depends on how secure you want your data to be? Do you want the NSA looking at it? Dropbox employees? I would put up an encrypted version of your mysqldump and securely transmit the key to your colleague - either face to face or over encrypted email, or have the password/key sent by courrier. ...


1

Try granting EXECUTE permissions on user devel. GRANT EXECUTE ON PROCEDURE test1.yourprocedure TO 'devel'@'%'


1

You should have him send you a public gpg key that he has the private key for, which you use to encrypt the dump. You can then deliver it to him using any method that is comfortable for you, and then he can decrypt it once he has received it. If you're on Windows.. http://www.gpg4win.org/ is a great tool for that.


1

this was really nonsense. I right click on ssms and run as administrator, and added the permission there without a problem.


1

Managed service accounts are supported in SQL server 2012 onwards to run it's services. There is no 'correct' way but managed service accounts on the application server are normal domain users as the SQL Server is concerned so as long as you can use them for the application they are a nice option. You might have to type the name in (domain\appuser$) as ...


1

The best way, really, is for the web app to have no right to create or modify tables at all. It should only have the rights to do what it needs to do to perform its day to day functions, not administration. In particular, the web app must not run as a superuser and should preferably not own the database or tables. If the webapp has built-in administration ...


1

In general multiple instances do not increase security, only complexity. There are reasons to use multiple instances but I don't think they fit your situation. You have different groups of users that need administrative (sysadmin, securityadmin etc) access. One of your databases needs to be on a different side of the firewall than the rest. I'm honestly ...


1

It'll involve 1) removing the user from any database fixed roles like db_datareader (only public will remain), 2) creating a custom role in the DB, 3) granting the new role specific permissions on the one table, and 4) adding the user as a member of the new role. You'll also want to make sure public has no grants to user objects as all users in a DB are a ...


1

What you described here is absolutely normal and intended. This feature is called a global database link: http://docs.oracle.com/cd/E24693_01/server.11203/e17120/ds_concepts002.htm#i1007888 It is a "side effect" when for example Oracle Internet Directory is in use, I have seen this at a few companies who have a lot of databases. More and better ...


1

I'd say this is a good security practice to restrict OS access to your DB files. First you should definitely restrict write privileges to DB files at the OS level, if not already configured that way. Don't allow anyone other than the OS user that runs the DB to write to the DB files. Practically any DB software I can think of restricts this by default. ...



Only top voted, non community-wiki answers of a minimum length are eligible