Hot answers tagged

7

You'll need to determine how the logins have access to run DDL in master. The following query will return a list of logins with server-level role membership: SELECT ServerName = @@SERVERNAME , RoleName = roles.name , MemberName = members.name , IsEnabled = CASE WHEN members.is_disabled = 1 THEN 0 ELSE 1 END FROM sys.server_role_members srm ...


4

You can grant admin access using this code: CREATE LOGIN [DOMAIN\ADGroupName] FROM WINDOWS; GRANT CONTROL SERVER TO [DOMAIN\ADGroupName]; That will allow any user who is a member of [DOMAIN\ADGroupName] to login to SQL Server without specifying a username/password, and will grant those users admin access to the entire instance, including all databases. ...


4

Just change ownership for starters. Database ownership (the owner_sid in sys.databases) not have really have much impact on day to day operations


4

DB_NAME does not work as advertised before SQL Server 2016 (where the behaviour of DB_ID is also changed). For details, see: Information disclosure with the db_name and db_id function (Connect bug report) There is a similar situation with other metadata functions, including: suser_name suser_sname suser_sid user_id database_principal_id is_rolemember ...


4

The security concern with SMTP from a database server is the potential for disclosure of sensitive information. For example, a user that has (or gains) permissions to execute sp_send_dbmail could send an email with sensitive information. Disallowing outbound access to the default SMTP port is a security measure security folks sometimes insist upon to limit ...


4

I'd talk to your hosting provider's technical support people about this and get them to explain to you the security configuration they have on the msdb database, which is where those details are stored. By itself, the list of database names likely does not indicate a security risk. I'd ensure I wasn't giving away any details in my database names. If I had ...


3

In and of itself, no, you are probably not adding a security risk. As long as no one but a sysadmin can alter the procedure and as long as the ONLY thing the procedure can do is start a job I don't see a problem. The risks come in with the fact that MSDB is (and is supposed to be) marked as TRUSTWORTHY. That means that by using EXECUTE AS OWNER you are ...


3

Some of what you are asking for is actually pretty simple. Permissions for your AD Group You create a login for your AD group CREATE LOGIN [domain\AD Group] FROM WINDOWS Then grant it the access you want. You say you want to grant it Admin access but unless this is your DBA team I wouldn't add the AD Group to something like sysadmin. Instead grant ...


2

The two most common scenarios for security via a linked-server are: Create a SQL login on the target SQL Server, and use that login in the definition of the linked server. You then GRANT and DENY access to that login on the target server objects as necessary, using the principle of least privilege. Define the SQL Server to allow "pass through" ...


2

According to the question all you need to do is attach a predicate on query to customer table as shown below. select * from customer where company_id in(select company_id from user_info where Admin='admin_user'); Right? So you have to create a function which should return a predicate as: company_id in(select company_id from user_info where ...


2

Upgrade to a modern version of SQL Server. As the error states, you cannot specify a default schema for a group. You can in SQL Server 2012 and newer.


2

Create the procedures with AUTHID DEFINER option (this is the default if you skip this clause) in a schema who has the ALTER USER privilege. Them simply grant execute on these procedures to NOC. NOC does not need any other privileges, as the procedures will run as if their owner would have called them.


2

Yes. What you have will do what you want. I do question the need for UserA to have db_owner access even on database A though. Do they have a need to be able to drop the database? Run backups that could interrupt your backup chain? Change recovery model (same problem)? Generally even if a developer has complete control over a given database I would ...


1

Streaming replication in PostgreSQL uses the same security mechanisms as a normal frontend-backend connection. So in order to encrypt the traffic, SSL should be used, and access control should be set up. Alternatively, or additionally, consider a VPN of some kind. PostgreSQL instances aren't really meant to be run facing the open internet.



Only top voted, non community-wiki answers of a minimum length are eligible