Tag Info

New answers tagged

0

That looks like a brute force living attempt. As it is coming from a publicly routable IPv4 address that implies you database server is visible to the world which is generally a bad idea. Of you need remote access for any reason (and there are valid reasons to need this, of course) then you should only open access through you firewall from a specific address ...


4

From the 12c docs: The SYS user is automatically granted the SYSDBA privilege upon installation. When you log in as user SYS, you must connect to the database as SYSDBA or SYSOPER. Connecting as a SYSDBA user invokes the SYSDBA privilege; connecting as SYSOPER invokes the SYSOPER privilege. Oracle Enterprise Manager Database Control does not permit you ...


6

My goal is to execute a command that requires the sysadmin role (DBCC TRACEON(1224)) You are punching a hole in your security by allowing an unprivileged user run as sysadmin role. If you are trying to set 1224 traceflag, which disables lock escalation based on the number of locks, you can do it on table level using ALTER TABLE e.g. Below enables lock ...


5

It can be done but it's generally considered fairly dangerous. At a very basic level you set the trustworthy flag on the database and then when use you execute as on the sp it can take advantage of it's server level principals security access. Because of how dangerous this is I don't want to go into any detail here. However I've blogged about it here ...


0

Creating a SQL Server Agent job (owned by a sysadmin member) will do the trick, although I realize that this is not a very pretty solution. The user can start the job (ansynchronously) using msdb.dbo.sp_start_job. Running an Agent job synchronously, however, requires a few more lines of code if this is a requirement. Also, obviously, you need to have the ...


4

It's a totally pointless function that executes arbitrary SQL. It isn't SECURITY DEFINER so the only risk I think it can pose is if you allow users to run arbitrary SQL predicates or call arbitrary functions (in which case you're probably already stuffed) but try to block them from running any command they want. As you guessed, it just executes the SQL ...


2

I want to log all logons using a logon trigger from server A in server B. Ideally, if you are using Enterprise edition, then as Shawn mentioned, you can use SQL Server Audit. You can even set up a light weight server side trace and then define a WMI event notification - TRACE_FILE_CLOSE to automatically load the trace data into a table when it ...


0

SQL Server Audit is your best option if you are using Enterprise Edition, anything less (Standard) does not allow database level auditing. However you could just as well setup Extended Event session to do the auditing for you at the database level. You can set the target to a file or ring buffer. Ring buffer would require period polling to persist the data ...


1

With regard to SUPER and TRIGGER privileges, you need the TRIGGER privilege to create triggers on tables you have rights for. If you play binlogs, there is the possibility of seeing commands to create triggers on tables you do not have rights for. This is implied from the MySQL Documentation: CREATE TRIGGER requires the TRIGGER privilege for the table ...


3

I took another approach in my case. This is what I did: Create a login and map it to a database. Go to a database an create a schema called Public_View for example. The owner of this schema must be the same owner of the tables that the views are gonna refer. Grant the new user access to the new schema. Create as many views as you want in the new schema and ...


5

we're going to allow an external partner (i.e. not an employee of our org) access to this server, like so: Their credentials will own (belong to db_owner) a couple databases. A concern along with the service account being the same on multiple instances is that an outside entity can escalate their permissions quite easily. Given that outside entity is ...


5

Risk mitigation would indicate creating a separate account for each service on each machine. The level of work required to create the accounts necessary is extremely minimal, but the unknown risks that accompany not doing so are quite high, according to Microsoft's own recommendations. Microsoft Best Practices recommend using separate service accounts for ...



Top 50 recent answers are included